The route guard below is meant to protect /admin/* routes, but always allows the request through — the admin link is simply hidden from the UI for non-admins, with no actual server-side check.
The bug: hiding a link in the UI is not access control. Anyone who knows (or guesses) the URL /admin/users can reach it directly, regardless of role — this is exactly Juice Shop's "Admin Section" challenge.
Your task: fix solve(role, route) so any route starting with /admin requires role === 'admin' — everything else is allowed through unchanged.
Sample tests