fix: allow authenticated users to access /users/status route

[AnujChhikara]

Date: 22 Jul , 2026

Developer Name: @AnujChhikara

---

Issue Ticket Number

• NA

Tech Doc Link

• NA

Business Doc Link

• NA

Description

PR #2599 temporarily restricted GET /users/status to super users (authorizeRoles([SUPERUSER])) to mitigate high Firestore reads on the usersStatus collection, leaving a TODO to revisit whether the route should stay protected.

Since then, we have added pagination to this route and done the query optimization for it (active-users-first, paginated, batched reads), which addressed the high Firestore read concern that motivated the restriction. Because that optimization is now in place, the super_user restriction is no longer needed, so this PR reverts GET /users/status to a normally authenticated route.

• routes/userStatus.js: GET / now runs authenticate -> validateGetQueryParams -> getUserStatusControllers (dropped authorizeRoles([SUPERUSER])), and removed the obsolete super_user TODO comment.
• test/integration/userStatus.test.js: switched the GET /users/status tests from the super_user token back to a normal user token so they assert a regular authenticated user can access the route. The unauthorized (401) test is retained.

Note: the super_user restriction on /users/search (also added in #2599) is intentionally left unchanged; this PR scopes only to /users/status.

Documentation Updated?

• Yes
• No

Under Feature Flag

• Yes
• No

Database Changes

• Yes
• No

Breaking Changes

• Yes
• No

Development Tested?

• Yes
• No

Screenshots

Screenshot 1

Test Coverage

Screenshot 1

Additional Notes

[coderabbitai]

Walkthrough

The user status GET route now requires authentication and query validation, but no longer restricts access to SUPERUSER users.

Changes

User status access control

Layer / File(s)	Summary
Update user status middleware routes/userStatus.js	Removes authorizeRoles([SUPERUSER]) from the GET route while retaining authentication, query validation, and controller execution.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• RealDevSquad/website-backend#2599: Modifies the same route’s middleware authorization chain by adding the SUPERUSER requirement.

Poem

A bunny hops past the guarded door,
Auth still checks, but roles no more.
Queries validated, status in sight,
The route now welcomes a wider light. 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly describes the main change: removing the superuser restriction from the /users/status route.
Description check	✅ Passed	The description is directly related to the changes and accurately explains the route and test updates.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[prakashchoudhary07]

Is this used in by any of the other services, where we might have to look into it?