mfa fixing

internal/webui/logs.go

@@ -22,7 +22,16 @@ func (a *App) logs(w http.ResponseWriter, r *http.Request) {
 		setFlash(w, "error", "Error loading logs")
 	}
 	emailAllowed := func(e db.EmailLog) bool { return isGlobal || allowedNames[emailDomain(e.MailFrom)] }
-	authAllowed := func(au db.AuthLog) bool { return isGlobal || allowedNames[authLogDomain(au.Identifier)] }
+	// admin_login/admin_mfa entries are identified by admin username, not a mailbox
+	// email — there's no domain to attribute them to (a scoped admin's own username
+	// could otherwise coincidentally collide with a domain name they're allowed to
+	// see), so they're global-admin-only regardless of the identifier heuristic below.
+	authAllowed := func(au db.AuthLog) bool {
+		if au.AuthType == "admin_login" || au.AuthType == "admin_mfa" {
+			return isGlobal
+		}
+		return isGlobal || allowedNames[authLogDomain(au.Identifier)]
+	}
 
 	filterType := r.URL.Query().Get("type")
 	if filterType == "" {