HH-548: allow Super Admin sessions to load platform lists (#125)

* fix(HH-548): authorize super admin platform lists

* fix(HH-548): limit dual auth to platform lists

---------

Co-authored-by: Rogee <rogee@ipao.vip>

backend/internal/middleware/platform_app_auth.go

@@ -16,15 +16,45 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"net/http"
+	"strings"
 	"time"
 
 	"github.com/gin-gonic/gin"
 
+	"github.com/gochat/gochat/internal/auth"
 	"github.com/gochat/gochat/internal/model"
 	"github.com/gochat/gochat/pkg/response"
 	"gorm.io/gorm"
 )
 
+// PlatformAPIIdentityAuth accepts either a PlatformApp credential or the
+// signed dashboard session used by GoChat's Super Admin SPA. An explicitly
+// supplied PlatformApp credential never falls back to a user session.
+func PlatformAPIIdentityAuth(jwtSvc *auth.JWTService, db *gorm.DB) gin.HandlerFunc {
+	platformAppAuth := PlatformAppAuth(db)
+	userAuth := AuthMiddlewareWithServiceAndDB(jwtSvc, db)
+	return func(c *gin.Context) {
+		if strings.TrimSpace(c.GetHeader("api_access_token")) != "" || strings.TrimSpace(c.GetHeader("HTTP_API_ACCESS_TOKEN")) != "" {
+			platformAppAuth(c)
+			return
+		}
+		userAuth(c)
+	}
+}
+
+// PlatformAPIAuthorize limits user sessions to Super Admins while preserving
+// the existing PlatformApp authentication and permissible checks.
+func PlatformAPIAuthorize() gin.HandlerFunc {
+	superAdmin := SuperAdmin()
+	return func(c *gin.Context) {
+		if _, ok := c.Get("platform_app_id"); ok {
+			c.Next()
+			return
+		}
+		superAdmin(c)
+	}
+}
+
 // PlatformAppAuth creates a middleware that authenticates Platform API requests
 // via the api_access_token header (Chatwoot-compatible).
 //

backend/internal/middleware/platform_app_auth_test.go

@@ -12,6 +12,8 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	"github.com/gochat/gochat/internal/auth"
+	"github.com/gochat/gochat/internal/config"
 	"github.com/gochat/gochat/internal/model"
 	"github.com/gochat/gochat/pkg/testutil"
 	"gorm.io/gorm"
@@ -21,6 +23,7 @@ import (
 func newPlatformTestDB(t *testing.T) *gorm.DB {
 	t.Helper()
 	return testutil.NewTestDBWithModels(t,
+		&model.User{},
 		&model.PlatformApp{},
 		&model.AccessToken{},
 		&model.Permissible{},
@@ -271,4 +274,53 @@ func TestPlatformAppAuth_ContextValues(t *testing.T) {
 	assert.Equal(t, 200, w.Code)
 }
 
+func TestPlatformAPIAuthSupportsSuperAdminAndPlatformApp(t *testing.T) {
+	db := newPlatformTestDB(t)
+	pa := model.PlatformApp{Name: "TestApp", Active: ptrBool(true)}
+	require.NoError(t, db.Create(&pa).Error)
+
+	rawToken := "platform-api-token"
+	hash := sha256.Sum256([]byte(rawToken))
+	require.NoError(t, db.Create(&model.AccessToken{
+		OwnerType:   model.AccessTokenOwnerTypePlatformApp,
+		OwnerID:     pa.ID,
+		Token:       hex.EncodeToString(hash[:]),
+		TokenPrefix: rawToken[:8],
+	}).Error)
+
+	jwtSvc := auth.NewJWTService(&config.JWTConfig{Secret: "platform-api-auth-test", ExpiryHours: 1})
+	superAdmin := model.User{Provider: "email", Email: "admin@example.com", Role: "super_admin", Active: true}
+	require.NoError(t, db.Create(&superAdmin).Error)
+	agent := model.User{Provider: "email", Email: "agent@example.com", Active: true}
+	require.NoError(t, db.Create(&agent).Error)
+	superAdminToken, err := jwtSvc.GenerateTokenPair(&superAdmin, 1, "administrator")
+	require.NoError(t, err)
+	agentToken, err := jwtSvc.GenerateTokenPair(&agent, 1, "agent")
+	require.NoError(t, err)
+
+	router := gin.New()
+	router.Use(PlatformAPIIdentityAuth(jwtSvc, db), PlatformAPIAuthorize())
+	router.GET("/test", func(c *gin.Context) { c.Status(http.StatusOK) })
+
+	for _, tc := range []struct {
+		name, header, token string
+		want                int
+	}{
+		{name: "platform app", header: "api_access_token", token: rawToken, want: http.StatusOK},
+		{name: "super admin session", header: "access-token", token: superAdminToken.AccessToken, want: http.StatusOK},
+		{name: "regular session", header: "access-token", token: agentToken.AccessToken, want: http.StatusForbidden},
+		{name: "missing credentials", want: http.StatusUnauthorized},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			w := httptest.NewRecorder()
+			req := httptest.NewRequest(http.MethodGet, "/test", nil)
+			if tc.header != "" {
+				req.Header.Set(tc.header, tc.token)
+			}
+			router.ServeHTTP(w, req)
+			assert.Equal(t, tc.want, w.Code)
+		})
+	}
+}
+
 func ptrBool(b bool) *bool { return &b }