Function requireAdmin

server/src/middleware/auth.ts:1169–1325

(req: Request, res: Response, next: NextFunction)

 * Or checks if user's email is in ADMIN_EMAILS list
 */
export async function requireAdmin(req: Request, res: Response, next: NextFunction) {
  const isHtmlRequest = req.accepts('html') && !req.originalUrl.startsWith('/api/');

  // Check for static admin API key (set by requireAuth)
  if ((req as Request & { isStaticAdminApiKey?: boolean }).isStaticAdminApiKey) {
    logger.debug({ path: req.path, method: req.method }, 'Admin access via static admin API key');
    return next();
  }

  // Check for WorkOS API key with admin permission
  const apiKey = (req as Request & { apiKey?: ValidatedApiKey }).apiKey;
  if (apiKey) {
    const isReadOnlyRequest = req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS';

    // admin:* grants full access (read and write)
    if (apiKeyHasPermission(apiKey, 'admin:*')) {
      logger.debug({ path: req.path, method: req.method, apiKeyId: apiKey.id }, 'Full admin access via WorkOS API key');
      return next();
    }

    // admin:read only grants access to read operations
    if (apiKeyHasPermission(apiKey, 'admin:read') && isReadOnlyRequest) {
      logger.debug({ path: req.path, method: req.method, apiKeyId: apiKey.id }, 'Read-only admin access via WorkOS API key');
      return next();
    }

    // API key exists but doesn't have sufficient permission
    return res.status(403).json({
      error: 'Insufficient permissions',
      message: isReadOnlyRequest
        ? 'This API key does not have admin access. Required permission: admin:* or admin:read'
        : 'This API key does not have write access. Required permission: admin:*',
      api_key_permissions: apiKey.permissions,
    });
  }

  // Dev mode: check if dev user has admin flag
  if (DEV_MODE_ENABLED) {
    const devUser = getDevUser(req);
    if (!devUser) {
      // Not logged in
      if (isHtmlRequest) {
        return res.redirect(`/auth/login?return_to=${encodeURIComponent(req.originalUrl)}`);
      }
      return res.status(401).json({
        error: 'Authentication required',
        message: 'Please log in to access this resource',
        login_url: '/auth/login',
      });
    }

    // Set user on request if not already set
    if (!req.user) {
      const mockUser = createDevUser(req);
      if (mockUser) {
        req.user = mockUser;
        req.accessToken = 'dev-mode-token';
      }