From 1af47698a1102cada79f7e8eb2afca57864157bb Mon Sep 17 00:00:00 2001
From: openclaw <openclaw@openclaws-MacBook-Air.local>
Date: Tue, 9 Jun 2026 15:00:44 -0600
Subject: [PATCH] debug: comprehensive logging to trace auth

---
 src/lib/admin-permissions.ts | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/src/lib/admin-permissions.ts b/src/lib/admin-permissions.ts
index 8a12cfb..9b012a4 100644
--- a/src/lib/admin-permissions.ts
+++ b/src/lib/admin-permissions.ts
@@ -39,6 +39,7 @@ export async function getAdminUser(): Promise<AdminUser | null> {
   let sessionEmail: string | null = null;
   try {
     const { data: session } = await getSession();
+    console.log("[admin-permissions] Full session:", JSON.stringify(session));
     sessionEmail = session?.user?.email ?? null;
     console.log("[admin-permissions] Session email:", sessionEmail);
   } catch (err) {
@@ -46,18 +47,25 @@ export async function getAdminUser(): Promise<AdminUser | null> {
     return null;
   }
 
-  if (!sessionEmail) return null;
+  if (!sessionEmail) {
+    console.log("[admin-permissions] No session email - returning null");
+    return null;
+  }
 
   try {
     return await withPlatformAdmin(async (db) => {
+      console.log("[admin-permissions] Looking for user with email:", sessionEmail.toLowerCase());
       const userRows = await db
         .select()
         .from(adminUsers)
         .where(eq(adminUsers.email, sessionEmail.toLowerCase()))
         .limit(1);
-      console.log("[admin-permissions] User rows found:", userRows.length);
+      console.log("[admin-permissions] User rows found:", userRows.length, userRows);
       const user = userRows[0];
-      if (!user) return null;
+      if (!user) {
+        console.log("[admin-permissions] User not found in admin_users");
+        return null;
+      }
 
       const membershipRows = await db
         .select({
@@ -73,7 +81,7 @@ export async function getAdminUser(): Promise<AdminUser | null> {
         .where(eq(adminUserBrands.adminUserId, user.id))
         .limit(1);
 
-      console.log("[admin-permissions] Membership rows found:", membershipRows.length);
+      console.log("[admin-permissions] Membership rows found:", membershipRows.length, membershipRows);
       if (membershipRows.length === 0) {
         // Signed in but not provisioned for any brand.
         return null;