From d10c05b03059187664aa2463e180f5d6457aab24 Mon Sep 17 00:00:00 2001
From: richjohnrambo <richjohnrambo@gmail.com>
Date: Mon, 17 Aug 2026 15:08:32 +0800
Subject: [PATCH] fix: decode bearer tokens for IM HTTP

---
 server/im_http.go      |  6 +++++-
 server/im_http_test.go | 17 +++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/server/im_http.go b/server/im_http.go
index d2f8098..78c6e94 100644
--- a/server/im_http.go
+++ b/server/im_http.go
@@ -4848,7 +4848,11 @@ func resolveIMHTTPBearer(req *http.Request) (*imPrincipal, error) {
 	if handler == nil || !handler.IsInitialized() {
 		return nil, types.ErrUnsupported
 	}
-	rec, _, err := handler.Authenticate(auth.AuthContext{}, []byte(strings.TrimSpace(token)))
+	secret := []byte(strings.TrimSpace(token))
+	if decoded, err := base64.StdEncoding.DecodeString(strings.TrimSpace(token)); err == nil {
+		secret = decoded
+	}
+	rec, _, err := handler.Authenticate(auth.AuthContext{}, secret)
 	if err != nil || rec == nil || rec.TenantID.IsZero() || rec.Uid.IsZero() {
 		return nil, types.ErrPermissionDenied
 	}
diff --git a/server/im_http_test.go b/server/im_http_test.go
index 3dcbb49..ca8fe08 100644
--- a/server/im_http_test.go
+++ b/server/im_http_test.go
@@ -940,6 +940,23 @@ func expectIMBearer(t *testing.T, ctrl *gomock.Controller, token string, tenantI
 	return mockStore
 }
 
+func TestResolveIMHTTPBearerAcceptsBase64Token(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	expectIMBearer(t, ctrl, "token-1", 7, 42)
+
+	req := httptest.NewRequest(http.MethodGet, "/v1/im/bootstrap", nil)
+	req.Header.Set("Authorization", "Bearer "+base64.StdEncoding.EncodeToString([]byte("token-1")))
+
+	principal, err := resolveIMHTTPBearer(req)
+	if err != nil {
+		t.Fatalf("resolve bearer: %v", err)
+	}
+	if principal.TenantID != 7 || principal.Uid != 42 {
+		t.Fatalf("principal mismatch: %#v", principal)
+	}
+}
+
 func TestIMHTTPProtocolHeaders(t *testing.T) {
 	apiKey := makeTestAPIKey(t)
 	called := 0