Function routes

libs/@local/graph/api/src/rest/admin.rs:95–130

Creates the admin API router. JWT and dev mode are mutually exclusive (enforced by the caller). - **JWT mode** (`Some`): Only `/health`, `/entities/delete`, and `/users/delete` are available. The token's `email` claim is resolved to a HASH user actor for provenance tracking. - **Dev mode** (`None`, requires `--unsafe-allow-dev-authentication`): All endpoints are available. The `X-Authenticated-U

(
    store_pool: PostgresStorePool,
    jwt_validator: Option<Arc<JwtValidator>>,
    external_services: ExternalServicesConfig,
)

///   destructive endpoints (`/snapshot`, `/accounts`, `/data-types`, `/property-types`,
///   `/entity-types`) are registered in this mode only.
pub fn routes(
    store_pool: PostgresStorePool,
    jwt_validator: Option<Arc<JwtValidator>>,
    external_services: ExternalServicesConfig,
) -> Router {
    let public = Router::new().route("/health", get(async || "Healthy"));

    let mut protected = Router::new()
        .route("/entities/delete", post(delete_entities))
        .route("/users/delete", post(delete_user));

    if let Some(validator) = jwt_validator {
        protected = protected.layer(Extension(validator));
    } else {
        protected = protected
            .route("/snapshot", post(restore_snapshot))
            .route("/accounts", delete(delete_accounts))
            .route("/data-types", delete(delete_data_types))
            .route("/property-types", delete(delete_property_types))
            .route("/entity-types", delete(delete_entity_types));
    }

    public
        .merge(protected)
        .fallback(|| async {
            status_to_response(Status::<()>::new(
                StatusCode::NotFound,
                Some("endpoint not found".to_owned()),
                vec![],
            ))
        })
        .layer(http_tracing_layer::HttpTracingLayer)
        .layer(Extension(Arc::new(store_pool)))
        .layer(Extension(Arc::new(external_services)))
        .layer(Extension(Arc::new(reqwest::Client::new())))
}

#[derive(Debug, derive_more::Display, derive_more::Error)]
enum AdminActorError {