From 0f8d160c54b2c6a36f34850b8be6b9dc74ecf39d Mon Sep 17 00:00:00 2001
From: "2569718930@qq.com" <2569718930@qq.com>
Date: Wed, 20 May 2026 21:57:27 +0800
Subject: [PATCH] =?UTF-8?q?entitlement=20=E6=97=A0=E8=BD=AC=E5=8F=91?=
 =?UTF-8?q?=E5=A4=B4=E6=97=B6=E8=BF=94=E5=9B=9E=E5=8D=A0=E4=BD=8D=E8=BA=AB?=
 =?UTF-8?q?=E4=BB=BD=EF=BC=8C=E4=BA=A4=E7=94=B1=20ops=20admin=20=E8=A3=81?=
 =?UTF-8?q?=E5=86=B3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 web/core.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/web/core.py b/web/core.py
index ee076968..6b246173 100644
--- a/web/core.py
+++ b/web/core.py
@@ -310,6 +310,10 @@ def _require_supabase_identity(request: Request) -> Dict[str, str]:
         if forwarded_user_id:
             forwarded_email = str(request.headers.get(_FORWARDED_SUPABASE_EMAIL_HEADER) or "").strip()
             return {"user_id": forwarded_user_id, "email": forwarded_email}
+        # Entitlement token is valid but forwarded headers are missing.
+        # Return a placeholder identity — callers (e.g. _require_ops_admin)
+        # can decide whether to accept it.
+        return {"user_id": "entitlement", "email": ""}
 
     logger.warning(
         "payment auth identity missing state_user={} auth_bearer={} legacy_ok={} forwarded_user={}"