Restrict observability endpoints to ops admins

web/services/system_api.py

@@ -19,7 +19,8 @@ def get_health_payload() -> Dict[str, Any]:
     return build_health_payload()
 
 
-async def get_system_status_payload() -> Dict[str, Any]:
+async def get_system_status_payload(request: Request) -> Dict[str, Any]:
+    legacy_routes._require_ops_admin(request)
     payload = await run_in_threadpool(build_system_status_payload)
     payload["realtime"] = await run_in_threadpool(_realtime_status_payload)
     return payload
@@ -52,7 +53,7 @@ def _realtime_status_payload() -> Dict[str, Any]:
 
 
 def get_system_cache_status(request: Request, cities: Optional[str] = None) -> Dict[str, Any]:
-    legacy_routes._assert_entitlement(request)
+    legacy_routes._require_ops_admin(request)
     selected = legacy_routes._normalize_city_list(cities)
     if not selected:
         selected = legacy_routes._normalize_city_list(None)
@@ -118,7 +119,8 @@ def run_system_priority_warm(
     }
 
 
-def get_prometheus_metrics_response() -> PlainTextResponse:
+def get_prometheus_metrics_response(request: Request) -> PlainTextResponse:
+    legacy_routes._require_ops_admin(request)
     return PlainTextResponse(
         export_prometheus_metrics(),
         media_type="text/plain; version=0.0.4; charset=utf-8",