Bug: Admin session broken — cookie path /api/admin/v1/auth doesn't cover other admin APIs, frontend 401 on all endpoints

[echoriver89]

Summary

After v3.1.4 upgrade, the frontend SPA cannot access any admin API other than /api/admin/v1/auth/*. All other endpoints return 401 adminUnauthorized, and the frontend shows "服务返回了无效响应" when trying to sync models or perform any admin action.

Root Cause

Two design mismatches combine to break admin auth entirely:

1. Cookie path scope mismatch

backend/internal/transport/http/adminauth/handler.go line 188-189:

c.SetCookie(refreshCookieName, value.RefreshToken, maxAge, "/api/admin/v1/auth", "", h.secureCookies || c.Request.TLS != nil, true)

The refresh token cookie is set with Path=/api/admin/v1/auth. Per RFC 6265, this cookie is only sent for requests whose path starts with /api/admin/v1/auth/. All other admin API paths (e.g., /api/admin/v1/models, /api/admin/v1/dashboard) do NOT receive this cookie.

2. Frontend never sends Authorization header

Searching the built assets/index-CD2fvhal.js confirms:

• The string "Authorization" does not appear in the JS bundle
• The string "Bearer" does not appear in the JS bundle
• The frontend relies entirely on cookies to authenticate admin API calls

This means:

• The refresh cookie (Path=/api/admin/v1/auth) is only sent to the auth refresh endpoint
• No other admin endpoint receives any auth credential
• All admin APIs return 401

Reproduction

1. Start grok2api v3.1.4
2. Open browser at http://127.0.0.1:20131
3. Login with admin credentials
4. Click "同步模型" → "服务返回了无效响应"
5. Open DevTools → Network → all /api/admin/v1/* requests (except /auth/*) return 401

Proposed Fix

Either:

• (a) Set the refresh cookie with Path="/" so it covers all admin APIs, AND have the middleware also accept access tokens from a cookie (not just Bearer header)
• (b) Or have the frontend inject Authorization: Bearer <token> into fetch calls and store the access token in localStorage

Workaround

Currently none. The only workaround would be to manually patch and rebuild.