From 04da939a22aedd4513da294c845f1a43904c8de2 Mon Sep 17 00:00:00 2001
From: wangdl <wangdl@longde.cloud>
Date: Thu, 18 Jun 2026 19:00:38 +0800
Subject: [PATCH] fix: correct admin path bypass in global JwtAuthGuard

request.path includes the global 'api' prefix, so /admin/learning
routes appear as /api/admin/learning. Bypass /api/admin in addition
to existing /admin-api and /internal paths.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 src/common/guards/jwt-auth.guard.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/common/guards/jwt-auth.guard.ts b/src/common/guards/jwt-auth.guard.ts
index 297c755..3255bdd 100644
--- a/src/common/guards/jwt-auth.guard.ts
+++ b/src/common/guards/jwt-auth.guard.ts
@@ -33,7 +33,7 @@ export class JwtAuthGuard implements CanActivate {
     const request = context.switchToHttp().getRequest<Request>();
 
     // Admin and internal routes use their own auth guards
-    if (request.path.startsWith('/admin') || request.path.startsWith('/internal')) {
+    if (request.path.startsWith('/api/admin') || request.path.startsWith('/admin-api') || request.path.startsWith('/internal')) {
       return true;
     }