last update

lib/admin-auth.ts

@@ -297,6 +297,23 @@ export async function isAdminAuthenticated(): Promise<boolean> {
   return verifyToken(token);
 }
 
+/**
+ * This project has no user accounts or roles table — there is a single
+ * privileged session: the authenticated admin cookie checked above. There is
+ * no separate "regular user" tier, so an authenticated admin session is by
+ * definition the only "Super Admin". This is a readable alias only, kept as
+ * a thin wrapper around `isAdminAuthenticated()` (not a new auth mechanism).
+ *
+ * Security note: this function (and any UI it gates, like the header's admin
+ * shortcut button) is NOT the access-control boundary. Every admin page and
+ * server action must independently guard itself with `requireAdminAuth()` or
+ * an equivalent inline `isAdminAuthenticated()` check — never rely on a link
+ * being hidden as the thing that keeps the admin area protected.
+ */
+export async function isSuperAdmin(): Promise<boolean> {
+  return isAdminAuthenticated();
+}
+
 /**
  * Call at the top of every authenticated admin page or server action.
  * Clears the session cookie and redirects to the login page if not authenticated.