From 7750bf6439a8d3bb8e1a5b14e902532c56276f2b Mon Sep 17 00:00:00 2001
From: akastijn <akastijn@alttd.com>
Date: Sun, 19 Jul 2026 20:42:00 +0200
Subject: [PATCH] Expand `/api/chat/read/**` access to include `MOD`
 permission.

---
 .../main/java/com/alttd/altitudeweb/config/SecurityConfig.java  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/src/main/java/com/alttd/altitudeweb/config/SecurityConfig.java b/backend/src/main/java/com/alttd/altitudeweb/config/SecurityConfig.java
index bf7ac44..c381e7b 100644
--- a/backend/src/main/java/com/alttd/altitudeweb/config/SecurityConfig.java
+++ b/backend/src/main/java/com/alttd/altitudeweb/config/SecurityConfig.java
@@ -62,7 +62,7 @@ public class SecurityConfig {
                                 .requestMatchers("/api/mail/**").authenticated()
                                 .requestMatchers("/api/site/vote").authenticated()
                                 .requestMatchers("/api/appeal").authenticated()
-                                .requestMatchers("/api/chat/read/**").hasAuthority(PermissionClaimDto.HEAD_MOD.getValue())
+                                .requestMatchers("/api/chat/read/**").hasAnyAuthority(PermissionClaimDto.HEAD_MOD.getValue(), PermissionClaimDto.MOD.getValue())
                                 .requestMatchers("/api/site/get-staff-playtime/**").hasAuthority(PermissionClaimDto.HEAD_MOD.getValue())
                                 .requestMatchers("/api/head_mod/**").hasAuthority(PermissionClaimDto.HEAD_MOD.getValue())
                                 .requestMatchers("/api/particles/**").hasAuthority(PermissionClaimDto.HEAD_MOD.getValue())