fix: decode bearer tokens for IM HTTP

server/im_http.go

@@ -4848,7 +4848,11 @@ func resolveIMHTTPBearer(req *http.Request) (*imPrincipal, error) {
 	if handler == nil || !handler.IsInitialized() {
 		return nil, types.ErrUnsupported
 	}
-	rec, _, err := handler.Authenticate(auth.AuthContext{}, []byte(strings.TrimSpace(token)))
+	secret := []byte(strings.TrimSpace(token))
+	if decoded, err := base64.StdEncoding.DecodeString(strings.TrimSpace(token)); err == nil {
+		secret = decoded
+	}
+	rec, _, err := handler.Authenticate(auth.AuthContext{}, secret)
 	if err != nil || rec == nil || rec.TenantID.IsZero() || rec.Uid.IsZero() {
 		return nil, types.ErrPermissionDenied
 	}

server/im_http_test.go

@@ -940,6 +940,23 @@ func expectIMBearer(t *testing.T, ctrl *gomock.Controller, token string, tenantI
 	return mockStore
 }
 
+func TestResolveIMHTTPBearerAcceptsBase64Token(t *testing.T) {
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+	expectIMBearer(t, ctrl, "token-1", 7, 42)
+
+	req := httptest.NewRequest(http.MethodGet, "/v1/im/bootstrap", nil)
+	req.Header.Set("Authorization", "Bearer "+base64.StdEncoding.EncodeToString([]byte("token-1")))
+
+	principal, err := resolveIMHTTPBearer(req)
+	if err != nil {
+		t.Fatalf("resolve bearer: %v", err)
+	}
+	if principal.TenantID != 7 || principal.Uid != 42 {
+		t.Fatalf("principal mismatch: %#v", principal)
+	}
+}
+
 func TestIMHTTPProtocolHeaders(t *testing.T) {
 	apiKey := makeTestAPIKey(t)
 	called := 0