Fixed user management

supabase/functions/admin_user_management/index.ts

@@ -46,8 +46,42 @@ serve(async (req) => {
   });
   const { data: authData, error: authError } =
     await authClient.auth.getUser();
+
+  // DEBUG: log auth results to help diagnose intermittent 401s from the
+  // gateway / auth service. Remove these logs before deploying to production.
+  console.log("admin_user_management: token-snippet", token.slice(0, 16));
+  console.log("admin_user_management: authData", JSON.stringify(authData));
+  console.log("admin_user_management: authError", JSON.stringify(authError));
+
   if (authError || !authData?.user) {
-    return jsonResponse({ error: "Unauthorized" }, 401);
+    // Extract token header (kid/alg) for debugging without revealing the full
+    // token. This helps confirm which key the gateway/runtime attempted to
+    // verify against.
+    let tokenHeader: unknown = null;
+    try {
+      const headerB64 = token.split(".")[0] ?? "";
+      tokenHeader = JSON.parse(atob(headerB64));
+    } catch (e) {
+      tokenHeader = { parseError: (e as Error).message };
+    }
+
+    return jsonResponse(
+      {
+        error: "Unauthorized",
+        debug: {
+          authError: authError?.message ?? null,
+          tokenHeader,
+          authDataUser: authData?.user
+            ? {
+                id: authData.user.id,
+                email: authData.user.email ?? null,
+                banned_until: authData.user.banned_until ?? null,
+              }
+            : null,
+        },
+      },
+      401,
+    );
   }
 
   const adminClient = createClient(supabaseUrl, serviceKey);