How Super Admins Bypass Credit Requirements in Awesome‑GPT‑Image‑2

Super admins bypass credit requirements in awesome‑gpt‑image‑2 through a three‑layer mechanism that identifies privileged emails via the SUPER_ADMIN_EMAILS environment variable, sets isSuperAdmin: true on the user profile, and passes a p_force_credit flag to the Supabase RPC that skips balance validation.

In the freestylefly/awesome‑gpt‑image‑2 repository, super administrators can generate images without depleting their credit balance. This privilege is enforced through a combination of email‑based identification, role elevation, and database‑level flag bypassing that operates seamlessly during the image generation workflow.

Super Admin Identification via Environment Configuration

The system recognizes super admins before any generation request is processed by checking the SUPER_ADMIN_EMAILS environment variable.

Email Verification in supabase.js

In api/_lib/supabase.js at lines 49‑52, the isSuperAdminEmail function validates whether the authenticated user’s email appears in the designated super admin list. This check serves as the primary gatekeeper for elevated privileges.

Profile Elevation and Normalization

Once identified, the profilePayloadFromUser function (lines 81‑92 of api/_lib/supabase.js) automatically assigns the super_admin role to matching users. Subsequently, the normalizeProfile function (lines 100‑105) attaches the boolean flag isSuperAdmin: true to the profile object, making the privilege available throughout the application lifecycle for authorization decisions.

Bypassing Credit Validation with Force Flags

When a generation request is initiated, the system leverages the isSuperAdmin flag to skip standard balance checks without modifying the core credit logic for regular users.

The reserveGeneration Flow

In api/generate-image.js at lines 35‑36, the reserveGeneration function passes p_force_credit: Boolean(profile?.isSuperAdmin) as a parameter to the Supabase reserve_generation_usage RPC. This boolean flag explicitly instructs the stored procedure to treat the reservation as privileged.

Database‑Level Permission Override

The stored procedure interprets p_force_credit as a directive to bypass the standard credit‑sufficiency validation. When this flag evaluates to true, the reservation succeeds regardless of the user's current credit balance, effectively granting unlimited generation capability to super admin accounts while maintaining strict accounting for regular users.

Endpoint Authorization Guards

Admin‑only endpoints enforce the super_admin role to prevent unauthorized access to privileged operations. For example, api/admin/users.js at line 41 verifies that the caller’s profile carries the super_admin role before processing sensitive requests. This ensures that only accounts listed in SUPER_ADMIN_EMAILS can invoke the credit‑bypassing generation path, adding a final security layer to the privilege escalation chain.

Implementation Code Examples

The following patterns demonstrate how to check super admin status and invoke the bypass mechanism in your own extensions:

// Identify a super admin by email
import { isSuperAdminEmail } from './_lib/supabase.js';

const email = 'admin@example.com';
if (isSuperAdminEmail(email)) {
  console.log('User is a super-admin'); // role will be set to "super_admin"
}

// Reserve generation with forced credit bypass
import { reserveGeneration } from './generate-image.js';
import { getAuthContext } from './_lib/supabase.js';

async function generate(req) {
  const auth = await getAuthContext(req);
  const reservation = await reserveGeneration(
    auth.client,
    auth.profile,          // profile.isSuperAdmin === true
    auth.user.id,
    caseId,
    prompt
  );
  // No credit error will be thrown for a super-admin
}

Summary

• Email‑based identification: The isSuperAdminEmail function in api/_lib/supabase.js checks against the SUPER_ADMIN_EMAILS environment variable to designate privileged accounts.
• Profile flagging: The normalizeProfile function sets isSuperAdmin: true, which persists throughout the session for authorization checks.
• RPC bypass: The reserveGeneration function passes p_force_credit to the Supabase stored procedure, forcing the reservation to skip credit validation for super admins.
• Endpoint protection: Admin routes like api/admin/users.js verify the super_admin role to ensure only authorized accounts access privileged workflows.

Frequently Asked Questions

How is a super admin identified in the system?

A super admin is identified by the isSuperAdminEmail function in api/_lib/supabase.js, which checks if the user’s email exists in the comma‑separated SUPER_ADMIN_EMAILS environment variable. Matching emails trigger automatic role assignment to super_admin during profile creation.

What happens if a regular user tries to set isSuperAdmin manually?

The isSuperAdmin property is set exclusively within the normalizeProfile function based on the email check result. Since this normalization occurs server‑side in api/_lib/supabase.js, users cannot manipulate their client‑side data to spoof super admin status, and the p_force_credit flag relies on this server‑verified profile object.

Does the credit bypass affect usage statistics or logging?

The analysis indicates that the reserve_generation_usage RPC handles the reservation logic, but specific logging behavior depends on the stored procedure implementation. While credit checks are bypassed via p_force_credit, the reservation itself likely still creates a record in the database to maintain audit trails, though the balance remains unchanged for super admins.

Which environment variable controls super admin access?

The SUPER_ADMIN_EMAILS environment variable controls access. This variable should contain a comma‑separated list of email addresses that the system recognizes as super administrators, as parsed by the logic in api/_lib/supabase.js.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}