From 4229f44810957fbeac0c9e1cb47341e238ec616e Mon Sep 17 00:00:00 2001
From: xuans <likb_blue@163.com>
Date: Wed, 30 Sep 2026 04:58:58 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8D=E7=AE=A1=E7=90=86=E5=91=98?=
 =?UTF-8?q?=E9=A1=B9=E7=9B=AE=E6=9D=83=E9=99=90=E4=B8=8A=E4=B8=8B=E6=96=87?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

补齐管理员请求的操作者身份上下文，恢复超级管理员读取和管理 SSH 私钥的项目授权，并增加回归测试。
---
 backend/internal/httpapi/middleware.go   |  1 +
 backend/internal/httpapi/ssh_key_test.go | 33 ++++++++++++++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/backend/internal/httpapi/middleware.go b/backend/internal/httpapi/middleware.go
index cc27ee0..67b61d5 100644
--- a/backend/internal/httpapi/middleware.go
+++ b/backend/internal/httpapi/middleware.go
@@ -72,6 +72,7 @@ func (s *Server) requireAdmin(c *gin.Context) {
 		})
 		return
 	}
+	c.Set(authenticatedActorKey, session.UserID)
 	c.Next()
 }
 
diff --git a/backend/internal/httpapi/ssh_key_test.go b/backend/internal/httpapi/ssh_key_test.go
index d82c797..5e21e20 100644
--- a/backend/internal/httpapi/ssh_key_test.go
+++ b/backend/internal/httpapi/ssh_key_test.go
@@ -19,6 +19,39 @@ import (
 	"git.pcux.cn/xuans/Scert/backend/internal/sshkey"
 )
 
+func TestSSHKeyAPIAllowsSuperAdminProjectAuthorization(t *testing.T) {
+	directory := t.TempDir()
+	cfg := readyTestConfig(directory)
+	cfg.Database.DSN = filepath.Join(directory, "data", "ssh-keys-super-admin.db")
+	db, err := database.Open(context.Background(), cfg.Database)
+	if err != nil {
+		t.Fatalf("open database: %v", err)
+	}
+	defer db.Close()
+	if err := database.Migrate(context.Background(), db.DB, "sqlite"); err != nil {
+		t.Fatalf("migrate database: %v", err)
+	}
+	if _, err := db.DB.ExecContext(t.Context(), `INSERT INTO users (id, username, email, password_hash, role, status) VALUES ('super-admin', 'super-admin', 'super-admin@example.invalid', 'test-only-no-login', 'super_admin', 'active')`); err != nil {
+		t.Fatalf("create super admin: %v", err)
+	}
+	store, err := secretstore.Open(filepath.Join(directory, "config"))
+	if err != nil {
+		t.Fatalf("open secret store: %v", err)
+	}
+	server := New(Dependencies{
+		Config:         cfg,
+		Repository:     repository.NewSQLDomainRepository(db.DB),
+		ProjectDomains: repository.NewSQLProjectMemberRepository(db.DB),
+		SSHKeys:        sshkey.NewService(store),
+	})
+	response := httptest.NewRecorder()
+	request := httptest.NewRequest(http.MethodGet, "/api/v1/ssh-keys", nil)
+	request.AddCookie(httpUserSessionCookie(server, "super-admin", repository.UserRoleSuperAdmin))
+	server.Handler().ServeHTTP(response, request)
+	if response.Code != http.StatusOK {
+		t.Fatalf("super admin SSH key list failed: %d %s", response.Code, response.Body.String())
+	}
+}
 func TestSSHKeyAPIHidesPrivateKeyAndBlocksDeletingUsedReference(t *testing.T) {
 	directory := t.TempDir()
 	cfg := readyTestConfig(directory)