fix(auth): combine session+role and bearer token as fallback for admin API

src/main.go

@@ -130,13 +130,31 @@ func main() {
 	}
 	uiHandler.RegisterRoutes(mux, combinedAuth)
 
-	// --- Admin routes: session auth + admin role check ---
+	// --- Admin routes: session+role OR bearer token ---
 	adminRoleAuth := func(next http.Handler) http.Handler {
 		return sessionStore.SessionMiddleware(roleChecker.RequireAdmin(next))
 	}
-	adminHandler.RegisterRoutes(mux, adminRoleAuth)
-	adminHandler.RegisterUIRoutes(mux, adminRoleAuth)
-	adminHandler.RegisterHTMXRoutes(mux, adminRoleAuth)
+	bearerAuth := admin.TokenAuthMiddleware(cfg.Admin.SecretToken)
+
+	// Combined: try session+role first, fall back to bearer token
+	adminAuth := func(next http.Handler) http.Handler {
+		return adminRoleAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			// Check if session user exists and has admin role
+			userID, ok := auth.GetUserID(r)
+			if ok {
+				// Session is valid — already verified by RequireAdmin
+				_ = userID
+				next.ServeHTTP(w, r)
+				return
+			}
+			// No valid session — try bearer token
+			bearerAuth(next).ServeHTTP(w, r)
+		}))
+	}
+
+	adminHandler.RegisterRoutes(mux, adminAuth)
+	adminHandler.RegisterUIRoutes(mux, adminAuth)
+	adminHandler.RegisterHTMXRoutes(mux, adminAuth)
 
 	// --- OIDC config page — shows Authelia status ---
 	mux.HandleFunc("GET /auth/status", func(w http.ResponseWriter, r *http.Request) {