Allow Bearer on Admin OIE REST and fix staging filing lookup.

Staging monitors need API-key access to /admin/oie and related ops routes; also resolve CRE links by uuid or external_id and align ingest test asserts with skip_c1/max_repos=0.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: northdpole

application/tests/admin_panel_test.py

@@ -720,6 +720,7 @@ def test_oie_start_defaults_to_live_sync(self) -> None:
                     max_repos=service.DEFAULT_OIE_MAX_REPOS,
                     skip_b=False,
                     skip_c=False,
+                    skip_c1=False,
                 )
                 pipe = c.get("/admin/pipeline").get_json()
                 stages = {e["stage"] for e in pipe["events"]}
@@ -743,14 +744,24 @@ def test_oie_start_defaults_to_live_sync(self) -> None:
                     max_repos=2,
                     skip_b=False,
                     skip_c=False,
+                    skip_c1=False,
                 )
 
                 r = c.post(
                     "/admin/ingest/start",
                     json={"target_id": "repo1", "max_repos": 0},
                 )
-                self.assertEqual(r.status_code, 400)
-                self.assertIn("max_repos", (r.get_json() or {}).get("description", ""))
+                self.assertEqual(r.status_code, 200, r.data)
+                mock_oie.assert_called_with(
+                    r.get_json()["run_id"],
+                    repos_yaml=str(service.REPOS_YAML),
+                    dry_run=False,
+                    sync_repos=True,
+                    max_repos=0,
+                    skip_b=False,
+                    skip_c=False,
+                    skip_c1=False,
+                )
 
             with self.app.test_client() as c:
                 c.post(
@@ -1600,6 +1611,7 @@ def test_built_in_agent_is_a_resource_not_a_crud_row(self) -> None:
                     max_repos=service.DEFAULT_OIE_MAX_REPOS,
                     skip_b=False,
                     skip_c=False,
+                    skip_c1=False,
                 )
 
     @patch.dict(os.environ, {"NO_LOGIN": "1", "CRE_ALLOW_IMPORT": "1"})

application/tests/api_tokens_test.py

@@ -206,8 +206,8 @@ def test_bad_signature_rejected(self) -> None:
             )
             self.assertEqual(resp.status_code, 401)
 
-    def test_admin_get_rejects_bearer(self) -> None:
-        """Admin surfaces require Google session — API keys are denied."""
+    def test_admin_oie_allows_bearer(self) -> None:
+        """OIE Admin REST allows API keys for machine ops."""
         minted = mint.mint_api_token(
             user=self.admin,
             name="admin-read",
@@ -219,4 +219,4 @@ def test_admin_get_rejects_bearer(self) -> None:
                     "/admin/oie/rq/status",
                     headers={"Authorization": f"Bearer {minted.token}"},
                 )
-                self.assertIn(resp.status_code, (401, 302), resp.data)
+                self.assertEqual(resp.status_code, 200, resp.data)

application/utils/api_tokens/verify.py

@@ -36,9 +36,21 @@ def extract_raw_token() -> Optional[str]:
 def api_key_allowed_for_request() -> bool:
     """True when this request may authenticate via API key.
 
-    Admin HTML/API surfaces require a Google session (not a bearer token).
+    OIE/agent Admin REST allows Bearer for machine ops; other /admin HTML
+    surfaces still require a Google session.
     """
     path = request.path or ""
+    ops_prefixes = (
+        "/admin/oie/",
+        "/admin/ingest",
+        "/admin/agent/",
+        "/admin/config",
+        "/admin/pipeline",
+        "/admin/dashboard",
+        "/admin/upstream-sync",
+    )
+    if path == "/admin/config" or any(path.startswith(p) for p in ops_prefixes):
+        return True
     if path.startswith("/admin/") or path.startswith("/rest/v1/admin/"):
         return False
     if path.startswith("/rest/v1/api-keys"):

application/utils/oie_scheduler/graph_filer.py

@@ -166,8 +166,13 @@ def file_linked_decisions(
 
         db_cres = []
         for link in sure:
+            # Librarian proposals store CRE primary key (uuid); also accept
+            # human-facing external_id (e.g. "123-456") for hand-authored rows.
             db_cre = (
-                session.query(db.CRE).filter(db.CRE.external_id == link.cre_id).first()
+                session.query(db.CRE).filter(db.CRE.id == link.cre_id).first()
+                or session.query(db.CRE)
+                .filter(db.CRE.external_id == link.cre_id)
+                .first()
             )
             if db_cre is None:
                 result.unknown_cre += 1