Why: a browser holding a revoked API key in localStorage sent the Bearer
header on every request; key precedence 401'd all APIs despite a valid
login session, locking admins out of user management. /api/me also
reported mustChangePassword for key principals, who cannot change
passwords (session-owned), dead-ending the forced-change gate.
Evidence: new TestStaleKeySessionFallback covers fallback and authVia;
TestAuthMiddleware/TestAdminAccountFlow unchanged and green; full
go test ./... green.
Impact: invalid key falls back to a valid session cookie before 401
(cookie-less programmatic clients unaffected); /api/me gains
authVia ("key"|"session"|""), letting the frontend keep key holders
out of the change-password gate.
Refs: Dev task feature/admin-auth-gate-fix.
weichen
merged commit 51ad3ce115 into main2026-10-11 13:48:25 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Why: 浏览器 localStorage 残留已吊销 API key 时，Bearer 优先级让有效登录会话也全部 401，管理员被锁在用户管理之外；/api/me 对 key 凭证也报 mustChangePassword，而 key 不能改密（会话专属），强制改密门成为死路。
改动：
/api/me增加authVia（key/session/空）Evidence： 新增
TestStaleKeySessionFallback（回落 + authVia）；go test ./...全绿（SELF，待 CI GATE）。Refs： Dev 任务 feature/admin-auth-gate-fix（组合验证与 gitlink PR 在 Dev 仓推进）。
Why: a browser holding a revoked API key in localStorage sent the Bearer header on every request; key precedence 401'd all APIs despite a valid login session, locking admins out of user management. /api/me also reported mustChangePassword for key principals, who cannot change passwords (session-owned), dead-ending the forced-change gate. Evidence: new TestStaleKeySessionFallback covers fallback and authVia; TestAuthMiddleware/TestAdminAccountFlow unchanged and green; full go test ./... green. Impact: invalid key falls back to a valid session cookie before 401 (cookie-less programmatic clients unaffected); /api/me gains authVia ("key"|"session"|""), letting the frontend keep key holders out of the change-password gate. Refs: Dev task feature/admin-auth-gate-fix.