diff --git a/backend/internal/http/handler/user_handler.go b/backend/internal/http/handler/user_handler.go index ca0d4dc..4729c0c 100644 --- a/backend/internal/http/handler/user_handler.go +++ b/backend/internal/http/handler/user_handler.go @@ -92,9 +92,10 @@ func (h *Handler) ListUsers(w http.ResponseWriter, r *http.Request) { companyFilter = &id } - if strings.EqualFold(requester.Role, "Seller") { + // Non-admin users can only see users from their own company + if !strings.EqualFold(requester.Role, "Admin") { if requester.CompanyID == nil { - writeError(w, http.StatusBadRequest, errors.New("seller must include X-Company-ID header")) + writeError(w, http.StatusBadRequest, errors.New("user must have a company associated")) return } companyFilter = requester.CompanyID