fix: restore jwt login and control-plane checks

console/internal/api/auth.go

@@ -37,37 +37,32 @@ func (s *Server) userNS(r *http.Request) string {
 func (s *Server) authMiddleware(h http.HandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		var ns string
+		env := strings.TrimSpace(strings.ToLower(r.Header.Get("X-Auth-Env")))
+		if _, ok := deckAPIs[env]; !ok {
+			env = "test"
+		}
 
 		if s.testMode {
 			sub := strings.TrimSpace(r.Header.Get("X-Test-Sub"))
-			if sub == "" {
-				sub = strings.TrimSpace(r.Header.Get("X-Auth-Token"))
+			if sub != "" {
+				ns = namespaceFromSub(sub)
+			} else {
+				token := strings.TrimSpace(r.Header.Get("X-Auth-Token"))
+				resolvedNS, err := s.resolveNamespaceForToken(token, env, true)
+				if err != nil {
+					writeJSONError(w, http.StatusUnauthorized, "unauthorized")
+					return
+				}
+				ns = resolvedNS
 			}
-			if sub == "" {
-				writeJSONError(w, http.StatusUnauthorized, "test mode: X-Test-Sub required")
-				return
-			}
-			h32 := sha256.Sum256([]byte(sub))
-			ns = "fission-" + hex.EncodeToString(h32[:8])
 		} else {
 			token := strings.TrimSpace(r.Header.Get("X-Auth-Token"))
-			env := strings.TrimSpace(strings.ToLower(r.Header.Get("X-Auth-Env")))
-			if _, ok := deckAPIs[env]; !ok {
-				env = "test"
-			}
-			if token == "" {
-				writeJSONError(w, http.StatusUnauthorized, "unauthorized")
-				return
-			}
-			if err := s.validateDeckToken(token, env); err != nil {
-				writeJSONError(w, http.StatusUnauthorized, "unauthorized")
-				return
-			}
-			var err error
-			ns, err = namespaceFromJWT(token)
+			resolvedNS, err := s.resolveNamespaceForToken(token, env, false)
 			if err != nil {
-				ns = s.ns
+				writeJSONError(w, http.StatusUnauthorized, "unauthorized")
+				return
 			}
+			ns = resolvedNS
 		}
 
 		ctx := context.WithValue(r.Context(), ctxKeyNS{}, ns)
@@ -83,6 +78,35 @@ func (s *Server) authMiddleware(h http.HandlerFunc) http.HandlerFunc {
 	}
 }
 
+func namespaceFromSub(sub string) string {
+	h32 := sha256.Sum256([]byte(sub))
+	return "fission-" + hex.EncodeToString(h32[:8])
+}
+
+func (s *Server) resolveNamespaceForToken(token, env string, allowTestSub bool) (string, error) {
+	token = strings.TrimSpace(token)
+	if token == "" {
+		if allowTestSub {
+			return "", fmt.Errorf("test mode: X-Test-Sub required")
+		}
+		return "", fmt.Errorf("unauthorized")
+	}
+
+	if err := s.validateDeckToken(token, env); err == nil {
+		ns, nsErr := namespaceFromJWT(token)
+		if nsErr != nil {
+			return s.ns, nil
+		}
+		return ns, nil
+	}
+
+	if allowTestSub && strings.Contains(token, "@") {
+		return namespaceFromSub(token), nil
+	}
+
+	return "", fmt.Errorf("invalid token")
+}
+
 // namespaceFromJWT декодирует JWT payload (без верификации подписи),
 // извлекает claim "sub" и вычисляет namespace: "fission-" + hex(SHA256(sub)[:8]).
 //