fix: bridge panel admin authorization

internal/api/api.go

@@ -332,7 +332,7 @@ func (s *Server) clusterDeviceNames() []string {
 }
 
 func (s *Server) Panel(password string) http.Handler {
-	p := panelweb.New(password, s)
+	p := panelweb.New(password, s.AdminToken, s)
 	go p.Cleanup()
 	return p.Handler()
 }

internal/web/panel.go

@@ -25,13 +25,14 @@ type Runner interface {
 
 type Panel struct {
 	Password   string
+	AdminToken string
 	Runner     Runner
 	mu         sync.RWMutex
 	sessions   map[string]time.Time
 }
 
-func New(password string, runner Runner) *Panel {
+func New(password, adminToken string, runner Runner) *Panel {
-	return &Panel{Password: password, Runner: runner, sessions: make(map[string]time.Time)}
+	return &Panel{Password: password, AdminToken: adminToken, Runner: runner, sessions: make(map[string]time.Time)}
 }
 
 func (p *Panel) Handler() http.Handler {
@@ -110,6 +111,9 @@ func (p *Panel) securitySettings(w http.ResponseWriter, r *http.Request) {
 	http.Error(w, "security API unavailable", 501)
 }
 func (p *Panel) updateSecuritySettings(w http.ResponseWriter, r *http.Request) {
+	if p.AdminToken != "" {
+		r.Header.Set("X-Admin-Token", p.AdminToken)
+	}
 	if v, ok := p.Runner.(securityPanelRunner); ok {
 		v.UpdateSecuritySettingsJSON(w, r)
 		return

internal/web/panel_test.go

@@ -16,7 +16,7 @@ func (testRunner) RotateAPIKey(w http.ResponseWriter, r *http.Request) {}
 func (testRunner) DeleteDevice(w http.ResponseWriter, r *http.Request) {}
 
 func TestStaticCSSContentType(t *testing.T) {
-	p := New("test-password", testRunner{})
+	p := New("test-password", "admin", testRunner{})
 	req := httptest.NewRequest("GET", "/static/app.css", nil)
 	rec := httptest.NewRecorder()