fix: system admin is always a tag owner

internal/domain/acl.go

@@ -59,10 +59,10 @@ func (a ACLPolicy) CheckTagOwners(tags []string, p *User) error {
 }
 
 func (a ACLPolicy) IsTagOwner(tag string, p *User) bool {
+	if p.UserType == UserTypeService {
+		return true
+	}
 	if tagOwners, ok := a.TagOwners[tag]; ok {
-		if p.UserType == UserTypeService {
-			return true
-		}
 		return a.validateTagOwners(tagOwners, p)
 	}
 	return false

internal/domain/acl_test.go

@@ -28,6 +28,13 @@ func TestACLPolicy_IsTagOwner(t *testing.T) {
 			userType:  UserTypeService,
 			expectErr: false,
 		},
+		{
+			name:      "system admin is always a valid owner",
+			tag:       "tag:unknown",
+			userName:  "system admin",
+			userType:  UserTypeService,
+			expectErr: false,
+		},
 		{
 			name:      "direct tag owner",
 			tag:       "tag:web",