From 28a3c6121a4102e074c1e69ea8e5d6e7c1a10d9a Mon Sep 17 00:00:00 2001
From: "[dyad]" <cetinmustafa83@gmail.com>
Date: Sun, 2 Aug 2026 11:54:28 +0200
Subject: [PATCH] =?UTF-8?q?[dyad]=20Dashboard=20rol=20regresyonunu=20d?=
 =?UTF-8?q?=C3=BCzelt?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/lib/route-middleware.ts | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/lib/route-middleware.ts b/src/lib/route-middleware.ts
index 298ac01..3ac97d5 100644
--- a/src/lib/route-middleware.ts
+++ b/src/lib/route-middleware.ts
@@ -1,7 +1,8 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { getSession } from '@/lib/auth';
 import { logComplianceAudit } from '@/lib/audit';
-import { successResponse, unauthorizedError, forbiddenError } from '@/lib/api-response';
+import { unauthorizedError, forbiddenError } from '@/lib/api-response';
+import { hasRoleAccess, type AppRole } from '@/lib/role-access';
 
 export type RouteHandler = (
   request: NextRequest,
@@ -46,7 +47,7 @@ export const withRoles = (allowedRoles: string[]) => {
       }
 
       const userRole = session.user?.role;
-      if (!allowedRoles.includes(userRole)) {
+      if (!hasRoleAccess(userRole, allowedRoles as AppRole[])) {
         return forbiddenError(request.url);
       }
 
@@ -72,7 +73,7 @@ export const withAudit = (action: string) => {
         try {
           await logComplianceAudit({
             userId: user.id,
-            schoolId: user.schoolId,
+            schoolId: user.schoolId ?? undefined,
             action,
             entityType: request.url.split('/').pop() || 'unknown',
             metadata: {