diff --git a/app/api/auth/[...nextauth]/route.ts b/app/api/auth/[...nextauth]/route.ts
index 0e021bd7..39c7c5ef 100644
--- a/app/api/auth/[...nextauth]/route.ts
+++ b/app/api/auth/[...nextauth]/route.ts
@@ -144,7 +144,7 @@ export const authOptions: NextAuthOptions = {
         console.log('JWT raw roles:', roles);
 
         // Clean up roles by removing ROLE_ prefix and converting to lowercase
-        const cleanRoles = roles.map(role => 
+        const cleanRoles = roles.map((role: string) => 
           role.replace(/^ROLE_/, '').toLowerCase()
         );
 
@@ -158,6 +158,11 @@ export const authOptions: NextAuthOptions = {
         token.username = keycloakProfile.preferred_username ?? '';
         token.first_name = keycloakProfile.given_name ?? '';
         token.last_name = keycloakProfile.family_name ?? '';
+
+        console.log('JWT callback final token:', {
+          tokenRoles: token.role,
+          token
+        });
       }
 
       if (Date.now() < (token.accessTokenExpires as number) * 1000) {