修复1

src/security/session.mjs

@@ -1,4 +1,9 @@
 export function createSessionManager({ sessions, readDb, sendError }) {
+  function normalizeUser(user) {
+    if (user?.role === 'admin' && !user.adminLevel) return { ...user, adminLevel: 'super' };
+    return user;
+  }
+
   function parseCookies(request) {
     return Object.fromEntries(String(request.headers.cookie || '').split(';').map(part => part.trim()).filter(Boolean).map(part => {
       const index = part.indexOf('=');
@@ -15,7 +20,7 @@ export function createSessionManager({ sessions, readDb, sendError }) {
     }
     const db = await readDb();
     const user = db.users.find(item => item.id === session.userId) || null;
-    return user?.active === false || user?.archivedAt ? null : user;
+    return user?.active === false || user?.archivedAt ? null : normalizeUser(user);
   }
   
   function safeUser(user) {
@@ -23,7 +28,7 @@ export function createSessionManager({ sessions, readDb, sendError }) {
       id: user.id,
       username: user.username,
       role: user.role,
-      adminLevel: user.adminLevel || null,
+      adminLevel: user.role === 'admin' ? user.adminLevel || 'super' : null,
       schoolId: user.schoolId || null,
       classId: user.classId || null,
       displayName: user.displayName,