# How Super Admins Bypass Credit Requirements in Awesome‑GPT‑Image‑2

> Discover how super admins bypass credit requirements in Awesome-GPT-Image-2. Learn the three-layer mechanism involving environment variables, user profiles, and Supabase RPC flags for seamless access.

- Repository: [苍何/awesome-gpt-image-2](https://github.com/freestylefly/awesome-gpt-image-2)
- Tags: how-to-guide
- Published: 2026-09-04

---

**Super admins bypass credit requirements in awesome‑gpt‑image‑2 through a three‑layer mechanism that identifies privileged emails via the `SUPER_ADMIN_EMAILS` environment variable, sets `isSuperAdmin: true` on the user profile, and passes a `p_force_credit` flag to the Supabase RPC that skips balance validation.**

In the freestylefly/awesome‑gpt‑image‑2 repository, super administrators can generate images without depleting their credit balance. This privilege is enforced through a combination of email‑based identification, role elevation, and database‑level flag bypassing that operates seamlessly during the image generation workflow.

## Super Admin Identification via Environment Configuration

The system recognizes super admins before any generation request is processed by checking the `SUPER_ADMIN_EMAILS` environment variable.

### Email Verification in supabase.js

In [`api/_lib/supabase.js`](https://github.com/freestylefly/awesome-gpt-image-2/blob/main/api/_lib/supabase.js) at lines 49‑52, the `isSuperAdminEmail` function validates whether the authenticated user’s email appears in the designated super admin list. This check serves as the primary gatekeeper for elevated privileges.

### Profile Elevation and Normalization

Once identified, the `profilePayloadFromUser` function (lines 81‑92 of [`api/_lib/supabase.js`](https://github.com/freestylefly/awesome-gpt-image-2/blob/main/api/_lib/supabase.js)) automatically assigns the `super_admin` role to matching users. Subsequently, the `normalizeProfile` function (lines 100‑105) attaches the boolean flag `isSuperAdmin: true` to the profile object, making the privilege available throughout the application lifecycle for authorization decisions.

## Bypassing Credit Validation with Force Flags

When a generation request is initiated, the system leverages the `isSuperAdmin` flag to skip standard balance checks without modifying the core credit logic for regular users.

### The reserveGeneration Flow

In [`api/generate-image.js`](https://github.com/freestylefly/awesome-gpt-image-2/blob/main/api/generate-image.js) at lines 35‑36, the `reserveGeneration` function passes `p_force_credit: Boolean(profile?.isSuperAdmin)` as a parameter to the Supabase `reserve_generation_usage` RPC. This boolean flag explicitly instructs the stored procedure to treat the reservation as privileged.

### Database‑Level Permission Override

The stored procedure interprets `p_force_credit` as a directive to bypass the standard credit‑sufficiency validation. When this flag evaluates to `true`, the reservation succeeds regardless of the user's current credit balance, effectively granting unlimited generation capability to super admin accounts while maintaining strict accounting for regular users.

## Endpoint Authorization Guards

Admin‑only endpoints enforce the `super_admin` role to prevent unauthorized access to privileged operations. For example, [`api/admin/users.js`](https://github.com/freestylefly/awesome-gpt-image-2/blob/main/api/admin/users.js) at line 41 verifies that the caller’s profile carries the `super_admin` role before processing sensitive requests. This ensures that only accounts listed in `SUPER_ADMIN_EMAILS` can invoke the credit‑bypassing generation path, adding a final security layer to the privilege escalation chain.

## Implementation Code Examples

The following patterns demonstrate how to check super admin status and invoke the bypass mechanism in your own extensions:

```javascript
// Identify a super admin by email
import { isSuperAdminEmail } from './_lib/supabase.js';

const email = 'admin@example.com';
if (isSuperAdminEmail(email)) {
  console.log('User is a super-admin'); // role will be set to "super_admin"
}

```

```javascript
// Reserve generation with forced credit bypass
import { reserveGeneration } from './generate-image.js';
import { getAuthContext } from './_lib/supabase.js';

async function generate(req) {
  const auth = await getAuthContext(req);
  const reservation = await reserveGeneration(
    auth.client,
    auth.profile,          // profile.isSuperAdmin === true
    auth.user.id,
    caseId,
    prompt
  );
  // No credit error will be thrown for a super-admin
}

```

## Summary

- **Email‑based identification**: The `isSuperAdminEmail` function in [`api/_lib/supabase.js`](https://github.com/freestylefly/awesome-gpt-image-2/blob/main/api/_lib/supabase.js) checks against the `SUPER_ADMIN_EMAILS` environment variable to designate privileged accounts.
- **Profile flagging**: The `normalizeProfile` function sets `isSuperAdmin: true`, which persists throughout the session for authorization checks.
- **RPC bypass**: The `reserveGeneration` function passes `p_force_credit` to the Supabase stored procedure, forcing the reservation to skip credit validation for super admins.
- **Endpoint protection**: Admin routes like [`api/admin/users.js`](https://github.com/freestylefly/awesome-gpt-image-2/blob/main/api/admin/users.js) verify the `super_admin` role to ensure only authorized accounts access privileged workflows.

## Frequently Asked Questions

### How is a super admin identified in the system?

A super admin is identified by the `isSuperAdminEmail` function in [`api/_lib/supabase.js`](https://github.com/freestylefly/awesome-gpt-image-2/blob/main/api/_lib/supabase.js), which checks if the user’s email exists in the comma‑separated `SUPER_ADMIN_EMAILS` environment variable. Matching emails trigger automatic role assignment to `super_admin` during profile creation.

### What happens if a regular user tries to set isSuperAdmin manually?

The `isSuperAdmin` property is set exclusively within the `normalizeProfile` function based on the email check result. Since this normalization occurs server‑side in [`api/_lib/supabase.js`](https://github.com/freestylefly/awesome-gpt-image-2/blob/main/api/_lib/supabase.js), users cannot manipulate their client‑side data to spoof super admin status, and the `p_force_credit` flag relies on this server‑verified profile object.

### Does the credit bypass affect usage statistics or logging?

The analysis indicates that the `reserve_generation_usage` RPC handles the reservation logic, but specific logging behavior depends on the stored procedure implementation. While credit checks are bypassed via `p_force_credit`, the reservation itself likely still creates a record in the database to maintain audit trails, though the balance remains unchanged for super admins.

### Which environment variable controls super admin access?

The `SUPER_ADMIN_EMAILS` environment variable controls access. This variable should contain a comma‑separated list of email addresses that the system recognizes as super administrators, as parsed by the logic in [`api/_lib/supabase.js`](https://github.com/freestylefly/awesome-gpt-image-2/blob/main/api/_lib/supabase.js).