From a8e22e63bc5ad8898ea7a279ee96fb1e27f94c44 Mon Sep 17 00:00:00 2001
From: Xor290 <free6nk33@gmail.com>
Date: Mon, 18 May 2026 12:30:36 +0200
Subject: [PATCH] fix(security): modify law for create users and clients

---
 backend/gestion/handlers/auth.go | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/backend/gestion/handlers/auth.go b/backend/gestion/handlers/auth.go
index aa53c5c7..e96d47c2 100644
--- a/backend/gestion/handlers/auth.go
+++ b/backend/gestion/handlers/auth.go
@@ -181,6 +181,11 @@ func RegisterClient(c *gin.Context) {
 
 // AdminCreateClient crée un client depuis l'interface admin (sans session ni token)
 func AdminCreateClient(c *gin.Context) {
+	if userRole := c.GetString("role"); userRole != "admin" {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Seul un administrateur peut créer des clients"})
+		return
+	}
+
 	var req models.RegisterClientRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
 		log.Printf("❌ [ADMIN_CREATE_CLIENT] Binding error: %v | body: username=%q nom=%q prenom=%q tel=%q", err, req.Username, req.Nom, req.Prenom, req.Telephone)
@@ -821,8 +826,8 @@ func CreateUser(c *gin.Context) {
 		return
 	}
 	userRole := c.GetString("role")
-	if userRole != "cabine" && userRole != "admin" {
-		c.JSON(http.StatusForbidden, gin.H{"error": "Accès réservé aux livreurs et aux administrateurs"})
+	if userRole != "admin" {
+		c.JSON(http.StatusForbidden, gin.H{"error": "Seul un administrateur peut créer des utilisateurs"})
 		return
 	}
 	err := database.CreateUser(&user)