fix(auth): admin redirects to OIDC login when no session

src/main.go

@@ -167,27 +167,28 @@ func main() {
 	bearerAuth := admin.TokenAuthMiddleware(cfg.Admin.SecretToken)
 	adminAuth := func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			// First, try session-based authentication
+			if token := r.Header.Get("Authorization"); token != "" {
+				bearerAuth(next).ServeHTTP(w, r)
+				return
+			}
 			cookie, err := r.Cookie("nextwks_session")
-			if err == nil && cookie != nil {
+			if err != nil || cookie == nil {
+				oidcHandler.LoginRedirect(w, r)
+				return
+			}
 			session, err := sessionStore.ValidateSession(cookie.Value)
-				if err == nil && session != nil {
+			if err != nil || session == nil {
+				oidcHandler.LoginRedirect(w, r)
+				return
+			}
 			isAdmin, _ := roleChecker.IsAdmin(session.UserID)
 			if isAdmin {
 				ctx := context.WithValue(r.Context(), auth.ContextUserID, session.UserID)
 				ctx = context.WithValue(ctx, auth.ContextRole, "admin")
 				next.ServeHTTP(w, r.WithContext(ctx))
 				return
-					} else {
-						ctx := context.WithValue(r.Context(), auth.ContextUserID, session.UserID)
-						ctx = context.WithValue(ctx, auth.ContextRole, "user")
-						next.ServeHTTP(w, r.WithContext(ctx))
-						return
 			}
-				}
-			}
-			// Fall back to bearer token
-			bearerAuth(next).ServeHTTP(w, r)
+			http.Error(w, "{\"error\":\"admin access required\"}", http.StatusForbidden)
 		})
 	}