fix: require admin auth for memory clear

[saim256]

Summary

• add default-deny admin authentication for the destructive memory clear endpoint
• accept X-Admin-Key or X-API-Key when it matches MEMORY_ADMIN_KEY
• cover missing, wrong, unconfigured, and valid admin-key behavior in the memory route tests

Fixes #4880

/claim #4880

Wallet: RTC253255d034065a839cd421811ec589ae5b694ffc

Validation

• python -m pytest bounties\issue-2285\tests\test_memory_routes.py -q -> 32 passed
• python -m py_compile bounties\issue-2285\src\memory_routes.py bounties\issue-2285\tests\test_memory_routes.py -> passed
• git diff --check -> passed
• python tools\bcos_spdx_check.py --base-ref origin/main -> OK

[lavishsaluja]

Approved current head e9587fa62fe7ba05f0757500c73f661ad98242e4.

This is the focused fix for #4880. Unlike the earlier copied-subtree attempts, this patches the live bounties/issue-2285/src/memory_routes.py module named in the issue. DELETE /api/memory/clear now fails closed when MEMORY_ADMIN_KEY is unset and requires a matching X-Admin-Key or X-API-Key before calling engine.store.clear_agent_memory(agent_id). The updated route tests cover valid admin access, missing/wrong keys, and the unconfigured-key fail-closed path.

Validation performed locally:

• python -m pytest bounties/issue-2285/tests/test_memory_routes.py -q -> 32 passed, 13 subtests passed
• python -m py_compile bounties/issue-2285/src/memory_routes.py bounties/issue-2285/tests/test_memory_routes.py -> passed
• git diff --check origin/main...codex-review-pr-4883 -> passed
• python tools/bcos_spdx_check.py --base-ref origin/main -> OK

No blocking findings in this diff.

[508704820]

Code Review: Require admin auth for memory clear

Summary

Adds _require_admin() check to DELETE /api/memory/clear endpoint, same vulnerability as #4880 (which I reported).

Positive ✅

1. Same correct fix pattern — MEMORY_ADMIN_KEY env var, hmac.compare_digest
2. Default-deny: no key = 401
3. Supports both X-Admin-Key and X-API-Key headers
4. Proper return type annotation: Optional[tuple]

Note

I also submitted PR #4882 for the same issue (bug #4880). Both PRs implement the same fix. This PR (#4883) is essentially identical in approach. Either one works — recommend merging whichever was first or has better test coverage.

LGTM ✅ Same fix as #4882.

[saim256]

Clarification: PR #4883 patches the live file named in #4880: bounties/issue-2285/src/memory_routes.py.

The earlier PR #4882 at head 0eeb329e... adds rips/rustchain-core/bounties/issue-2285/src/memory_routes.py and leaves the live module unchanged, so the deployed/imported /api/memory/clear route is only fixed by this PR unless #4882 changes paths.

[jaxint]

Great contribution! LGTM.

[jaxint]

Great contribution! LGTM.

[loganoe]

Approved. This applies the default-deny admin-key check to the correct bounties/issue-2285/src/memory_routes.py clear endpoint, accepts X-Admin-Key/X-API-Key, and preserves existing memory behavior for authorized callers.

Validation performed:

• git diff --check origin/main...HEAD
• python3 -m py_compile bounties/issue-2285/src/memory_routes.py bounties/issue-2285/tests/test_memory_routes.py
• PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 /tmp/rustchain-flask-venv/bin/python -m pytest -q bounties/issue-2285/tests/test_memory_routes.py -> 32 passed, 13 subtests passed

[508704820]

Code Review: Require Admin Auth for Memory Clear

Summary

Adds _require_admin() to memory API /clear endpoint with default-deny pattern: when MEMORY_ADMIN_KEY is not configured, returns 401.

What Works Well

1. Default-deny: Correct security posture
2. hmac.compare_digest: Constant-time comparison
3. Consistent with #4882: Same correct pattern

Verdict: Approve

Correct implementation following the default-deny pattern established in #4882.