ITHC: protect administrative representation unlock endpoint

docs/administrative-authentication.md

@@ -70,16 +70,14 @@ independent administrative-session authorization. A later authorised stage
 must enforce the administrative session on privileged API routes and account
 for both browser calls and the existing server-side bootstrap callers.
 
-Storage download, representation editing, and queue actions retain their
-existing authorization behaviour. The other administrative API and storage
-limitations described in this section remain open.
+Storage download and queue actions retain their existing authorization
+behaviour. The other administrative API and storage limitations described in
+this section remain open.
 
 Directly observed storage routes include:
 
 - `/api/file/getrepsblobproxy`, which forwards a caller-supplied container using
   server relay credentials and path signing.
-- `/api/file/editRepJson`, which performs a direct blob mutation and has no
-  visible administrative-session or HMAC check.
 - `/api/file/downloadblob` and `/api/file/createrepcompletemessage_api`, which
   enforce existing path-HMAC checks but not administrative authorization.
 
@@ -97,6 +95,12 @@ the administrative session and requires a trusted same-origin request. It also
 validates the requested container, case-folder segment, and representation-file
 segment before performing deletion.
 
+Administrative representation JSON unlocking uses the dedicated
+`POST /api/admin/editRepJson` route. That endpoint independently validates the
+administrative session, requires a trusted same-origin request, and validates
+the requested container and blob path before removing `repComplete`. The former
+`/api/file/editRepJson` route is retired and no longer performs storage access.
+
 Administrative case deletion was not investigated or remediated as part of
 Stage 3 and remains a separate, unverified security boundary. The other
 administrative API and storage limitations documented above also remain open.