fix(server): harden self-hosted server — pgvector upgrade, admin auth, endpoint security (#5360)

server/routers/entities.py

@@ -2,11 +2,10 @@ from collections import defaultdict
 from datetime import datetime
 from typing import Any, Literal, Optional
 
+from auth import require_admin, verify_auth
+from errors import upstream_error
 from fastapi import APIRouter, Depends
 from pydantic import BaseModel
-
-from auth import verify_auth
-from errors import upstream_error
 from schemas import MessageResponse
 from server_state import get_memory_instance
 
@@ -69,7 +68,7 @@ def list_entities(_auth=Depends(verify_auth)):
 
 
 @router.delete("/{entity_type}/{entity_id}", response_model=MessageResponse)
-def delete_entity(entity_type: EntityType, entity_id: str, _auth=Depends(verify_auth)):
+def delete_entity(entity_type: EntityType, entity_id: str, _auth=Depends(require_admin)):
     try:
         get_memory_instance().delete_all(**{TYPE_TO_FIELD[entity_type]: entity_id})
     except Exception:

server/routers/requests.py

@@ -1,15 +1,14 @@
-from datetime import datetime
 import uuid
+from datetime import datetime
 
+from auth import require_admin
+from db import get_db
 from fastapi import APIRouter, Depends, Query
+from models import RequestLog
 from pydantic import BaseModel
 from sqlalchemy import select
 from sqlalchemy.orm import Session
 
-from auth import require_auth
-from db import get_db
-from models import RequestLog, User
-
 router = APIRouter(prefix="/requests", tags=["requests"])
 
 
@@ -30,7 +29,7 @@ API_KEY_AUTH_TYPES = ("api_key", "admin_api_key")
 
 @router.get("", response_model=list[RequestLogItem])
 def list_requests(
-    user: User = Depends(require_auth),
+    _auth=Depends(require_admin),
     db: Session = Depends(get_db),
     limit: int = Query(default=50, ge=1, le=200),
 ):