From ba21363eae45a9cb4d247949cacffe92737ae004 Mon Sep 17 00:00:00 2001
From: andwati <andwatiian@gmail.com>
Date: Tue, 13 Jan 2026 19:21:20 +0300
Subject: [PATCH] fixed 403 errror on order creation

---
 package.json                      |  3 +-
 src/middleware/role.middleware.ts |  6 ++--
 src/routes/order.routes.ts        |  2 +-
 src/scripts/seed.ts               | 57 +++++++++++++++++++++++++++++++
 4 files changed, 64 insertions(+), 4 deletions(-)
 create mode 100644 src/scripts/seed.ts

diff --git a/package.json b/package.json
index 5cbc578..0d7c67d 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,8 @@
     "lint": "eslint . --ext .ts",
     "lint:fix": "eslint . --ext .ts --fix",
     "prettier": "prettier --check .",
-    "prettier:fix": "prettier --write ."
+    "prettier:fix": "prettier --write .",
+    "seed": "tsc && node dist/scripts/seed.js"
   },
   "keywords": [],
   "author": "",
diff --git a/src/middleware/role.middleware.ts b/src/middleware/role.middleware.ts
index 47ac54e..791e0e4 100644
--- a/src/middleware/role.middleware.ts
+++ b/src/middleware/role.middleware.ts
@@ -1,6 +1,8 @@
 import type { Request, Response, NextFunction } from "express";
 
-export function requireRole(role: "admin" | "customer") {
+export function requireRole(roles: "admin" | "customer" | ("admin" | "customer")[]) {
+  const allowedRoles = Array.isArray(roles) ? roles : [roles];
+
   return (req: Request, _res: Response, next: NextFunction) => {
     if (!req.user) {
       return next({
@@ -9,7 +11,7 @@ export function requireRole(role: "admin" | "customer") {
       });
     }
 
-    if (req.user.role !== role) {
+    if (!allowedRoles.includes(req.user.role as "admin" | "customer")) {
       return next({
         statusCode: 403,
         message: "Forbidden",
diff --git a/src/routes/order.routes.ts b/src/routes/order.routes.ts
index 9ee1db6..7d5dd8e 100644
--- a/src/routes/order.routes.ts
+++ b/src/routes/order.routes.ts
@@ -44,7 +44,7 @@ const router: Router = Router();
 router.post(
   "/",
   authMiddleware,
-  requireRole("customer"),
+  requireRole(["customer", "admin"]),
   validate(createOrderSchema),
   OrderController.create,
 );
diff --git a/src/scripts/seed.ts b/src/scripts/seed.ts
new file mode 100644
index 0000000..ece79fb
--- /dev/null
+++ b/src/scripts/seed.ts
@@ -0,0 +1,57 @@
+import { connectDB } from "../config/db.js";
+import { ProductModel } from "../models/product.model.js";
+import mongoose from "mongoose";
+import { logger } from "../utils/logger.js";
+
+const PRODUCTS = [
+  {
+    name: "Wireless Mouse",
+    price: 2500, // $25.00
+    stock: 100,
+  },
+  {
+    name: "Mechanical Keyboard",
+    price: 12000, // $120.00
+    stock: 50,
+  },
+  {
+    name: "USB-C Hub",
+    price: 4500, // $45.00
+    stock: 75,
+  },
+  {
+    name: "Monitor Stand",
+    price: 3500, // $35.00
+    stock: 200,
+  },
+  {
+    name: "Gaming Headset",
+    price: 8000, // $80.00
+    stock: 30,
+  }
+];
+
+async function seed() {
+  try {
+    logger.info("Connecting to database...");
+    await connectDB();
+    logger.info("Connected to database.");
+
+    logger.info("Clearing products...");
+    await ProductModel.deleteMany({});
+    logger.info("Products cleared.");
+
+    logger.info("Seeding products...");
+    await ProductModel.insertMany(PRODUCTS);
+    logger.info("Products seeded successfully.");
+
+    process.exit(0);
+  } catch (error) {
+    logger.error("Error seeding database:", { error });
+    process.exit(1);
+  } finally {
+    await mongoose.disconnect();
+  }
+}
+
+seed();