Document and verify authentication for the indexer admin analytics endpoints

[priscaenoch]

Problem

The frontend's rate-limit dashboard sends Authorization: Bearer <admin token> to /api/admin/analytics/rate-limit-hits, /api/admin/analytics/top-users, /api/admin/analytics/violation-heatmap, and /api/admin/analytics/upgrade-recommendations. The indexer has admin/, auth/, and rateLimit/ modules, but there is no documentation of how the admin token is issued, what it authorises, whether it expires, or how it is rotated.

Admin analytics expose usage and user data, so the auth model for these routes needs to be explicit and verified rather than implied by client code.

What needs to be done

• Document the admin auth scheme: how the token is configured/issued, its scope, expiry, and rotation.
• Verify every /api/admin/* route enforces the check (no route should be reachable unauthenticated).
• Return a clear 401 for missing/invalid tokens and 403 where appropriate, so the client can react correctly.
• Ensure tokens are never logged.
• Add tests covering unauthenticated and invalid-token access for each admin route.

Files

• indexer/src/admin/, indexer/src/auth/
• README.md / docs/

Acceptance deliverables

• Documented admin auth scheme.
• Every admin route rejects unauthenticated and invalid-token requests with the correct status.

Tests to pass

• Tests asserting 401 for missing and invalid tokens on each /api/admin/* route.
• A test asserting a valid token succeeds.

[AnnieIj]

Hi! I'd love to work on this issue.

I plan to document and verify the authentication flow for the indexer admin analytics endpoints by reviewing the current implementation, validating the authentication and authorization requirements, updating the API documentation with clear usage examples, and ensuring the documented behavior matches the actual implementation. I'll also add or update tests where necessary to help prevent future regressions. Could you please assign this issue to me?

[samuel2926i39-art]

complete the task as fast as possible, i wont engage in anything that would waste time. do maximum workflow-only and create the PR. kindly assign

[grantfox-oss]

🦊 GrantFox — @samuel2926i39-art has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #22)
2. Your PR will be reviewed by the octraban maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign | FWC26 campaign!

@samuel2926i39-art's PR #35 was approved and merged by @priscaenoch.

🏆 @samuel2926i39-art: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (118 total points). Track your full progress on GrantFox.

👏 Great work, @samuel2926i39-art! Keep contributing to octraban.