feat(server): admin-gate GET /requests

server/routers/requests.py

@@ -6,9 +6,9 @@ from pydantic import BaseModel
 from sqlalchemy import select
 from sqlalchemy.orm import Session
 
-from auth import require_auth
+from auth import require_admin
 from db import get_db
-from models import RequestLog, User
+from models import RequestLog
 
 router = APIRouter(prefix="/requests", tags=["requests"])
 
@@ -30,7 +30,7 @@ API_KEY_AUTH_TYPES = ("api_key", "admin_api_key")
 
 @router.get("", response_model=list[RequestLogItem])
 def list_requests(
-    user: User = Depends(require_auth),
+    _admin=Depends(require_admin),
     db: Session = Depends(get_db),
     limit: int = Query(default=50, ge=1, le=200),
 ):

server/tests/test_admin_gating.py

@@ -157,3 +157,31 @@ def test_delete_entity_member_forbidden(client, auth_member_header):
 def test_delete_entity_no_auth_unauthorized(client):
     response = client.delete("/entities/user/alice")
     assert response.status_code == 401
+
+
+# --- GET /requests ---
+
+
+def test_get_requests_admin_jwt(client, auth_admin_header):
+    response = client.get("/requests", headers=auth_admin_header)
+    assert response.status_code == 200
+
+
+def test_get_requests_admin_api_key(client, admin_api_key_env):
+    response = client.get("/requests", headers=admin_api_key_env)
+    assert response.status_code == 200
+
+
+def test_get_requests_auth_disabled(client, auth_disabled_env):
+    response = client.get("/requests")
+    assert response.status_code == 200
+
+
+def test_get_requests_member_forbidden(client, auth_member_header):
+    response = client.get("/requests", headers=auth_member_header)
+    assert response.status_code == 403
+
+
+def test_get_requests_no_auth_unauthorized(client):
+    response = client.get("/requests")
+    assert response.status_code == 401