From 5f6de2c02cc3243fe44b1496ad710b50235b070a Mon Sep 17 00:00:00 2001
From: Oliver Kieselbach <oliver.kieselbach@outlook.com>
Date: Sun, 10 May 2026 23:56:23 +0200
Subject: [PATCH] fix health dashboard

---
 .../Functions/Infrastructure/HealthCheckFunction.cs    | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/Backend/AutopilotMonitor.Functions/Functions/Infrastructure/HealthCheckFunction.cs b/src/Backend/AutopilotMonitor.Functions/Functions/Infrastructure/HealthCheckFunction.cs
index a5a16d23..ed1109db 100644
--- a/src/Backend/AutopilotMonitor.Functions/Functions/Infrastructure/HealthCheckFunction.cs
+++ b/src/Backend/AutopilotMonitor.Functions/Functions/Infrastructure/HealthCheckFunction.cs
@@ -14,6 +14,7 @@ namespace AutopilotMonitor.Functions.Functions.Infrastructure
         private readonly HealthCheckService _healthCheckService;
         private readonly IMemoryCache _cache;
         private readonly BackendBuildInfo _buildInfo;
+        private readonly GlobalAdminService _globalAdminService;
 
         private const int MaxRequestsPerMinute = 30;
         private static readonly TimeSpan RateWindow = TimeSpan.FromMinutes(1);
@@ -22,12 +23,14 @@ namespace AutopilotMonitor.Functions.Functions.Infrastructure
             ILogger<HealthCheckFunction> logger,
             HealthCheckService healthCheckService,
             IMemoryCache cache,
-            BackendBuildInfo buildInfo)
+            BackendBuildInfo buildInfo,
+            GlobalAdminService globalAdminService)
         {
             _logger = logger;
             _healthCheckService = healthCheckService;
             _cache = cache;
             _buildInfo = buildInfo;
+            _globalAdminService = globalAdminService;
         }
 
         /// <summary>
@@ -103,8 +106,11 @@ namespace AutopilotMonitor.Functions.Functions.Infrastructure
             // SignalR Quota check exposes the subscription/resource-group path of the
             // backing SignalR resource — restrict to Global Admins. Non-GA callers
             // (Tenant Admins, Operators) get the rest of the report unchanged.
+            // The route is registered as AuthenticatedUser, so PolicyEnforcementMiddleware
+            // does NOT compute IsGlobalAdmin; resolve it directly via GlobalAdminService.
             var requestCtx = context.GetRequestContext();
-            var visibleChecks = requestCtx.IsGlobalAdmin
+            var isGlobalAdmin = await _globalAdminService.IsGlobalAdminAsync(requestCtx.UserPrincipalName);
+            var visibleChecks = isGlobalAdmin
                 ? healthCheckResult.Checks
                 : healthCheckResult.Checks.Where(c => c.Name != "SignalR Quota").ToList();