diff --git a/packages/xpub-faraday/config/authsome.js b/packages/xpub-faraday/config/authsome.js index 1ad14f2eb9d9239a1ee7b98a7ac01e697fcdc378..ecda1b81754c35d9abf84203860fa5e3d18941d0 100644 --- a/packages/xpub-faraday/config/authsome.js +++ b/packages/xpub-faraday/config/authsome.js @@ -183,8 +183,8 @@ const authsomeMode = async (userId, operation, object, context) => { // authorization/authsome mode, e.g. const user = await context.models.User.find(userId) - // Admins can do anything - if (user && user.admin === true) return true + // Admins and editor in chiefs can do anything + if (user && (user.admin === true || user.editorInChief === true)) return true if (user) { return authenticatedUser(user, operation, object, context)