Merge branch 'main' into opencode/sunny-orchid

# Conflicts:
#	README.md

apps/aether-gateway/src/control/auth/credentials.rs

@@ -153,7 +153,7 @@ pub(super) fn extract_trusted_admin_headers(
     let user_role = header_value_str(headers, crate::constants::TRUSTED_ADMIN_USER_ROLE_HEADER)?
         .trim()
         .to_string();
-    if !user_role.eq_ignore_ascii_case("admin") {
+    if !crate::roles::can_access_admin_console(&user_role) {
         return None;
     }
     let session_id = header_value_str(headers, crate::constants::TRUSTED_ADMIN_SESSION_ID_HEADER)
@@ -171,7 +171,7 @@ pub(super) fn extract_trusted_admin_headers(
 
     Some(GatewayTrustedAdminHeaders {
         user_id,
-        user_role: "admin".to_string(),
+        user_role,
         session_id,
         management_token_id,
     })
@@ -563,6 +563,42 @@ mod tests {
         );
     }
 
+    #[test]
+    fn extracts_trusted_audit_admin_headers() {
+        let mut headers = http::HeaderMap::new();
+        headers.insert(
+            crate::constants::GATEWAY_HEADER,
+            "rust-phase3b".parse().unwrap(),
+        );
+        headers.insert(
+            crate::constants::TRUSTED_ADMIN_USER_ID_HEADER,
+            "audit-admin-1".parse().unwrap(),
+        );
+        headers.insert(
+            crate::constants::TRUSTED_ADMIN_USER_ROLE_HEADER,
+            "audit_admin".parse().unwrap(),
+        );
+        headers.insert(
+            crate::constants::TRUSTED_ADMIN_SESSION_ID_HEADER,
+            "sess-audit-1".parse().unwrap(),
+        );
+
+        let extracted = extract_request_credentials(
+            &headers,
+            &uri("/api/admin/endpoints/health/api-formats"),
+            "admin:endpoints_health",
+        );
+        assert_eq!(
+            extracted.trusted_admin_headers,
+            Some(GatewayTrustedAdminHeaders {
+                user_id: "audit-admin-1".to_string(),
+                user_role: "audit_admin".to_string(),
+                session_id: Some("sess-audit-1".to_string()),
+                management_token_id: None,
+            })
+        );
+    }
+
     #[test]
     fn ignores_trusted_admin_headers_without_gateway_marker() {
         let mut headers = http::HeaderMap::new();

apps/aether-gateway/src/control/auth/resolution.rs

@@ -273,7 +273,7 @@ async fn resolve_local_admin_principal(
     if claims
         .get("role")
         .and_then(Value::as_str)
-        .is_some_and(|role| !role.eq_ignore_ascii_case("admin"))
+        .is_some_and(|role| !crate::roles::can_access_admin_console(role))
     {
         return Ok(None);
     }
@@ -300,7 +300,7 @@ async fn resolve_local_admin_principal_from_claims(
     let Some(user) = state.find_user_auth_by_id(user_id).await? else {
         return Ok(None);
     };
-    if !user.is_active || user.is_deleted || !user.role.eq_ignore_ascii_case("admin") {
+    if !user.is_active || user.is_deleted || !crate::roles::can_access_admin_console(&user.role) {
         return Ok(None);
     }
 
@@ -329,7 +329,7 @@ async fn resolve_local_admin_principal_from_claims(
 
     Ok(Some(GatewayAdminPrincipalContext {
         user_id: user.id,
-        user_role: "admin".to_string(),
+        user_role: user.role,
         session_id: Some(session.id),
         management_token_id: None,
         management_token_permissions: None,

apps/aether-gateway/src/control/management_token_permissions.rs

@@ -224,6 +224,19 @@ pub(crate) fn read_only_management_token_permissions() -> Vec<String> {
         .collect()
 }
 
+pub(crate) fn audit_admin_read_only_management_token_permissions() -> Vec<String> {
+    let mut permissions = read_only_management_token_permissions()
+        .into_iter()
+        .collect::<BTreeSet<_>>();
+    permissions.extend(
+        PERMISSION_GROUPS
+            .iter()
+            .filter(|group| !group.assignable)
+            .map(|group| permission_key(group.scope, "read").to_string()),
+    );
+    permissions.into_iter().collect()
+}
+
 pub(crate) fn normalize_assignable_management_token_permissions(
     value: Option<&Value>,
 ) -> Result<Value, String> {
@@ -615,6 +628,64 @@ mod tests {
         .is_ok());
     }
 
+    #[test]
+    fn read_only_permissions_allow_reads_and_reject_writes() {
+        let decision = GatewayControlDecision::synthetic(
+            "/api/admin/providers".to_string(),
+            Some("admin_proxy".to_string()),
+            Some("providers_manage".to_string()),
+            Some("create_provider".to_string()),
+            Some("admin:providers".to_string()),
+        );
+        let permissions = read_only_management_token_permissions();
+
+        assert!(validate_management_token_admin_route_permission(
+            &http::Method::GET,
+            &decision,
+            Some(&permissions),
+        )
+        .is_ok());
+        assert_eq!(
+            validate_management_token_admin_route_permission(
+                &http::Method::POST,
+                &decision,
+                Some(&permissions),
+            )
+            .expect_err("read-only permissions should reject writes")
+            .required_permission,
+            "admin:providers:write"
+        );
+    }
+
+    #[test]
+    fn audit_admin_read_only_permissions_allow_management_tokens_reads_and_reject_writes() {
+        let decision = GatewayControlDecision::synthetic(
+            "/api/admin/management-tokens".to_string(),
+            Some("admin_proxy".to_string()),
+            Some("management_tokens_manage".to_string()),
+            Some("list_tokens".to_string()),
+            Some("admin:management_tokens".to_string()),
+        );
+        let permissions = audit_admin_read_only_management_token_permissions();
+
+        assert!(validate_management_token_admin_route_permission(
+            &http::Method::GET,
+            &decision,
+            Some(&permissions),
+        )
+        .is_ok());
+        assert_eq!(
+            validate_management_token_admin_route_permission(
+                &http::Method::POST,
+                &decision,
+                Some(&permissions),
+            )
+            .expect_err("read-only permissions should reject management token writes")
+            .required_permission,
+            "admin:management_tokens:write"
+        );
+    }
+
     fn extract_admin_route_scopes(source: &'static str) -> BTreeSet<&'static str> {
         let mut scopes = BTreeSet::new();
         let mut remaining = source;

apps/aether-gateway/src/control/mod.rs

@@ -14,11 +14,13 @@ pub(crate) use auth::{
 };
 pub(crate) use execute::{allows_control_execute_emergency, maybe_execute_via_control};
 pub(crate) use management_token_permissions::{
-    all_assignable_management_token_permissions, management_token_permission_catalog_payload,
-    management_token_permission_keys_from_value, management_token_permission_mode_and_summary,
+    all_assignable_management_token_permissions,
+    audit_admin_read_only_management_token_permissions,
+    management_token_permission_catalog_payload, management_token_permission_keys_from_value,
+    management_token_permission_mode_and_summary,
     management_token_permissions_cover_all_assignable_permissions,
     management_token_required_permission, normalize_assignable_management_token_permissions,
-    validate_management_token_admin_route_permission,
+    read_only_management_token_permissions, validate_management_token_admin_route_permission,
 };
 pub(crate) use public::{resolve_public_request_context, GatewayPublicRequestContext};
 #[cfg(test)]