hot fix #1

internal/middleware/auth.go

@@ -157,7 +157,13 @@ func RoleAuth(requiredRole string) gin.HandlerFunc {
 			return
 		}
 
-		// Check if user has the required role
+		// Editors are allowed to access routes that require either "editor" or "admin"
+		if userRole == "editor" && (requiredRole == "editor" || requiredRole == "admin") {
+			c.Next()
+			return
+		}
+
+		// Check if user has the required role exactly
 		if userRole != requiredRole {
 			c.JSON(http.StatusForbidden, gin.H{"error": "Insufficient permissions"})
 			c.Abort()