Require authentication on all rag-analytics routes

cf/manifest.prod.yml

@@ -2,7 +2,15 @@
 applications:
 - name: srt-api-prod
   memory: 1024M
-  disk_quota: 2048M
+  # The image is ~3.3G, mostly the Python venv, so 2048M is not enough to
+
+  # unpack it. Pushing with a smaller quota than the running app fails with
+
+  # "uncompressed layer size exceeds quota" and crash-loops the app, which is
+
+  # how production went down on 2026-09-01. Keep this in step with reality.
+
+  disk_quota: 4096M
 #  health-check-type: process # don't re-enable....move to port 8080 if you have problems
   instances: 1
   env:

cf/manifest.staging.yml

@@ -2,7 +2,15 @@
 applications:
 - name: srt-api-staging
   memory: 1024M
-  disk_quota: 2048M
+  # The image is ~3.3G, mostly the Python venv, so 2048M is not enough to
+
+  # unpack it. Pushing with a smaller quota than the running app fails with
+
+  # "uncompressed layer size exceeds quota" and crash-loops the app, which is
+
+  # how production went down on 2026-09-01. Keep this in step with reality.
+
+  disk_quota: 4096M
 #  health-check-type: process # don't re-enable....move to port 8080 if you have problems
   instances: 1
   env:

server/app.js

@@ -361,30 +361,30 @@ module.exports = {
 
     // Advanced RAG Analytics Routes for Dashboarding
     const ragAnalyticsRoutes = ragAnalyticsRoutesFactory(pgPool)
-    app.get('/api/rag-analytics/tri-state', ragAnalyticsRoutes.getTriState)
-    app.get('/api/rag-analytics/posture', ragAnalyticsRoutes.getPosture)
-    app.get('/api/rag-analytics/ict-taxonomy', ragAnalyticsRoutes.getIctTaxonomy)
-    app.get('/api/rag-analytics/document-intelligence', ragAnalyticsRoutes.getDocumentIntelligence)
-    app.get('/api/rag-analytics/vector-violations', ragAnalyticsRoutes.getVectorViolations)
-    app.get('/api/rag-analytics/agency-leaderboard', ragAnalyticsRoutes.getAgencyLeaderboard)
-
-    app.get('/api/rag-analytics/playground/status', ragAnalyticsRoutes.getPlaygroundStatus)
-    app.get('/api/rag-analytics/adhoc-usage', ragAnalyticsRoutes.getAdhocUsage)
-    app.get('/api/rag-analytics/stages', ragAnalyticsRoutes.listStages)
-    app.post('/api/rag-analytics/stages', ragAnalyticsRoutes.saveStage)
-    app.delete('/api/rag-analytics/stages/:stageId', ragAnalyticsRoutes.deleteStage)
-    app.post('/api/rag-analytics/stages/generate-examples', ragAnalyticsRoutes.generateExamples)
-    app.get('/api/rag-analytics/pipelines', ragAnalyticsRoutes.listPipelines)
-    app.post('/api/rag-analytics/pipelines', ragAnalyticsRoutes.savePipeline)
-    app.delete('/api/rag-analytics/pipelines/:templateId', ragAnalyticsRoutes.deletePipeline)
-    app.get('/api/rag-analytics/playground/list-models', ragAnalyticsRoutes.listPlaygroundModels)
-    app.post('/api/rag-analytics/playground/test-completion', ragAnalyticsRoutes.testPlaygroundCompletion)
-    app.post('/api/rag-analytics/playground/test-embeddings', ragAnalyticsRoutes.testPlaygroundEmbeddings)
-    app.post('/api/rag-analytics/playground/package-synthesis', ragAnalyticsRoutes.packageSynthesis)
-    app.post('/api/rag-analytics/playground/execute-pipeline', ragAnalyticsRoutes.executePipeline)
-    app.post('/api/rag-analytics/playground/execute-stage', ragAnalyticsRoutes.executeStage)
-    app.post('/api/rag-analytics/playground/generate-prompt', ragAnalyticsRoutes.generatePrompt)
-    app.post('/api/rag-analytics/playground/analyze', ragAnalyticsRoutes.playgroundAnalyze)
+    app.get('/api/rag-analytics/tri-state', token(), admin_only(), ragAnalyticsRoutes.getTriState)
+    app.get('/api/rag-analytics/posture', token(), admin_only(), ragAnalyticsRoutes.getPosture)
+    app.get('/api/rag-analytics/ict-taxonomy', token(), admin_only(), ragAnalyticsRoutes.getIctTaxonomy)
+    app.get('/api/rag-analytics/document-intelligence', token(), admin_only(), ragAnalyticsRoutes.getDocumentIntelligence)
+    app.get('/api/rag-analytics/vector-violations', token(), admin_only(), ragAnalyticsRoutes.getVectorViolations)
+    app.get('/api/rag-analytics/agency-leaderboard', token(), admin_only(), ragAnalyticsRoutes.getAgencyLeaderboard)
+
+    app.get('/api/rag-analytics/playground/status', token(), admin_only(), ragAnalyticsRoutes.getPlaygroundStatus)
+    app.get('/api/rag-analytics/adhoc-usage', token(), admin_only(), ragAnalyticsRoutes.getAdhocUsage)
+    app.get('/api/rag-analytics/stages', token(), admin_only(), ragAnalyticsRoutes.listStages)
+    app.post('/api/rag-analytics/stages', token(), admin_only(), ragAnalyticsRoutes.saveStage)
+    app.delete('/api/rag-analytics/stages/:stageId', token(), admin_only(), ragAnalyticsRoutes.deleteStage)
+    app.post('/api/rag-analytics/stages/generate-examples', token(), admin_only(), ragAnalyticsRoutes.generateExamples)
+    app.get('/api/rag-analytics/pipelines', token(), admin_only(), ragAnalyticsRoutes.listPipelines)
+    app.post('/api/rag-analytics/pipelines', token(), admin_only(), ragAnalyticsRoutes.savePipeline)
+    app.delete('/api/rag-analytics/pipelines/:templateId', token(), admin_only(), ragAnalyticsRoutes.deletePipeline)
+    app.get('/api/rag-analytics/playground/list-models', token(), admin_only(), ragAnalyticsRoutes.listPlaygroundModels)
+    app.post('/api/rag-analytics/playground/test-completion', token(), admin_only(), ragAnalyticsRoutes.testPlaygroundCompletion)
+    app.post('/api/rag-analytics/playground/test-embeddings', token(), admin_only(), ragAnalyticsRoutes.testPlaygroundEmbeddings)
+    app.post('/api/rag-analytics/playground/package-synthesis', token(), ragAnalyticsRoutes.packageSynthesis)
+    app.post('/api/rag-analytics/playground/execute-pipeline', token(), admin_only(), ragAnalyticsRoutes.executePipeline)
+    app.post('/api/rag-analytics/playground/execute-stage', token(), admin_only(), ragAnalyticsRoutes.executeStage)
+    app.post('/api/rag-analytics/playground/generate-prompt', token(), admin_only(), ragAnalyticsRoutes.generatePrompt)
+    app.post('/api/rag-analytics/playground/analyze', token(), ragAnalyticsRoutes.playgroundAnalyze)
     app.post('/api/rag-analytics/art-lookup', token(), ragAnalyticsRoutes.artLookup)
 
     app.use(expressWinston.errorLogger({