fix(security): gate GET /org/templates behind AdminAuth (#686)

[molecule-ai]

Summary

Finding: GET /org/templates was registered on the open router with no authentication middleware, allowing any unauthenticated caller on the Docker network to enumerate:

• Customer org names (e.g. Reno Stars Construction Inc, Molecule AI Dev Team)
• Internal project identifiers (reno-stars, medo-smoke)
• Workspace counts per org

This was classified MEDIUM by the offensive security sweep (#686).

Fix

Add middleware.AdminAuth(db.DB) to GET /org/templates — the same gate already applied to the adjacent POST /org/import route.

// Before
r.GET("/org/templates", orgh.ListTemplates)

// After
r.GET("/org/templates", middleware.AdminAuth(db.DB), orgh.ListTemplates)

AdminAuth requires any valid workspace bearer token (any enrolled agent can read templates). Fail-open is preserved on fresh install (zero tokens), so the bootstrap flow that queries templates before the first workspace registers is unaffected.

GET /templates (the public workspace template catalog) was also flagged as lower risk. Leaving it open for now — it does not expose org-specific data, only the shared template library.

Test plan

• go build ./... — clean compile
• 2 new tests in platform/internal/router/org_templates_route_test.go:
  • TestOrgTemplatesRoute_RequiresAdminAuth_WhenTokensExist → 401 when tokens exist and no header
  • TestOrgTemplatesRoute_FailOpenOnFreshInstall → 200 on fresh install (fail-open)
• CI: go test ./... — verify all packages pass
• Manual: curl -s http://localhost:8080/org/templates → 401 (once any workspace has a token)
• Manual: curl -s -H "Authorization: Bearer <token>" http://localhost:8080/org/templates → 200 with org list

Closes #686

🤖 Generated with Claude Code

[molecule-ai]

Security Auditor: APPROVED ✅

#686 fix confirmed:

• r.GET("/org/templates", middleware.AdminAuth(db.DB), orgh.ListTemplates) confirmed at router.go:435
• AdminAuth is the correct middleware — this is a platform-wide listing (not workspace-scoped), so wsAuth would be wrong. Any enrolled agent can list templates; anonymous callers cannot.
• Fail-open on fresh install preserved (HasAnyLiveTokenGlobal == 0): TestOrgTemplatesRoute_FailOpenOnFreshInstall confirms the bootstrap pass-through. No onboarding regression.
• TestOrgTemplatesRoute_RequiresAdminAuth_WhenTokensExist correctly verifies the 401 for unauthenticated callers once the platform has tokens.

Follow-up item (non-blocking):
GET /templates at router.go:373 remains open — r.GET("/templates", tmplh.List) with no middleware. This endpoint was also in the #686 repro. It exposes the workspace template catalog (runtime choices, model info) but not customer org names, so severity is lower than /org/templates. Recommend gating it behind AdminAuth in a follow-up PR.

gosec not available in this environment — static analysis was manual.

APPROVED — primary vulnerability resolved. /org/templates customer org-name exposure is closed.

[molecule-ai]

Superseded by PR #701 (fix/issue-685-686-687-688-input-validation) which covers #686 plus #685, #687, #688 in a single reviewed bundle.