Update main.py

main.py

@@ -136,15 +136,33 @@ def send_rotation_notification(job_id, shift_record):
 
 # === Auth Middleware ===
 def verify_token(req):
-    token = req.headers.get("Authorization")
-    if not token:
+    auth_header = req.headers.get("Authorization")
+    if not auth_header:
         return None
+    
     try:
-        decoded = firebase_auth.verify_id_token(token.replace("Bearer ", ""))
-        if decoded["email"] not in ADMIN_EMAILS:
-            return None
-        return decoded
-    except:
+        # Extract token
+        if auth_header.startswith("Bearer "):
+            token = auth_header[7:].strip()
+        else:
+            token = auth_header.strip()
+            
+        # Verify the token
+        decoded = firebase_auth.verify_id_token(token)
+        
+        # Get user UID from decoded token
+        uid = decoded.get('uid')
+        
+        # Check if user is admin by querying Firebase Realtime Database
+        admins_ref = db.reference("/admins")
+        admin_data = admins_ref.child(uid).get()
+        
+        if admin_data and admin_data.get("is_admin", False):
+            return decoded
+        
+        return None
+    except Exception as e:
+        print(f"Token verification error: {e}")
         return None
 
 # === Admin Setup ===