fix

apps/api/cats.json

@@ -0,0 +1 @@
+{"categories":[{"created_at":"2026-08-08T09:52:08.115992+02:00","description":null,"description_template":{"metaDescription":"Write a short Meta Description for the product and spotlight key features, specs, or use cases. Keep between 120-155 characters for optimal display in search results.","metaTitle":"Create a concise and compelling Meta Title that includes the product name and main feature, benefit or use case. Keep it between 50-60 characters for optimal display in search results.","sections":[{"exportId":"heading_1","id":"11003f56-6abb-4c46-8287-5447fd1c4da8","instructions":"Write a compelling main title that includes the product name and its key feature. Example: \"Professional 4K Monitor with Ultra-Wide Color Gamut\"","type":"h1"},{"exportId":"paragraph_1","id":"40403106-faa9-4c76-8693-0ad1456b3b86","instructions":"Write a detailed paragraph about specific features or benefits. Example: \"Describe the monitor's color accuracy and its benefits for professional work\"","type":"p"},{"exportId":"heading_2","id":"8c6c9cab-77fb-4c91-acb7-bb2b67f8d36a","instructions":"Create a section heading focusing on a key aspect. Example: \"Advanced Display Technology\" or \"Professional Color Accuracy\"","type":"h2"},{"exportId":"bullet_points","id":"b6824b02-bbe9-4352-b657-923a2948879e","instructions":"List key features or specifications. Example: \"List the most important technical specifications like resolution, refresh rate, and response time\"","type":"ul"},{"exportId":"Prednost1","id":"f5d3ae52-c7d4-4eed-b026-ca7aed338388","instructions":"Izpostavi eno prednost izdelka v nekaj besedah. Primer: \"Samočistilni kondenzator.\"","type":"p"},{"exportId":"Prednost2","id":"d8e04ff8-e37a-4c8e-9fd9-7657a36c35ac","instructions":"Izpostavi eno prednost izdelka v nekaj besedah. Primer: \"Smart Dry.\"","type":"p"},{"exportId":"Prednost3","id":"87cfa795-1ad8-41ef-ab34-72b4a098c5ab","instructions":"Izpostavi eno prednost izdelka v nekaj besedah. Primer: \"Možnost polovičnega polnjenja.\"","type":"p"}]},"has_description_formula":true,"has_prompt":true,"has_title_formula":true,"id":"faca7a03-7c11-4c05-ba78-5527bd205846","is_active":true,"level":0,"name":"Agregati","parent_unique_id":"1002","path":"","position":0,"title_template":{"elements":[{"description":"Znamka izdelka","example":"Samsung","id":"0-variable-brand","label":"Znamka","type":"variable","value":"brand"}],"separator":" "},"unique_id":"1","updated_at":"2026-08-09T21:45:12.236059+02:00"},{"created_at":"2026-08-08T09:52:08.039871+02:00","description":null,"description_template":{"metaDescription":"Write a short Meta Description for the product and spotlight key features, specs, or use cases. Keep between 120-155 characters for optimal display in search results.","metaTitle":"Create a concise and compelling Meta Title that includes the product name and main feature, benefit or use case. Keep it between 50-60 characters for optimal display in search results.","sections":[{"id":"a7908e85-7b0b-4e92-a347-82601dfec118","instructions":"Write a detailed paragraph about specific features or benefits. Example: \"Describe the monitor's color accuracy and its benefits for professional work\"","type":"p"}]},"has_description_formula":true,"has_prompt":false,"has_title_formula":true,"id":"81b4d01c-76c0-4781-901d-34fb52b4eafe","is_active":true,"level":0,"name":"Audio video","parent_unique_id":null,"path":"","position":0,"title_template":{"elements":[{"description":"Znamka izdelka","example":"Samsung","id":"0-variable-brand","label":"Znamka","type":"variable","value":"brand"}],"separator":" "},"unique_id":"1000","updated_at":"2026-08-08T09:52:08.039871+02:00"},{"created_at":"2026-08-08T09:52:08.287027+02:00","description":null,"description_template":{"metaDescription":"Write a short Meta Description for the product and spotlight key features, specs, or use cases. Keep between 120-155 characters for optimal display in search results.","metaTitle":"Create a concise and compelling Meta Title that includes the product name and main feature, benefit or use case. Keep it between 50-60 characters for optimal display in search results.","sections":[{"id":"a7908e85-7b0b-4e92-a347-82601dfec118","instructions":"Write a detailed paragraph about specific features or benefits. Example: \"Describe the monitor's color accuracy and its benefits for professional work\"","type":"p"}]},"has_description_formula":true,"has_prompt":true,"has_title_formula":true,"id":"2af1581e-1f81-482d-84c7-5dac6dde2f21","is_active":true,"level":0,"name":"Avto oprema","parent_unique_id":"1002","path":"","position":0,"title_template":{"elements":[{"description":"Znamka izdelka","example":"Samsung","id":"0-variable-brand","label":"Znamka","type":"variable","value":"brand"}],"separator":" "},"unique_id":"123","updated_at":"2026-08-09T21:45:12.236059+02:00"}],"limit":3,"offset":0,"total":119}

apps/api/internal/httpapi/admin_dev_handlers.go

@@ -24,12 +24,10 @@ func isLocalDemoEmail(email string) bool {
 	}
 }
 
-// resolveDevImpersonationActor returns the privileged actor allowed to drive non-prod
-// user switching: the current full admin/demo user, or the stored impersonator.
+// resolveImpersonationActor returns the privileged actor allowed to drive user
+// switching: platform staff_role=admin (any env), plus non-prod full admin / demo
+// users, or the stored impersonator when still privileged.
 func (s *Server) resolveDevImpersonationActor(ctx context.Context) (actorID uuid.UUID, ok bool, err error) {
-	if s.Config.IsProduction() {
-		return uuid.Nil, false, nil
-	}
 	uid, hasUID := UserIDFromContext(ctx)
 	if !hasUID || uid == uuid.Nil {
 		return uuid.Nil, false, nil
@@ -38,15 +36,9 @@ func (s *Server) resolveDevImpersonationActor(ctx context.Context) (actorID uuid
 		return uuid.Nil, false, errors.New("auth unavailable")
 	}
 
-	access, err := s.checkStaffAccess(ctx, uid)
-	if err != nil {
+	if canImpersonate, err := s.userMayImpersonate(ctx, uid); err != nil {
 		return uuid.Nil, false, err
-	}
-	if access.FullAdmin {
-		return uid, true, nil
-	}
-	user, err := s.Auth.GetUser(ctx, uid)
-	if err == nil && isLocalDemoEmail(user.Email) {
+	} else if canImpersonate {
 		return uid, true, nil
 	}
 
@@ -58,27 +50,44 @@ func (s *Server) resolveDevImpersonationActor(ctx context.Context) (actorID uuid
 	if err != nil || impID == uuid.Nil {
 		return uuid.Nil, false, nil
 	}
-	impAccess, err := s.checkStaffAccess(ctx, impID)
-	if err != nil {
+	if canImpersonate, err := s.userMayImpersonate(ctx, impID); err != nil {
 		return uuid.Nil, false, err
-	}
-	if impAccess.FullAdmin {
-		return impID, true, nil
-	}
-	impUser, err := s.Auth.GetUser(ctx, impID)
-	if err == nil && isLocalDemoEmail(impUser.Email) {
+	} else if canImpersonate {
 		return impID, true, nil
 	}
 	return uuid.Nil, false, nil
 }
 
-// handleAdminDevSetPassword sets a known local password for any active user.
-// Blocked in production. Intended for @legacy.local migrated accounts (invite emails skip those).
-func (s *Server) handleAdminDevSetPassword(w http.ResponseWriter, r *http.Request) {
-	if s.Config.IsProduction() {
-		Error(w, http.StatusNotFound, "not found")
-		return
+// userMayImpersonate is true for platform staff_role=admin in any environment.
+// Non-production also allows other full admins and local demo accounts.
+func (s *Server) userMayImpersonate(ctx context.Context, userID uuid.UUID) (bool, error) {
+	access, err := s.checkStaffAccess(ctx, userID)
+	if err != nil {
+		return false, err
 	}
+	if access.FullAdmin && access.Role == auth.StaffRoleAdmin {
+		return true, nil
+	}
+	if s.Config.IsProduction() {
+		return false, nil
+	}
+	if access.FullAdmin {
+		return true, nil
+	}
+	if s.Auth == nil {
+		return false, nil
+	}
+	user, err := s.Auth.GetUser(ctx, userID)
+	if err != nil {
+		return false, nil
+	}
+	return isLocalDemoEmail(user.Email), nil
+}
+
+// handleAdminDevSetPassword force-sets a password for any active user.
+// Platform admin only (route). Production requires an explicit password (no default)
+// so ops can unlock @legacy.local / fake-email accounts that cannot receive invites.
+func (s *Server) handleAdminDevSetPassword(w http.ResponseWriter, r *http.Request) {
 	if s.Auth == nil {
 		Error(w, http.StatusServiceUnavailable, "auth unavailable")
 		return
@@ -92,8 +101,12 @@ func (s *Server) handleAdminDevSetPassword(w http.ResponseWriter, r *http.Reques
 		Password string `json:"password"`
 	}
 	_ = DecodeJSONOptional(r, &body)
-	password := body.Password
-	if strings.TrimSpace(password) == "" {
+	password := strings.TrimSpace(body.Password)
+	if password == "" {
+		if s.Config.IsProduction() {
+			Error(w, http.StatusBadRequest, "password is required")
+			return
+		}
 		password = defaultDevPassword
 	}
 	if len(password) < 8 {
@@ -117,20 +130,21 @@ func (s *Server) handleAdminDevSetPassword(w http.ResponseWriter, r *http.Reques
 		LogAndError(w, http.StatusInternalServerError, "could not set password", err)
 		return
 	}
+	hint := "Password set. Sign in with this email and the password you provided."
+	if !s.Config.IsProduction() {
+		hint = "Password set for local login. Omit body.password to use the built-in local default."
+	}
 	JSON(w, http.StatusOK, map[string]any{
 		"ok":      true,
 		"user_id": id,
 		"email":   user.Email,
-		"hint":    "Password set for local login. Omit body.password to use the built-in local default.",
+		"hint":    hint,
 	})
 }
 
-// handleAdminDevImpersonate swaps the current session to the target user (non-production only).
+// handleAdminDevImpersonate swaps the current session to the target user so the
+// operator sees that user's tenant membership and plan (not platform staff chrome).
 func (s *Server) handleAdminDevImpersonate(w http.ResponseWriter, r *http.Request) {
-	if s.Config.IsProduction() {
-		Error(w, http.StatusNotFound, "not found")
-		return
-	}
 	if s.Auth == nil {
 		Error(w, http.StatusServiceUnavailable, "auth unavailable")
 		return
@@ -191,10 +205,6 @@ func (s *Server) handleAdminDevImpersonate(w http.ResponseWriter, r *http.Reques
 
 // handleAdminDevStopImpersonate restores the session to the original admin/demo actor.
 func (s *Server) handleAdminDevStopImpersonate(w http.ResponseWriter, r *http.Request) {
-	if s.Config.IsProduction() {
-		Error(w, http.StatusNotFound, "not found")
-		return
-	}
 	if s.Auth == nil {
 		Error(w, http.StatusServiceUnavailable, "auth unavailable")
 		return
@@ -219,14 +229,10 @@ func (s *Server) handleAdminDevStopImpersonate(w http.ResponseWriter, r *http.Re
 		return
 	}
 	if impID != actorID {
-		// Prefer the stored impersonator when it is still the privileged actor.
-		impAccess, aerr := s.checkStaffAccess(r.Context(), impID)
-		if aerr != nil || !impAccess.FullAdmin {
-			impUser, uerr := s.Auth.GetUser(r.Context(), impID)
-			if uerr != nil || !isLocalDemoEmail(impUser.Email) {
-				Error(w, http.StatusForbidden, "user switch not allowed")
-				return
-			}
+		canImp, ierr := s.userMayImpersonate(r.Context(), impID)
+		if ierr != nil || !canImp {
+			Error(w, http.StatusForbidden, "user switch not allowed")
+			return
 		}
 	}
 	user, err := s.Auth.GetUser(r.Context(), impID)
@@ -393,12 +399,8 @@ func enrichSwitchableUser(u *switchableUserRow, legacyCompanyID string) {
 }
 
 // handleAdminDevListSwitchableUsers lists active users with a preferred company label
-// for the header user-switch dropdown (non-production only).
+// for the header user-switch dropdown (platform staff_role=admin, or non-prod demo).
 func (s *Server) handleAdminDevListSwitchableUsers(w http.ResponseWriter, r *http.Request) {
-	if s.Config.IsProduction() {
-		Error(w, http.StatusNotFound, "not found")
-		return
-	}
 	if s.Pool == nil {
 		Error(w, http.StatusServiceUnavailable, "database unavailable")
 		return

apps/api/internal/httpapi/admin_dev_impersonation_test.go

@@ -6,7 +6,7 @@ import (
 	"testing"
 )
 
-func TestRouterProductionOmitsImpersonationRoutes(t *testing.T) {
+func TestRouterProductionMountsImpersonationBehindAuth(t *testing.T) {
 	t.Parallel()
 	s := testAPIServer()
 	s.Config.AppEnv = "production"
@@ -16,6 +16,7 @@ func TestRouterProductionOmitsImpersonationRoutes(t *testing.T) {
 		"/api/admin/users/00000000-0000-0000-0000-000000000001/impersonate",
 		"/api/admin/dev/stop-impersonate",
 		"/api/admin/dev/switchable-users",
+		"/api/admin/users/00000000-0000-0000-0000-000000000001/dev-password",
 	} {
 		rec := httptest.NewRecorder()
 		method := http.MethodPost
@@ -23,10 +24,9 @@ func TestRouterProductionOmitsImpersonationRoutes(t *testing.T) {
 			method = http.MethodGet
 		}
 		h.ServeHTTP(rec, httptest.NewRequest(method, path, nil))
-		// Unauthenticated session yields 401; production must not expose the route as 200/403 from the handler.
-		// Mounted routes behind RequireSession return 401; unmounted chi paths under /api/admin still hit RequireSession then 404 for unknown — either way not a successful switch.
+		// Unauthenticated: RequireSession → 401. Must not succeed without a session.
 		if rec.Code == http.StatusOK {
-			t.Fatalf("%s returned 200 in production", path)
+			t.Fatalf("%s returned 200 without auth in production", path)
 		}
 	}
 }

apps/api/internal/httpapi/auth_handlers.go

@@ -379,16 +379,20 @@ func (s *Server) handleMe(w http.ResponseWriter, r *http.Request) {
 			}
 		}
 	}
-	if !s.Config.IsProduction() {
-		canSwitch := impersonating
-		if !canSwitch {
+	canUserSwitch := impersonating
+	if !canUserSwitch {
+		if accessErr == nil && access.FullAdmin && access.Role == auth.StaffRoleAdmin {
+			canUserSwitch = true
+		} else if !s.Config.IsProduction() {
 			if accessErr == nil && access.FullAdmin {
-				canSwitch = true
+				canUserSwitch = true
 			} else if isLocalDemoEmail(user.Email) {
-				canSwitch = true
+				canUserSwitch = true
 			}
 		}
-		out["dev_user_switch"] = canSwitch
+	}
+	if canUserSwitch {
+		out["dev_user_switch"] = true
 	}
 	JSON(w, http.StatusOK, out)
 }

apps/api/internal/httpapi/company_member_role_test.go

@@ -152,7 +152,7 @@ func TestAllowCompanyAdminOrPlatform(t *testing.T) {
 		}
 	})
 
-	t.Run("dev_impersonator_retains_admin", func(t *testing.T) {
+	t.Run("impersonated_member_denied", func(t *testing.T) {
 		t.Parallel()
 		actor := uuid.MustParse("bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb")
 		sm := scs.New()
@@ -185,28 +185,16 @@ func TestAllowCompanyAdminOrPlatform(t *testing.T) {
 		LoadSession(sm)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			ctx := context.WithValue(r.Context(), ctxUserID, uid)
 			ctx = context.WithValue(ctx, ctxRole, "member")
-			req := r.WithContext(ctx)
-			if !s.allowCompanyAdminOrPlatform(w, req) {
-				t.Fatal("impersonating privileged actor must retain company-admin powers")
+			if s.allowCompanyAdminOrPlatform(w, r.WithContext(ctx)) {
+				t.Fatal("impersonated member must not retain company-admin powers")
 			}
-			w.WriteHeader(http.StatusNoContent)
 		})).ServeHTTP(rec, func() *http.Request {
 			req := httptest.NewRequest(http.MethodGet, "/", nil)
 			req.AddCookie(&http.Cookie{Name: sm.Cookie.Name, Value: token})
 			return req
 		}())
-		if rec.Code != http.StatusNoContent {
-			t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
-		}
-	})
-
-	t.Run("dev_impersonator_helper_empty_session", func(t *testing.T) {
-		t.Parallel()
-		s := &Server{Config: config.Config{AppEnv: "development"}}
-		req := httptest.NewRequest(http.MethodGet, "/", nil)
-		req = req.WithContext(context.WithValue(req.Context(), ctxUserID, uid))
-		if s.devImpersonatorRetainsCompanyAdmin(req) {
-			t.Fatal("nil Sessions must not retain admin")
+		if rec.Code != http.StatusForbidden {
+			t.Fatalf("status=%d body=%s, want 403", rec.Code, rec.Body.String())
 		}
 	})
 }

apps/api/internal/httpapi/middleware.go

@@ -68,8 +68,6 @@ func requireCompanyAdmin(w http.ResponseWriter, r *http.Request) bool {
 
 // allowCompanyAdminOrPlatform allows company admins, API keys, or platform admins.
 // Platform admins can manage team after migration when all memberships are still "member".
-// Non-prod: while a privileged demo/platform actor is impersonating, retain company-admin powers
-// so local user-switch can still create API keys and manage the tenant.
 func (s *Server) allowCompanyAdminOrPlatform(w http.ResponseWriter, r *http.Request) bool {
 	if CompanyAdminAllowed(r.Context()) {
 		return true
@@ -87,38 +85,10 @@ func (s *Server) allowCompanyAdminOrPlatform(w http.ResponseWriter, r *http.Requ
 	if isAdmin {
 		return true
 	}
-	if s.devImpersonatorRetainsCompanyAdmin(r) {
-		return true
-	}
 	Error(w, http.StatusForbidden, "admin required")
 	return false
 }
 
-// devImpersonatorRetainsCompanyAdmin is true in non-production when the session is
-// impersonating and the stored actor is still a privileged demo/platform admin.
-func (s *Server) devImpersonatorRetainsCompanyAdmin(r *http.Request) bool {
-	if s.Config.IsProduction() || s.Sessions == nil {
-		return false
-	}
-	impStr := strings.TrimSpace(s.Sessions.GetString(r.Context(), auth.SessionImpersonatorIDKey))
-	if impStr == "" {
-		return false
-	}
-	impID, err := uuid.Parse(impStr)
-	if err != nil || impID == uuid.Nil {
-		return false
-	}
-	access, err := s.checkStaffAccess(r.Context(), impID)
-	if err == nil && access.FullAdmin {
-		return true
-	}
-	if s.Auth == nil {
-		return false
-	}
-	impUser, err := s.Auth.GetUser(r.Context(), impID)
-	return err == nil && isLocalDemoEmail(impUser.Email)
-}
-
 func (s *Server) RequireSession(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		uidStr := s.Sessions.GetString(r.Context(), auth.SessionUserIDKey)

apps/api/internal/httpapi/server.go

@@ -343,12 +343,10 @@ func (s *Server) Router() http.Handler {
 		r.Route("/api/admin", func(r chi.Router) {
 			r.Use(s.RequireSession)
 
-			// Non-prod only: user switch / impersonation (handlers also fail closed).
-			if !s.Config.IsProduction() {
-				r.Get("/dev/switchable-users", s.handleAdminDevListSwitchableUsers)
-				r.Post("/dev/stop-impersonate", s.handleAdminDevStopImpersonate)
-				r.Post("/users/{id}/impersonate", s.handleAdminDevImpersonate)
-			}
+			// User switch / impersonation: platform staff_role=admin (handlers enforce).
+			r.Get("/dev/switchable-users", s.handleAdminDevListSwitchableUsers)
+			r.Post("/dev/stop-impersonate", s.handleAdminDevStopImpersonate)
+			r.Post("/users/{id}/impersonate", s.handleAdminDevImpersonate)
 
 			// Support desk: full admin OR support_staff (least privilege).
 			r.Group(func(r chi.Router) {
@@ -389,11 +387,9 @@ func (s *Server) Router() http.Handler {
 				r.Get("/users", s.handleAdminListUsers)
 				r.Patch("/users/{id}/staff-role", s.handleAdminSetStaffRole)
 				r.Put("/support/agents/{id}", s.handleAdminSetSupportAgent)
-				r.Get("/staff", s.handleAdminListStaff)
-				if !s.Config.IsProduction() {
-					r.Post("/users/{id}/dev-password", s.handleAdminDevSetPassword)
-				}
-				r.Get("/companies", s.handleAdminListCompanies)
+			r.Get("/staff", s.handleAdminListStaff)
+			r.Post("/users/{id}/dev-password", s.handleAdminDevSetPassword)
+			r.Get("/companies", s.handleAdminListCompanies)
 				r.Get("/readiness", s.handleAdminReadiness)
 				r.Get("/diagnostics", s.handleAdminDiagnostics)
 				r.Get("/analytics", s.handleAdminAnalytics)

apps/api/login.json

@@ -0,0 +1 @@
+{"user":{"id":"6bf00877-a693-4d77-b28e-8c8292adac98","email":"a1-primary@descrybe.local","name":"A1 user","must_set_password":false,"is_platform_admin":false,"is_active":true},"company_id":"604f23a8-b66e-4b21-8b45-0d72b68f4790","companies":[{"id":"604f23a8-b66e-4b21-8b45-0d72b68f4790","name":"A1 Slovenija"}]}