fix: allowlist role authoritative on every authed request

auth/dependencies.py

@@ -4,6 +4,7 @@ FastAPI dependency for authenticated routes.
 from fastapi import Depends, Header, HTTPException, status
 from sqlalchemy.orm import Session
 
+from auth.roles import ensure_role
 from auth.utils import decode_access_token
 from db.database import get_db
 from db.models import User
@@ -23,4 +24,12 @@ def get_current_user(
     user = db.query(User).filter(User.id == user_id).first()
     if not user:
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="User not found")
+    # The email allowlist is authoritative on EVERY authenticated request — not
+    # just login — so downstream gates (e.g. premium generation) never see a
+    # stale role='user' for an allowlisted SUPER_ADMIN. Idempotent after the
+    # first upgrade. Non-fatal if the write fails (still returns the user).
+    try:
+        ensure_role(user, db)
+    except Exception:
+        db.rollback()
     return user

auth/roles.py

@@ -0,0 +1,38 @@
+"""
+Role resolution — the SUPER_ADMIN allowlist is the single source of truth.
+
+Lives in the `auth` layer (not `api`) so BOTH the auth endpoints and the
+`get_current_user` dependency can apply it. Previously the allowlist upgrade
+only ran during login/`/me`, so a request authenticated with a token whose DB
+row still said `role='user'` (e.g. a SUPER_ADMIN email that logged in before the
+upgrade persisted) was treated as a normal user by downstream gates like the
+premium generation flow. Applying it in `get_current_user` makes every
+authenticated request authoritative.
+"""
+import os
+
+from sqlalchemy.orm import Session
+
+from db.models import User
+
+# ponytail: small allowlist drives the SUPER_ADMIN role (env-overridable, comma-separated).
+SUPER_ADMIN_EMAILS: set[str] = {
+    e.strip().lower()
+    for e in os.environ.get("SUPER_ADMIN_EMAILS", "proff.pratiksingh@gmail.com").split(",")
+    if e.strip()
+}
+
+
+def resolve_role(email: str) -> str:
+    """Role is fully determined by the email allowlist (case-insensitive)."""
+    return "SUPER_ADMIN" if (email or "").lower() in SUPER_ADMIN_EMAILS else "user"
+
+
+def ensure_role(user: User, db: Session) -> str:
+    """Set the user's role from the allowlist, persisting an upgrade to
+    SUPER_ADMIN once. Idempotent: after the first upgrade it only reads."""
+    role = resolve_role(user.email)
+    if getattr(user, "role", None) != role and role == "SUPER_ADMIN":
+        user.role = role
+        db.commit()
+    return role