fix: harden dashboard auth and terminal flows

Tighten terminal websocket auth and proxy trust handling while making file-backed auth/RBAC writes atomic to reduce high-impact security and persistence risks.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

dashboard/backend/routers/system.py

@@ -5,6 +5,7 @@ import platform
 import time
 import httpx
 from fastapi import APIRouter, Query, Request, HTTPException
+import config
 from config import TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID, VOLUME_ROOT, OPENCLAW_GATEWAY_TOKEN
 
 router = APIRouter()
@@ -116,13 +117,11 @@ def _classify(method, path, status, user):
 
 @router.get("/openclaw-token")
 def openclaw_token(request: Request):
-    ip = request.client.host
-    import config
-    if config.is_trusted_proxy(ip):
-        forwarded = request.headers.get("x-forwarded-for", "").split(",")[0].strip()
-        if forwarded:
-            ip = forwarded
-    import config
+    user = request.state.user
+    if user.role != "admin":
+        raise HTTPException(status_code=403, detail="Admin only")
+
+    ip = config.get_client_ip(request)
     if not config.is_lan_ip(ip):
         raise HTTPException(status_code=403, detail="Access denied")
     return {"token": OPENCLAW_GATEWAY_TOKEN}