From 7c0d5a7b91c0088038e50d5810e6852f87ae6947 Mon Sep 17 00:00:00 2001
From: cclohmar <claus.lohmar@lohmar.co.uk>
Date: Sun, 14 Jun 2026 14:57:13 +0000
Subject: [PATCH] fix(auth): combine session+role and bearer token as fallback
 for admin API

---
 src/main.go | 26 ++++++++++++++++++++++----
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/src/main.go b/src/main.go
index 81b0bf5..bfe1c6d 100644
--- a/src/main.go
+++ b/src/main.go
@@ -130,13 +130,31 @@ func main() {
 	}
 	uiHandler.RegisterRoutes(mux, combinedAuth)
 
-	// --- Admin routes: session auth + admin role check ---
+	// --- Admin routes: session+role OR bearer token ---
 	adminRoleAuth := func(next http.Handler) http.Handler {
 		return sessionStore.SessionMiddleware(roleChecker.RequireAdmin(next))
 	}
-	adminHandler.RegisterRoutes(mux, adminRoleAuth)
-	adminHandler.RegisterUIRoutes(mux, adminRoleAuth)
-	adminHandler.RegisterHTMXRoutes(mux, adminRoleAuth)
+	bearerAuth := admin.TokenAuthMiddleware(cfg.Admin.SecretToken)
+
+	// Combined: try session+role first, fall back to bearer token
+	adminAuth := func(next http.Handler) http.Handler {
+		return adminRoleAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			// Check if session user exists and has admin role
+			userID, ok := auth.GetUserID(r)
+			if ok {
+				// Session is valid — already verified by RequireAdmin
+				_ = userID
+				next.ServeHTTP(w, r)
+				return
+			}
+			// No valid session — try bearer token
+			bearerAuth(next).ServeHTTP(w, r)
+		}))
+	}
+
+	adminHandler.RegisterRoutes(mux, adminAuth)
+	adminHandler.RegisterUIRoutes(mux, adminAuth)
+	adminHandler.RegisterHTMXRoutes(mux, adminAuth)
 
 	// --- OIDC config page — shows Authelia status ---
 	mux.HandleFunc("GET /auth/status", func(w http.ResponseWriter, r *http.Request) {