Motivation

• The Logic Engine endpoints allowed any authenticated user to create, save, duplicate, import, delete, or run graphs that can contain high-impact node types (api_client, datapoint_write, python_script), enabling SSRF, device actuation, and DoS risks.
• The intent is to restrict state-changing and execution operations to admin users while retaining read access for normal users.

Description

• Updated obs/api/v1/logic.py to require get_admin_user instead of get_current_user for graph write/execute endpoints: POST /graphs, PUT /graphs/{id}, PATCH /graphs/{id}, DELETE /graphs/{id}, POST /graphs/import, POST /graphs/{id}/run, and POST /graphs/{id}/duplicate.
• Kept read-only endpoints (GET /node-types, GET /graphs, GET /graphs/{id}, GET /graphs/{id}/export) using get_current_user so authenticated users retain listing and viewing capabilities.
• Preserved existing behavior such as executor cache reload/invalidate and database interactions; no functional changes to execution or node handling were made.

Testing

• python -m py_compile obs/api/v1/logic.py completed successfully.
• pytest -q tests/integration/test_duplication.py could not be executed in this environment due to a missing test dependency (pytest_asyncio).

Codex Task