HH-548: allow Super Admin sessions to load platform lists (#125)

* fix(HH-548): authorize super admin platform lists

* fix(HH-548): limit dual auth to platform lists

---------

Co-authored-by: Rogee <rogee@ipao.vip>

backend/internal/middleware/platform_app_auth.go

@@ -16,15 +16,45 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"net/http"
+	"strings"
 	"time"
 
 	"github.com/gin-gonic/gin"
 
+	"github.com/gochat/gochat/internal/auth"
 	"github.com/gochat/gochat/internal/model"
 	"github.com/gochat/gochat/pkg/response"
 	"gorm.io/gorm"
 )
 
+// PlatformAPIIdentityAuth accepts either a PlatformApp credential or the
+// signed dashboard session used by GoChat's Super Admin SPA. An explicitly
+// supplied PlatformApp credential never falls back to a user session.
+func PlatformAPIIdentityAuth(jwtSvc *auth.JWTService, db *gorm.DB) gin.HandlerFunc {
+	platformAppAuth := PlatformAppAuth(db)
+	userAuth := AuthMiddlewareWithServiceAndDB(jwtSvc, db)
+	return func(c *gin.Context) {
+		if strings.TrimSpace(c.GetHeader("api_access_token")) != "" || strings.TrimSpace(c.GetHeader("HTTP_API_ACCESS_TOKEN")) != "" {
+			platformAppAuth(c)
+			return
+		}
+		userAuth(c)
+	}
+}
+
+// PlatformAPIAuthorize limits user sessions to Super Admins while preserving
+// the existing PlatformApp authentication and permissible checks.
+func PlatformAPIAuthorize() gin.HandlerFunc {
+	superAdmin := SuperAdmin()
+	return func(c *gin.Context) {
+		if _, ok := c.Get("platform_app_id"); ok {
+			c.Next()
+			return
+		}
+		superAdmin(c)
+	}
+}
+
 // PlatformAppAuth creates a middleware that authenticates Platform API requests
 // via the api_access_token header (Chatwoot-compatible).
 //