The route had a redundant isAuthed() checking for 'bpb_admin' cookie, but login sets 'admin_token'. The middleware already guards all /api/admin/* routes, so the in-route check was just wrong. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Description
No description provided
Languages
TypeScript
52.6%
JavaScript
21%
HTML
11.2%
CSS
8%
Shell
6.6%
Other
0.6%