fix

apps/api/internal/httpapi/middleware.go

@@ -192,6 +192,12 @@ func (s *Server) RequireCompany(next http.Handler) http.Handler {
 		}
 		m, err := s.Auth.EnsureMembership(r.Context(), uid, cid)
 		if err != nil {
+			if errors.Is(err, auth.ErrNotCompanyMember) && s.staffMayActAsCompany(r.Context(), uid) {
+				ctx := context.WithValue(r.Context(), ctxCompanyID, cid)
+				ctx = context.WithValue(ctx, ctxRole, "admin")
+				next.ServeHTTP(w, r.WithContext(ctx))
+				return
+			}
 			Error(w, http.StatusForbidden, "forbidden")
 			return
 		}
@@ -201,6 +207,16 @@ func (s *Server) RequireCompany(next http.Handler) http.Handler {
 	})
 }
 
+// staffMayActAsCompany is true only for platform staff_role=admin (or legacy
+// is_platform_admin → admin). Developers and support_staff cannot tenant-switch.
+func (s *Server) staffMayActAsCompany(ctx context.Context, userID uuid.UUID) bool {
+	access, err := s.checkStaffAccess(ctx, userID)
+	if err != nil || !access.FullAdmin {
+		return false
+	}
+	return access.Role == auth.StaffRoleAdmin
+}
+
 func (s *Server) CSRF(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		// Public API-key and token export routes do not use cookie CSRF.