diff --git a/apps/api/src/routes/content.ts b/apps/api/src/routes/content.ts
index 904105f..5a23a00 100644
--- a/apps/api/src/routes/content.ts
+++ b/apps/api/src/routes/content.ts
@@ -15,11 +15,11 @@ import {
 import { and, asc, count, desc, eq, inArray } from "drizzle-orm"
 import { Hono } from "hono"
 
-import { requireAuth, type AppEnv } from "../auth/middleware"
+import { requireAuth, requireSuperAdmin, type AppEnv } from "../auth/middleware"
 import { db, schema } from "../db"
 import { failure, success } from "../http"
 import { JudgeStatus } from "../judge/status"
-import { isSuperAdmin, objectValue, queryInteger, sampleUser } from "./helpers"
+import { objectValue, queryInteger, sampleUser } from "./helpers"
 
 export const contentRoutes = new Hono<AppEnv>()
 
@@ -108,9 +108,8 @@ contentRoutes.get("/messages", requireAuth, async (c) => {
   }))
 })
 
-contentRoutes.post("/messages", requireAuth, async (c) => {
+contentRoutes.post("/messages", requireSuperAdmin, async (c) => {
   const user = c.get("user")!
-  if (!isSuperAdmin(user)) return failure(c, 403, "permission-denied", "Permission denied")
   const parsed = createMessageRequestSchema.safeParse(await c.req.json().catch(() => null))
   if (!parsed.success) return failure(c, 400, "invalid-request", "Invalid message payload")
   if (parsed.data.recipientId === user.id) return failure(c, 400, "invalid-recipient", "Can not send a message to yourself")
diff --git a/apps/api/src/routes/problemset.ts b/apps/api/src/routes/problemset.ts
index 86da9fd..e16e218 100644
--- a/apps/api/src/routes/problemset.ts
+++ b/apps/api/src/routes/problemset.ts
@@ -27,13 +27,13 @@ import {
 } from "drizzle-orm"
 import { Hono } from "hono"
 
-import { optionalAuth, requireAuth, type AppEnv } from "../auth/middleware"
+import { optionalAuth, requireAuth, requireTeacher, type AppEnv } from "../auth/middleware"
 import { db, schema } from "../db"
 import { publishAchievementNotification } from "../events"
 import { failure, success } from "../http"
 import { JudgeStatus } from "../judge/status"
 import { updateAchievementsForProblemSet } from "../services/achievements"
-import { isTeacherOrAbove, objectValue, queryInteger, sampleUser } from "./helpers"
+import { objectValue, queryInteger, sampleUser } from "./helpers"
 
 export const problemsetRoutes = new Hono<AppEnv>()
 
@@ -362,9 +362,7 @@ problemsetRoutes.get("/problem-sets/:id/badges", async (c) => {
   return success(c, badges.map((badge) => badgeData(badge)))
 })
 
-problemsetRoutes.get("/problem-sets/:id/user-progress", requireAuth, async (c) => {
-  const user = c.get("user")!
-  if (!isTeacherOrAbove(user)) return failure(c, 403, "permission-denied", "Permission denied")
+problemsetRoutes.get("/problem-sets/:id/user-progress", requireTeacher, async (c) => {
   const id = queryInteger(c.req.param("id"), 0, { min: 1 })
   const [problemSet] = await db.select({ id: schema.problemset.id }).from(schema.problemset).where(and(
     eq(schema.problemset.id, id), eq(schema.problemset.visible, true), ne(schema.problemset.status, "draft"),