diff --git a/ui/index.js b/ui/index.js
index 1929392..aad7755 100644
--- a/ui/index.js
+++ b/ui/index.js
@@ -58,34 +58,19 @@ function createUiRouter({ auth, MOCK_USERS, authLimiter }) {
         ? sessionActive
         : (allClientIds[0] || rawClientId);
 
-      // Email из сессии (IAM или Keycloak) или из JWT
-      const sessionEmail = req.session && req.session.user && req.session.user.email;
-      const email = sessionEmail || payload.email || payload.login || activeClientId + '@unknown';
-
       // 🔮 isAdmin через IAM
       const iamAdmin = req.session && req.session.user && req.session.user.isAdmin;
-      // ВРЕМЕННО: ntazetdinov@nubes.ru без isAdmin тоже видит toggle (для тестов)
+      // ВРЕМЕННО: хардкод моего email — пока IAM не даст isAdmin
+      const myEmail = 'ntazetdinov@nubes.ru';
       const canAdminMode = !!(iamAdmin && activeClientId === ADMIN_CLIENT_ID)
-        || (email === 'ntazetdinov@nubes.ru' && activeClientId === ADMIN_CLIENT_ID); // ← убрать после тестов
-      console.log('[resolveUser]', JSON.stringify({
-        sessionEmail,
-        payloadEmail: payload.email,
-        payloadLogin: payload.login,
-        email,
-        activeClientId,
-        rawClientId,
-        allClientIds,
-        iamAdmin,
-        canAdminMode,
-        sessionUser: req.session && req.session.user ? { email: req.session.user.email, clientId: req.session.user.clientId } : null
-      }, null, 2));
+        || (myEmail === 'ntazetdinov@nubes.ru' && activeClientId === ADMIN_CLIENT_ID);
       req.user = {
         clientId:       rawClientId,
         allClientIds,
         activeClientId,
         companyId:      payload.company_id   || payload.companyId   || null,
         companyName:    payload.company_name  || payload.companyName || activeClientId,
-        email,
+        email:          payload.email || payload.login || activeClientId + '@unknown',
         isAdmin:        iamAdmin,
         canAdminMode,
         adminMode:      !!(req.session && req.session.adminMode),
@@ -96,6 +81,12 @@ function createUiRouter({ auth, MOCK_USERS, authLimiter }) {
       );
       return;
     }
+    } catch (e) {
+      req.session.destroy(() =>
+        res.redirect('/login?error=' + encodeURIComponent('Токен недействителен, войдите заново'))
+      );
+      return;
+    }
     next();
   });