Index: src/middleware/auth.js
===================================================================
--- src/middleware/auth.js	(revision 2165b6d3d57ceaa8b5d1f70491868482149470cf)
+++ src/middleware/auth.js	(revision 7bc636b391c66ac399c33e54f7173a022c6a3cbd)
@@ -2,7 +2,4 @@
  * Auth middleware
  */
-
-import db from '../config/database.js';
-import PermissionsService from '../services/PermissionsService.js';
 
 /**
@@ -38,44 +35,9 @@
 }
 
-// A 'kijker' (viewer) may VIEW everything (incl. Admin) but CHANGE nothing. The
-// write block lives in the global guard in server.js; this helper only determines
-// "is this a read-only account?". `readonly` is the legacy flag we still include
-// so unmigrated demo accounts remain blocked.
-export function isViewer(user) {
-  return !!user && (user.role === 'kijker' || !!user.readonly);
-}
-
 export function requireGod(req, res, next) {
   if (!req.session?.user) return loginRedirect(req, res);
-  const role = req.session.user.role;
-  // god manages; a viewer MAY see the Admin panel (read-only) — the
-  // global guard 403s every write, so this only grants view access.
-  if (role !== 'god' && role !== 'kijker') {
+  if (req.session.user.role !== 'god') {
     return res.status(403).send('God role required');
   }
   next();
 }
-
-// Can the logged-in user manage the CURRENT site (res.locals.site)? god always;
-// otherwise only the owner of that site. Used for site-scoped admin routes
-// that an artist reaches via /user/<own-slug>/admin/... (res.locals.site is then
-// their own site; a foreign slug yields a different site -> 403).
-export function requireSiteManager(req, res, next) {
-  if (!req.session?.user) return loginRedirect(req, res);
-  const u = req.session.user;
-  if (u.role === 'god' || u.role === 'kijker') return next(); // viewer = read-only view access
-  const site = res.locals.site;
-  // owner OR assigned co-admin (site_members) — canAdminSite covers both.
-  if (site && PermissionsService.canAdminSite(u, site)) return next();
-  return res.status(403).send('Geen toegang tot deze site.');
-}
-
-// Same, but the site is determined by the :slug parameter (e.g. site-edit).
-export function requireSiteManagerBySlug(req, res, next) {
-  if (!req.session?.user) return loginRedirect(req, res);
-  const u = req.session.user;
-  if (u.role === 'god' || u.role === 'kijker') return next(); // viewer = read-only view access
-  const site = db.prepare('SELECT id, owner_id FROM sites WHERE slug = ?').get(req.params.slug);
-  if (site && PermissionsService.canAdminSite(u, site)) return next();
-  return res.status(403).send('Geen toegang tot deze site.');
-}