webadmin user unauthorized problem about caddy-security HOT 8 CLOSED

{
	order authenticate before respond
	order authorize before basicauth

	security {
		local identity store localdb {
		realm local
		path {$HOME}/.local/caddy/users.json
		user webadmin {
                name webadmin
                email [email protected]
                password "Admin@123" overwrite
                roles authp/admin authp/user
			}
		}

		authentication portal myportal {
			# crypto default token lifetime 3600
			crypto key sign-verify {env.JWT_SHARED_KEY}
			enable identity store localdb
			cookie domain "http://10.20.1.19"
			cookie insecure on
			ui {
				links {
					"My Website" "http://10.20.1.19/app" icon "las la-star"
					"Guests" "http://10.20.1.19/guests" icon "las la-star"
					"Users" "http://10.20.1.19/users" icon "las la-star"
					"Admins" "http://10.20.1.19/admins" icon "las la-star"
					"My Identity" "/auth/whoami" icon "las la-user"
				}
				# password_recovery_enabled yes
			}
			transform user {
				match origin local
				action add role authp/user
				ui link "Portal Settings" /settings icon "las la-cog"
			}
		}

		authorization policy guests_policy {
			set token sources cookie
			validate bearer header
			# disable auth redirect
			set auth url "http://10.20.1.19/auth"
			allow roles authp/admin authp/user
			crypto key verify {env.JWT_SHARED_KEY}
			acl rule {
				comment allow guests only
				match role guest authp/guest
				allow stop log info
			}
			acl rule {
				comment default deny
				match any
				deny log warn
			}
		}

		authorization policy users_policy {
			set token sources cookie
			validate bearer header
			set auth url "http://10.20.1.19/auth"
			allow roles authp/admin authp/user
			crypto key verify {env.JWT_SHARED_KEY}
			acl rule {
				comment allow users
				match role authp/user
				allow stop log info
			}
			acl rule {
				comment default deny
				match any
				deny log warn
			}
		}

		authorization policy admins_policy {
			set token sources cookie
			validate bearer header
			set auth url "http://10.20.1.19/auth"
			allow roles authp/admin authp/user
			crypto key verify {env.JWT_SHARED_KEY}
			acl rule {
				comment allow users
				match role authp/user
				allow stop log info
			}
			acl rule {
				comment default deny
				match any
				deny log warn
			}
		}
	}
}


"http://10.20.1.19" {
	route /auth* {
		authenticate with myportal
	}

	route /app* {
		authorize with users_policy
		reverse_proxy 127.0.0.1:3000
	}

	route {
        redir http://{hostport}/auth 302
	}
}

route /app/* {
		authorize with users_policy
		reverse_proxy 127.0.0.1:3000
	}

	route /app* {
		authorize with users_policy
		uri strip_prefix /app
		reverse_proxy 127.0.0.1:3000
	}