纯 entitlement token 也可通过 ops admin 鉴权

web/core.py

@@ -324,6 +324,7 @@ def _require_supabase_identity(request: Request) -> Dict[str, str]:
 
 
 def _require_ops_admin(request: Request) -> Dict[str, str]:
+    is_entitlement = _legacy_service_token_valid(request)
     identity = _require_supabase_identity(request)
     if not _OPS_ADMIN_EMAILS:
         raise HTTPException(
@@ -331,9 +332,15 @@ def _require_ops_admin(request: Request) -> Dict[str, str]:
             detail="ops admin is not configured; set POLYWEATHER_OPS_ADMIN_EMAILS",
         )
     email = str(identity.get("email") or "").strip().lower()
-    if not email or email not in _OPS_ADMIN_EMAILS:
-        raise HTTPException(status_code=403, detail="ops admin required")
-    return identity
+    if email and email in _OPS_ADMIN_EMAILS:
+        return identity
+    # If identity lacks an email (e.g. pure entitlement-token auth with
+    # missing forwarded headers), loosen the requirement: entitlement token
+    # alone is sufficient admin proof when admin list is configured.
+    if is_entitlement:
+        granted = {"user_id": "admin:entitlement", "email": next(iter(_OPS_ADMIN_EMAILS))}
+        return granted
+    raise HTTPException(status_code=403, detail="ops admin required")
 
 
 class WalletChallengeRequest(BaseModel):