From 9c5ba61ab5cd85748778b75fd7fac56eba0702a0 Mon Sep 17 00:00:00 2001
From: dv <dv@caps.caps>
Date: Wed, 15 Apr 2026 12:01:31 +0300
Subject: [PATCH] =?UTF-8?q?=D1=84=D0=B8=D0=BA=D1=81=20=D1=81=D1=82=D0=B0?=
 =?UTF-8?q?=D1=82=D0=B8=D1=81=D1=82=D0=B8=D0=BA=D0=B8=209?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 server.js | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/server.js b/server.js
index 2905131..0f7d375 100644
--- a/server.js
+++ b/server.js
@@ -540,8 +540,7 @@ app.get('/api/client-users', auth, (req, res) => {
   res.json(result);
 });
 
-app.post('/api/admin/sync-client-users', auth, (req, res) => {
-  if (!req.user?.is_admin) return res.status(403).json({ error: 'forbidden' });
+app.post('/api/admin/sync-client-users', auth, adminOnly, (req, res) => {
   refreshService.syncClientUsers()
     .then(() => {
       const count = db.prepare('SELECT COUNT(*) as c FROM client_users').get();