fix: compliance auth checks X-User-IsAdmin from IAM JWT (no separate admin store)

pkg/auth/auth.go

@@ -44,11 +44,13 @@ func Middleware() func(http.Handler) http.Handler {
 // RequirePermission checks roles from X-User-Roles (set by Gateway
 // from JWT claims). Admin role grants all permissions. Authenticated
 // users without explicit roles get "read" access.
+// X-User-IsAdmin: true (from IAM JWT isAdmin claim) also grants admin.
 func RequirePermission(perm string) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			roles := r.Header.Get("X-User-Roles")
-			if hasRole(roles, perm) || hasRole(roles, "admin") {
+			isAdmin := strings.EqualFold(r.Header.Get("X-User-IsAdmin"), "true")
+			if isAdmin || hasRole(roles, perm) || hasRole(roles, "admin") {
 				next.ServeHTTP(w, r)
 				return
 			}

pkg/compliance/router.go

@@ -251,6 +251,13 @@ func NewRouter(store ComplianceStore, opts ...RouterOption) chi.Router {
 func requireRole(store ComplianceStore, module, action string, next http.HandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		roleName := r.Header.Get("X-User-Roles")
+		isAdmin := strings.EqualFold(r.Header.Get("X-User-IsAdmin"), "true")
+
+		// IAM isAdmin claim grants superadmin access
+		if isAdmin && roleName == "" {
+			roleName = "superadmin"
+		}
+
 		if roleName == "" {
 			writeError(w, http.StatusForbidden, "no role in token")
 			return