Bearer token authentication fails with enterprise license active

src/lib/server/authorize.ts

@@ -159,8 +159,8 @@ export async function authorize(cookies: Cookies): Promise<AuthorizationContext>
 			// Must be authenticated
 			if (!user) return false;
 
-			// Admins can access all environments
+			// Admins can access all environments (use fresh isAdmin, not cached user.isAdmin)
-			if (user.isAdmin) return true;
+			if (isAdmin) return true;
 
 			// In free edition, all authenticated users have full access
 			if (!enterprise) return true;
@@ -176,8 +176,8 @@ export async function authorize(cookies: Cookies): Promise<AuthorizationContext>
 			// Must be authenticated
 			if (!user) return [];
 
-			// Admins can access all environments
+			// Admins can access all environments (use fresh isAdmin, not cached user.isAdmin)
-			if (user.isAdmin) return null;
+			if (isAdmin) return null;
 
 			// In free edition, all authenticated users have full access
 			if (!enterprise) return null;
@@ -193,8 +193,8 @@ export async function authorize(cookies: Cookies): Promise<AuthorizationContext>
 			// Must be authenticated
 			if (!user) return false;
 
-			// Admins can always manage users
+			// Admins can always manage users (use fresh isAdmin, not cached user.isAdmin)
-			if (user.isAdmin) return true;
+			if (isAdmin) return true;
 
 			// In free edition, all authenticated users have full access
 			if (!enterprise) return true;

src/routes/api/auth/tokens/[id]/+server.ts

@@ -3,6 +3,7 @@ import type { RequestHandler } from './$types';
 import { authorize } from '$lib/server/authorize';
 import { revokeApiToken } from '$lib/server/api-tokens';
 import { isAuthEnabled } from '$lib/server/auth';
+import { getRequestContext } from '$lib/server/request-context';
 import { audit } from '$lib/server/audit';
 
 /**
@@ -16,6 +17,12 @@ export const DELETE: RequestHandler = async (event) => {
 		return json({ error: 'Authentication is not enabled' }, { status: 400 });
 	}
 
+	// Bearer tokens cannot manage tokens (prevent leaked token from revoking others)
+	const reqCtx = getRequestContext();
+	if (reqCtx?.authMethod === 'bearer') {
+		return json({ error: 'Token management requires a cookie session' }, { status: 403 });
+	}
+
 	const auth = await authorize(cookies);
 	if (!auth.isAuthenticated || !auth.user) {
 		return json({ error: 'Authentication required' }, { status: 401 });