Update routes/auth.js

routes/auth.js

@@ -7,10 +7,30 @@ const { User, Student, ClassModel, NotificationModel, School } = require('../mod
 const getQueryFilter = (req) => { 
   const s = req.headers['x-school-id']; 
   const role = req.headers['x-user-role'];
+  
+  // 1. If requester is a Principal, they only see their own school's data
   if (role === 'PRINCIPAL') {
       if (!s) return { _id: null }; 
       return { schoolId: s };
   }
+
+  // 2. If requester is ADMIN (Super Admin)
+  if (role === 'ADMIN') {
+      // If filtering by a specific school (e.g. from dropdown), return that school's data
+      if (s) return { schoolId: s };
+      
+      // If fetching "Global" list (no specific school selected or 'All' selected):
+      // We want to see:
+      // a) Users with NO schoolId (e.g. pending principals creating schools)
+      // b) Users from ALL schools (if we want a truly global list, we might remove the filter entirely, 
+      //    but usually 'getQueryFilter' is used to scope data. 
+      //    For the "User Management" page specifically, the route handler below handles the global flag.)
+      
+      // Default behavior for other resources (like students/classes) when admin hasn't selected a school:
+      return {}; 
+  }
+
+  // 3. Teachers/Students
   if (!s) return {};
   return { 
     $or: [
@@ -105,9 +125,28 @@ router.post('/update-profile', async (req, res) => {
 
 // --- User Management Routes ---
 router.get('/', async (req, res) => {
-    const filter = getQueryFilter(req);
+    let filter = {};
+    
+    // If requesting "Global" list (e.g. Admin Panel with 'global=true'), ignore school filter
+    if (req.query.global === 'true' && req.headers['x-user-role'] === 'ADMIN') {
+        filter = {}; // Return all users
+    } else {
+        // Otherwise apply standard school scoping
+        filter = getQueryFilter(req);
+    }
+
     if (req.headers['x-user-role'] === 'PRINCIPAL') filter.role = { $ne: 'ADMIN' };
     if (req.query.role) filter.role = req.query.role;
+    
+    // Special case: If Admin is viewing a specific school, but we also want to see 
+    // pending principals who HAVE NO schoolId yet (the "creating school" case),
+    // we need to OR the query.
+    // However, the UI usually separates "Global View" vs "School View". 
+    // If Admin is in "Global View", they will see everything (including empty schoolId).
+    // If Admin selects a school, they only see that school's users.
+    // The issue was likely that `getQueryFilter` was being applied strictly even for global admin view.
+    // The change above (checking `req.query.global`) fixes this.
+
     res.json(await User.find(filter).sort({ createTime: -1 })); 
 });