From 0d5995eb63f8801d32eb32fbe74b75b68752bfa9 Mon Sep 17 00:00:00 2001
From: CaIon <i@caion.me>
Date: Sun, 5 Jul 2026 13:35:10 +0800
Subject: [PATCH] fix(auth): allow read-only access for non-disabled tokens

---
 middleware/auth.go | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/middleware/auth.go b/middleware/auth.go
index 69c06e96..86abddc7 100644
--- a/middleware/auth.go
+++ b/middleware/auth.go
@@ -274,6 +274,17 @@ func TokenAuthReadOnly() func(c *gin.Context) {
 			return
 		}
 
+		// TokenAuthReadOnly must keep allowing other token states to query read-only
+		// data, such as token usage logs; only explicitly disabled tokens are denied.
+		if token.Status == common.TokenStatusDisabled {
+			c.JSON(http.StatusUnauthorized, gin.H{
+				"success": false,
+				"message": common.TranslateMessage(c, i18n.MsgTokenStatusUnavailable),
+			})
+			c.Abort()
+			return
+		}
+
 		userCache, err := model.GetUserCache(token.UserId)
 		if err != nil {
 			common.SysLog(fmt.Sprintf("TokenAuthReadOnly GetUserCache error for user %d: %v", token.UserId, err))