fix

apps/api/internal/httpapi/middleware.go

@@ -68,8 +68,6 @@ func requireCompanyAdmin(w http.ResponseWriter, r *http.Request) bool {
 
 // allowCompanyAdminOrPlatform allows company admins, API keys, or platform admins.
 // Platform admins can manage team after migration when all memberships are still "member".
-// Non-prod: while a privileged demo/platform actor is impersonating, retain company-admin powers
-// so local user-switch can still create API keys and manage the tenant.
 func (s *Server) allowCompanyAdminOrPlatform(w http.ResponseWriter, r *http.Request) bool {
 	if CompanyAdminAllowed(r.Context()) {
 		return true
@@ -87,38 +85,10 @@ func (s *Server) allowCompanyAdminOrPlatform(w http.ResponseWriter, r *http.Requ
 	if isAdmin {
 		return true
 	}
-	if s.devImpersonatorRetainsCompanyAdmin(r) {
-		return true
-	}
 	Error(w, http.StatusForbidden, "admin required")
 	return false
 }
 
-// devImpersonatorRetainsCompanyAdmin is true in non-production when the session is
-// impersonating and the stored actor is still a privileged demo/platform admin.
-func (s *Server) devImpersonatorRetainsCompanyAdmin(r *http.Request) bool {
-	if s.Config.IsProduction() || s.Sessions == nil {
-		return false
-	}
-	impStr := strings.TrimSpace(s.Sessions.GetString(r.Context(), auth.SessionImpersonatorIDKey))
-	if impStr == "" {
-		return false
-	}
-	impID, err := uuid.Parse(impStr)
-	if err != nil || impID == uuid.Nil {
-		return false
-	}
-	access, err := s.checkStaffAccess(r.Context(), impID)
-	if err == nil && access.FullAdmin {
-		return true
-	}
-	if s.Auth == nil {
-		return false
-	}
-	impUser, err := s.Auth.GetUser(r.Context(), impID)
-	return err == nil && isLocalDemoEmail(impUser.Email)
-}
-
 func (s *Server) RequireSession(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		uidStr := s.Sessions.GetString(r.Context(), auth.SessionUserIDKey)