diff --git a/attached_assets/Pasted-ctions-userRole-admin-Admin-filtering-with-groupIds-1-Fetchin-1755240014092_1755240014102.txt b/attached_assets/Pasted-ctions-userRole-admin-Admin-filtering-with-groupIds-1-Fetchin-1755240014092_1755240014102.txt
new file mode 100644
index 0000000..dba208b
--- /dev/null
+++ b/attached_assets/Pasted-ctions-userRole-admin-Admin-filtering-with-groupIds-1-Fetchin-1755240014092_1755240014102.txt
@@ -0,0 +1,204 @@
+ctions
+ 
+ 
+ 
+      
+  userRole: 'admin'
+
+}
+
+Admin filtering with groupIds: [ 1 ]
+
+Fetching all orders
+
+🔗 PRODUCTION: getDeliveries() récupéré 44 livraisons avec relations
+
+Deliveries returned: 44 items
+
+Customer Orders returned: 9 items
+
+GET /api/deliveries 304 in 124ms
+
+GET /api/customer-orders 304 in 116ms
+
+🔗 PRODUCTION: getOrders() récupéré 31 commandes avec relations
+
+Orders returned: 31 items
+
+GET /api/orders 304 in 148ms
+
+GET /api/groups 304 in 95ms
+
+GET /api/publicities 304 in 140ms
+
+🌤️ Fetching previous year weather data from API
+
+Weather API error for previous year: 401 
+
+GET /api/weather/current 200 in 886ms
+
+GET /api/user 304 in 5ms
+
+GET /api/user 304 in 4ms
+
+GET /api/backups 304 in 8ms
+
+GET /api/weather/settings 200 in 4ms
+
+HEAD /api/health 200 in 1ms
+
+PUT /api/weather/settings/1 200 in 11ms
+
+GET /api/weather/settings 200 in 4ms
+
+GET /api/user 304 in 12ms
+
+GET /api/publicities 304 in 32ms
+
+Deliveries API called with: {
+
+  startDate: undefined,
+
+  endDate: undefined,
+
+  storeId: '1',
+
+  withBL: undefined,
+
+  userRole: 'admin'
+
+}
+
+Admin filtering deliveries with groupIds: [ 1 ]
+
+Fetching all deliveries
+
+📊 Calcul statistiques mensuelles: {
+
+  year: 2025,
+
+  month: 8,
+
+  startDate: '2025-08-01',
+
+  endDate: '2025-09-01',
+
+  groupIds: undefined
+
+}
+
+🔗 PRODUCTION: getDeliveries() récupéré 44 livraisons avec relations
+
+Deliveries returned: 44 items
+
+GET /api/deliveries 304 in 168ms
+
+Orders API called with: {
+
+  startDate: undefined,
+
+  endDate: undefined,
+
+  storeId: undefined,
+
+  userRole: 'admin'
+
+}
+
+Admin filtering with groupIds: undefined
+
+Fetching all orders
+
+Customer Orders API called with: { groupIds: undefined, userRole: 'admin' }
+
+Orders API called with: {
+
+  startDate: undefined,
+
+  endDate: undefined,
+
+  storeId: '1',
+
+  userRole: 'admin'
+
+}
+
+Admin filtering with groupIds: [ 1 ]
+
+Fetching all orders
+
+Tasks API called with: { groupIds: undefined, userRole: 'admin' }
+
+Customer Orders API called with: { groupIds: [ 1 ], userRole: 'admin' }
+
+🔗 PRODUCTION: getOrders() récupéré 49 commandes avec relations
+
+Orders returned: 49 items
+
+GET /api/orders 304 in 336ms
+
+📊 Statistiques calculées: {
+
+  ordersCount: 18,
+
+  deliveriesCount: 42,
+
+  pendingOrdersCount: 6,
+
+  averageDeliveryTime: 0.3611111111111111,
+
+  totalPalettes: 120,
+
+  totalPackages: 36
+
+}
+
+Deliveries API called with: {
+
+  startDate: undefined,
+
+  endDate: undefined,
+
+  storeId: undefined,
+
+  withBL: undefined,
+
+  userRole: 'admin'
+
+}
+
+Admin filtering deliveries with groupIds: undefined
+
+Fetching all deliveries
+
+GET /api/stats/monthly 304 in 364ms
+
+GET /api/dlc-products/stats 304 in 351ms
+
+Tasks returned: 61 items
+
+Customer Orders returned: 36 items
+
+Customer Orders returned: 9 items
+
+GET /api/tasks 304 in 361ms
+
+GET /api/customer-orders 304 in 373ms
+
+GET /api/customer-orders 304 in 331ms
+
+🔗 PRODUCTION: getOrders() récupéré 31 commandes avec relations
+
+Orders returned: 31 items
+
+GET /api/orders 304 in 370ms
+
+🔗 PRODUCTION: getDeliveries() récupéré 82 livraisons avec relations
+
+Deliveries returned: 82 items
+
+GET /api/deliveries 304 in 456ms
+
+GET /api/publicities 304 in 400ms
+
+HEAD /api/health 200 in 2ms
\ No newline at end of file
diff --git a/server/routes.ts b/server/routes.ts
index 6f1e892..3330563 100644
--- a/server/routes.ts
+++ b/server/routes.ts
@@ -2389,8 +2389,13 @@ RÉSUMÉ DU SCAN
   });
 
   // Backup management routes (Admin only)
-  app.get('/api/backups', isAuthenticated, requireAdmin, async (req: any, res: any) => {
+  app.get('/api/backups', isAuthenticated, async (req: any, res) => {
     try {
+      const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id);
+      if (!user || user.role !== 'admin') {
+        return res.status(403).json({ message: "Access denied" });
+      }
+
       const backups = await backupService.getBackupList();
       res.json(backups);
     } catch (error) {
@@ -2399,11 +2404,11 @@ RÉSUMÉ DU SCAN
     }
   });
 
-  app.post('/api/backups', isAuthenticated, requireAdmin, async (req: any, res: any) => {
+  app.post('/api/backups', isAuthenticated, async (req: any, res) => {
     try {
       const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id);
-      if (!user) {
-        return res.status(404).json({ message: "User not found" });
+      if (!user || user.role !== 'admin') {
+        return res.status(403).json({ message: "Access denied" });
       }
 
       const backup = await backupService.createBackup('manual', user.id);
@@ -2414,12 +2419,17 @@ RÉSUMÉ DU SCAN
     }
   });
 
-  app.get('/api/backups/:filename/download', isAuthenticated, requireAdmin, async (req: any, res: any) => {
+  app.get('/api/backups/:filename/download', isAuthenticated, async (req: any, res) => {
     try {
+      const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id);
+      if (!user || user.role !== 'admin') {
+        return res.status(403).json({ message: "Access denied" });
+      }
+
       const { filename } = req.params;
       const filepath = await backupService.downloadBackup(filename);
       
-      res.download(filepath, filename, (err) => {
+      res.download(filepath, filename, (err: any) => {
         if (err) {
           console.error("Error downloading backup:", err);
           res.status(404).json({ message: "Backup file not found" });
@@ -2431,8 +2441,13 @@ RÉSUMÉ DU SCAN
     }
   });
 
-  app.delete('/api/backups/:filename', isAuthenticated, requireAdmin, async (req: any, res: any) => {
+  app.delete('/api/backups/:filename', isAuthenticated, async (req: any, res) => {
     try {
+      const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id);
+      if (!user || user.role !== 'admin') {
+        return res.status(403).json({ message: "Access denied" });
+      }
+
       const { filename } = req.params;
       await backupService.deleteBackup(filename);
       res.json({ message: "Backup deleted successfully" });
@@ -2757,8 +2772,13 @@ RÉSUMÉ DU SCAN
   });
 
   // Weather routes
-  app.get('/api/weather/settings', isAuthenticated, requireAdmin, async (req: any, res) => {
+  app.get('/api/weather/settings', isAuthenticated, async (req: any, res) => {
     try {
+      const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id);
+      if (!user || user.role !== 'admin') {
+        return res.status(403).json({ message: "Access denied" });
+      }
+
       const settings = await storage.getWeatherSettings();
       res.json(settings);
     } catch (error) {
@@ -2767,8 +2787,13 @@ RÉSUMÉ DU SCAN
     }
   });
 
-  app.post('/api/weather/settings', isAuthenticated, requireAdmin, async (req: any, res) => {
+  app.post('/api/weather/settings', isAuthenticated, async (req: any, res) => {
     try {
+      const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id);
+      if (!user || user.role !== 'admin') {
+        return res.status(403).json({ message: "Access denied" });
+      }
+
       const data = insertWeatherSettingsSchema.parse(req.body);
       const settings = await storage.createWeatherSettings(data);
       res.json(settings);
@@ -2781,8 +2806,13 @@ RÉSUMÉ DU SCAN
     }
   });
 
-  app.put('/api/weather/settings/:id', isAuthenticated, requireAdmin, async (req: any, res) => {
+  app.put('/api/weather/settings/:id', isAuthenticated, async (req: any, res) => {
     try {
+      const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id);
+      if (!user || user.role !== 'admin') {
+        return res.status(403).json({ message: "Access denied" });
+      }
+
       const id = parseInt(req.params.id);
       const data = insertWeatherSettingsSchema.partial().parse(req.body);
       const settings = await storage.updateWeatherSettings(id, data);
@@ -2796,8 +2826,13 @@ RÉSUMÉ DU SCAN
     }
   });
 
-  app.post('/api/weather/test-connection', isAuthenticated, requireAdmin, async (req: any, res) => {
+  app.post('/api/weather/test-connection', isAuthenticated, async (req: any, res) => {
     try {
+      const user = await storage.getUserWithGroups(req.user.claims ? req.user.claims.sub : req.user.id);
+      if (!user || user.role !== 'admin') {
+        return res.status(403).json({ message: "Access denied" });
+      }
+
       const { apiKey, location } = req.body;
       
       if (!apiKey || !location) {