Fix user delete flow 12

services/notification/app/api/notifications.py

@@ -527,9 +527,26 @@ async def test_send_whatsapp(
 async def cancel_pending_user_notifications(
     user_id: str,
     current_user = Depends(get_current_user_dep),
-    _admin_check = Depends(require_role(["admin"])),
     db: AsyncSession = Depends(get_db)
 ):
+    
+     # Check if this is a service call or admin user
+    user_type = current_user.get('type', '')
+    user_role = current_user.get('role', '').lower()
+    service_name = current_user.get('service', '')
+    
+    logger.info("The user_type and user_role", user_type=user_type, user_role=user_role)
+    
+    # ✅ IMPROVED: Accept service tokens OR admin users
+    is_service_token = (user_type == 'service' or service_name in ['auth', 'admin'])
+    is_admin_user = (user_role == 'admin')
+    
+    if not (is_service_token or is_admin_user):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Admin role or service authentication required"
+        )
+    
     """Cancel all pending notifications for a user (admin only)"""
     try:
         user_uuid = uuid.UUID(user_id)
@@ -597,9 +614,26 @@ async def cancel_pending_user_notifications(
 async def delete_user_notification_data(
     user_id: str,
     current_user = Depends(get_current_user_dep),
-    _admin_check = Depends(require_role(["admin"])),
     db: AsyncSession = Depends(get_db)
 ):
+    
+     # Check if this is a service call or admin user
+    user_type = current_user.get('type', '')
+    user_role = current_user.get('role', '').lower()
+    service_name = current_user.get('service', '')
+    
+    logger.info("The user_type and user_role", user_type=user_type, user_role=user_role)
+    
+    # ✅ IMPROVED: Accept service tokens OR admin users
+    is_service_token = (user_type == 'service' or service_name in ['auth', 'admin'])
+    is_admin_user = (user_role == 'admin')
+    
+    if not (is_service_token or is_admin_user):
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Admin role or service authentication required"
+        )
+        
     """Delete all notification data for a user (admin only)"""
     try:
         user_uuid = uuid.UUID(user_id)