fix(manager): format RBAC subject from integer user id

[anxkhn]

The RBAC middleware built the Casbin enforcement subject with fmt.Sprint on
the id read from the JWT claims. Because JWT claims are JSON, the id decodes as
a float64, and fmt.Sprint renders any float64 value >= 1000000 in
scientific notation (for example 1.234567e+06).

The grouping policies are written from the integer user id (a uint), so the
scientific-notation subject never matched any policy and Enforce returned
false. Every request from a user whose id is >= 1000000 was rejected with
HTTP 401 on every manager API endpoint.

This converts the id back to uint before formatting, matching how the audit
middleware already reads the same "id" claim (manager/middlewares/audit.go
uses uint(id)), so the request subject equals the policy subject across the
full id range.

A regression test drives the real RBAC handler through httptest with ids
around the scientific-notation boundary (1, 999999, 1000000, 1234567,
4294967295). Before the fix the ids >= 1000000 return 401; after the fix all
pass.

Related Issue

Fixes #<ISSUE_NUMBER>

Motivation and Context

RBAC uses the Casbin grouping matcher g(r.sub, p.sub), so the request
subject string must equal the policy subject byte-for-byte. Policies are always
stored from the integer id (fmt.Sprint(user.ID) where User.ID is uint),
while the request subject was formatted from the float64 claim. The two
strings diverge for every id >= 1000000, which silently locks those accounts out
of the whole manager API. This is a fail-closed authorization defect that only
shows up once ids grow past one million, so it is easy to miss until a large
deployment hits it.

Screenshots (if appropriate)

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation Update (if none of the other choices apply)

Checklist

• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes.

[codecov]

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 28.11%. Comparing base (530a1d2) to head (8efcee6).

Files with missing lines	Patch %	Lines
manager/middlewares/rbac.go	0.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4877      +/-   ##
==========================================
+ Coverage   28.09%   28.11%   +0.02%     
==========================================
  Files         232      232              
  Lines       23186    23186              
==========================================
+ Hits         6513     6519       +6     
+ Misses      16224    16214      -10     
- Partials      449      453       +4     

Flag	Coverage Δ
unittests	28.11% <0.00%> (+0.02%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
manager/middlewares/rbac.go	18.75% <0.00%> (+18.75%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[gaius-qi]

LGTM

[Copilot]

Pull request overview

Fixes Manager RBAC authorization failures for large user IDs by ensuring the Casbin enforcement subject is formatted from an integer ID (matching how grouping policies are stored), and adds a regression test intended to cover IDs around the scientific-notation formatting boundary.

Changes:

• Update RBAC middleware to convert the JWT claim "id" (decoded as float64) back to uint before formatting/enforcement.
• Add an httptest-driven regression test for RBAC behavior across a range of user IDs, including values >= 1,000,000.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
manager/middlewares/rbac.go	Formats RBAC subject using an integer-cast user ID to avoid scientific notation mismatches in Casbin subject matching.
manager/middlewares/rbac_test.go	Adds a regression test intended to validate RBAC decisions across IDs near/above the formatting boundary.

[gaius-qi]

LGTM