Index: src/middleware/auth.js
===================================================================
--- src/middleware/auth.js	(revision 8afbdd6572a947bce4726d5aa0d0aa0d6c7e5067)
+++ src/middleware/auth.js	(revision 98ecf51d81042b5773ac053aa13dfc773dbdf4e9)
@@ -4,4 +4,5 @@
 
 import db from '../config/database.js';
+import PermissionsService from '../services/PermissionsService.js';
 
 /**
@@ -65,5 +66,6 @@
   if (u.role === 'god' || u.role === 'kijker') return next(); // kijker = alleen-lezen kijk-toegang
   const site = res.locals.site;
-  if (site && site.owner_id === u.id) return next();
+  // owner OF toegewezen mede-beheerder (site_members) — canAdminSite dekt beide.
+  if (site && PermissionsService.canAdminSite(u, site)) return next();
   return res.status(403).send('Geen toegang tot deze site.');
 }
@@ -74,6 +76,6 @@
   const u = req.session.user;
   if (u.role === 'god' || u.role === 'kijker') return next(); // kijker = alleen-lezen kijk-toegang
-  const site = db.prepare('SELECT owner_id FROM sites WHERE slug = ?').get(req.params.slug);
-  if (site && site.owner_id === u.id) return next();
+  const site = db.prepare('SELECT id, owner_id FROM sites WHERE slug = ?').get(req.params.slug);
+  if (site && PermissionsService.canAdminSite(u, site)) return next();
   return res.status(403).send('Geen toegang tot deze site.');
 }