Fix dashboard multi-user auth flow

Author: ersinkoc

internal/admin/admin_coverage2_test.go

@@ -273,6 +273,30 @@ func TestSettingsPut(t *testing.T) {
 	}
 }
 
+func TestSettingsPutEnablesAuthManager(t *testing.T) {
+	s := testServer()
+	dir := t.TempDir()
+	cfgPath := filepath.Join(dir, "uwas.yaml")
+	os.WriteFile(cfgPath, []byte("global: {}"), 0644)
+	s.SetConfigPath(cfgPath)
+	s.config.Global.WebRoot = dir
+	s.authMgr = nil
+
+	req := httptest.NewRequest("PUT", "/api/v1/settings", strings.NewReader(`{"global.users.enabled":true}`))
+	rec := httptest.NewRecorder()
+	s.handleSettingsPut(rec, withAdminContext(req))
+
+	if rec.Code != 200 {
+		t.Fatalf("status = %d, want 200, body: %s", rec.Code, rec.Body.String())
+	}
+	if s.authMgr == nil {
+		t.Fatal("auth manager was not initialized")
+	}
+	if mgr, ok := s.authMgr.(*auth.Manager); ok {
+		mgr.Stop()
+	}
+}
+
 func TestSettingsPutBadJSON(t *testing.T) {
 	s := testServer()
 	rec := httptest.NewRecorder()
@@ -627,7 +651,7 @@ func TestUserCreateAuthInvalidRole(t *testing.T) {
 	s := testServer()
 	s.SetAuthManager(newMockAuthManager())
 	rec := httptest.NewRecorder()
-	req := withAdminContext(httptest.NewRequest("POST", "/api/v1/auth/users", strings.NewReader(`{"username":"newuser","email":"a@b.com","password":"pass","role":"admin"}`)))
+	req := withAdminContext(httptest.NewRequest("POST", "/api/v1/auth/users", strings.NewReader(`{"username":"newuser","email":"a@b.com","password":"pass","role":"superadmin"}`)))
 	req.RemoteAddr = "10.0.0.1:1234"
 	s.handleUserCreateAuth(rec, req)
 	if rec.Code != 400 {

internal/admin/api.go

@@ -4032,11 +4032,37 @@ func (s *Server) handleSettingsPut(w http.ResponseWriter, r *http.Request) {
 	}
 	s.configMu.Unlock()
 
+	s.ensureAuthManagerFromConfig()
 	s.persistConfig()
 	s.recordAuditR(r, "settings.update", fmt.Sprintf("%d fields", len(updates)), true)
 	jsonResponse(w, map[string]any{"status": "saved", "updated": len(updates)})
 }
 
+func (s *Server) ensureAuthManagerFromConfig() {
+	s.configMu.RLock()
+	enabled := s.config.Global.Users.Enabled
+	webRoot := s.config.Global.WebRoot
+	apiKey := s.config.Global.Admin.APIKey
+	allowLegacyPlaintext := s.config.Global.Users.AllowLegacyPlaintextAPIKey
+	s.configMu.RUnlock()
+
+	if !enabled {
+		return
+	}
+	if s.authMgr == nil {
+		mgr := auth.NewManager(webRoot, apiKey)
+		mgr.SetAllowLegacyPlaintextKey(allowLegacyPlaintext)
+		s.authMgr = mgr
+		if s.logger != nil {
+			s.logger.Info("multi-user auth enabled from settings")
+		}
+		return
+	}
+	if mgr, ok := s.authMgr.(*auth.Manager); ok {
+		mgr.SetAllowLegacyPlaintextKey(allowLegacyPlaintext)
+	}
+}
+
 func toInt(v any) int {
 	switch n := v.(type) {
 	case float64:
@@ -5136,7 +5162,7 @@ func (s *Server) handleUserCreateAuth(w http.ResponseWriter, r *http.Request) {
 	}
 
 	role := auth.Role(req.Role)
-	if role != auth.RoleUser && role != auth.RoleReseller {
+	if role != auth.RoleAdmin && role != auth.RoleUser && role != auth.RoleReseller {
 		jsonError(w, "invalid role", http.StatusBadRequest)
 		return
 	}