fixed members login and permissions issues

src/servers/_middlewares/rate-limiter.ts

@@ -49,20 +49,22 @@ export function rateLimiter(options: RateLimiterOptions): MiddlewareHandler {
     const now = Date.now();
     const entry = store.get(key);
 
-    if (entry && entry.resetAt > now) {
-      if (entry.count >= max) {
-        const retryAfter = Math.ceil((entry.resetAt - now) / 1000);
-        throw errors.TOO_MANY_REQUESTS(message, retryAfter);
-      }
-      entry.count++;
-    } else {
-      store.set(key, {
-        count: 1,
-        resetAt: now + windowMs,
-      });
+    if (entry && entry.resetAt > now && entry.count >= max) {
+      const retryAfter = Math.ceil((entry.resetAt - now) / 1000);
+      throw errors.TOO_MANY_REQUESTS(message, retryAfter);
     }
 
     await next();
+
+    // Only count failed attempts (4xx status codes)
+    const status = ctx.res.status;
+    if (status >= 400 && status < 500) {
+      if (entry && entry.resetAt > now) {
+        entry.count++;
+      } else {
+        store.set(key, { count: 1, resetAt: now + windowMs });
+      }
+    }
   };
 }
 

src/servers/_middlewares/user-middleware.ts

@@ -7,7 +7,7 @@ import { officerdb, eq, Users, TokenBlacklist } from 'officerdb';
 // Role permissions: which HTTP methods each role can use
 // Roles not listed here are denied by default (fail-safe)
 const ROLE_PERMISSIONS: Record<string, string[]> = {
-  Member: ['GET'],
+  Member: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
   Admin: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
   Owner: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
   'Super Admin': ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],