with open("/app/app/api/v1/endpoints/users.py", "r") as f:
    content = f.read()

old = '    # Verificar permisos - solo ADMIN puede eliminar\n    if current_user.role != UserRole.ADMIN:\n        raise HTTPException(\n            status_code=status.HTTP_403_FORBIDDEN,\n            detail="Only admins can delete users"\n        )'

new = '    # Verificar permisos - ADMIN global o CLIENT_ADMIN pueden eliminar\n    allowed = [UserRole.ADMIN, UserRole.CLIENT_ADMIN]\n    if current_user.role not in allowed:\n        raise HTTPException(\n            status_code=status.HTTP_403_FORBIDDEN,\n            detail="Only admins can delete users"\n        )'

if old in content:
    content = content.replace(old, new)
    print("OK: permisos delete actualizados")
else:
    print("ERROR: bloque no encontrado")

with open("/app/app/api/v1/endpoints/users.py", "w") as f:
    f.write(content)