fix(auth): require admin role for upload, simplify requireAdmin

internal/server/handler.go

@@ -282,7 +282,9 @@ func (h *Handler) StoreOperation(w http.ResponseWriter, r *http.Request) {
 
 	if secret != h.setting.Secret {
 		// Fall back to JWT Bearer token auth (admin UI uploads)
-		if token := bearerToken(r); token == "" || h.jwt.Validate(token) != nil {
+		token := bearerToken(r)
+		claims := h.jwt.Claims(token)
+		if claims == nil || claims.Role != "admin" {
 			http.Error(w, "Forbidden", http.StatusForbidden)
 			return
 		}

internal/server/handler_auth.go

@@ -189,10 +189,6 @@ func (h *Handler) Logout(c ContextNoBody) (any, error) {
 func (h *Handler) requireAdmin(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		token := bearerToken(r)
-		if token == "" || h.jwt.Validate(token) != nil {
-			http.Error(w, "Unauthorized", http.StatusUnauthorized)
-			return
-		}
 		claims := h.jwt.Claims(token)
 		if claims == nil || claims.Role != "admin" {
 			http.Error(w, "Unauthorized", http.StatusUnauthorized)

internal/server/handler_test.go

@@ -1052,7 +1052,7 @@ func TestStoreOperation_CookieAuth(t *testing.T) {
 	}
 
 	t.Run("valid JWT token without secret succeeds", func(t *testing.T) {
-		token, err := jwtMgr.Create("")
+		token, err := jwtMgr.Create("", WithRole("admin"))
 		require.NoError(t, err)
 
 		body := &bytes.Buffer{}
@@ -1102,6 +1102,27 @@ func TestStoreOperation_CookieAuth(t *testing.T) {
 		assert.Equal(t, http.StatusForbidden, rec.Code)
 	})
 
+	t.Run("viewer JWT token is rejected", func(t *testing.T) {
+		token, err := jwtMgr.Create("some-steam-id", WithRole("viewer"))
+		require.NoError(t, err)
+
+		body := &bytes.Buffer{}
+		writer := multipart.NewWriter(body)
+		require.NoError(t, writer.WriteField("worldName", "altis"))
+		require.NoError(t, writer.WriteField("missionName", "Viewer Upload Test"))
+		require.NoError(t, writer.WriteField("missionDuration", "1800"))
+		require.NoError(t, writer.WriteField("filename", "viewer_upload_test"))
+		require.NoError(t, writer.Close())
+
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/operations/add", body)
+		req.Header.Set("Content-Type", writer.FormDataContentType())
+		req.Header.Set("Authorization", "Bearer "+token)
+		rec := httptest.NewRecorder()
+
+		hdlr.StoreOperation(rec, req)
+		assert.Equal(t, http.StatusForbidden, rec.Code)
+	})
+
 	t.Run("no secret and no token fails", func(t *testing.T) {
 		body := &bytes.Buffer{}
 		writer := multipart.NewWriter(body)
@@ -1658,7 +1679,8 @@ func TestStoreOperation_JWTAuth(t *testing.T) {
 	require.NoError(t, err)
 
 	jwt := NewJWTManager("test-secret", time.Hour)
-	token, _ := jwt.Create("")
+	token, err := jwt.Create("", WithRole("admin"))
+	require.NoError(t, err)
 	h := &Handler{
 		repoOperation: repo,
 		setting:       Setting{Secret: "actual-secret", Data: dataDir},