Phase 3 + 6

inventory-server/src/routes/config.js

@@ -1,10 +1,13 @@
-const express = require('express');
+import express from 'express';
+import { requireAdmin } from '../../shared/auth/middleware.js';
+
 const router = express.Router();
 
-// Debug middleware
+// Phase 6.2: global settings are admin-only on write. Reads pass through to any
+// authenticated user (the server-level authenticate() already gates that).
 router.use((req, res, next) => {
-  console.log(`[Config Route] ${req.method} ${req.path}`);
-  next();
+  if (req.method === 'GET' || req.method === 'HEAD' || req.method === 'OPTIONS') return next();
+  return requireAdmin(req, res, next);
 });
 
 // ===== GLOBAL SETTINGS =====
@@ -322,4 +325,4 @@ router.post('/vendors/:vendor/reset', async (req, res) => {
 });
 
 // Export the router
-module.exports = router; 
+export default router;