chore: update admin apis

internal/server/server.go

@@ -284,13 +284,13 @@ func (s *Server) initAuth(cfg *config.Config, logger *zap.Logger) {
 	statsRepo := repository.NewStatsRepo(s.pg)
 	feedbackSvc := service.NewFeedbackService(feedbackRepo, mail, cfg.FeedbackAdminEmails, logger)
 	s.feedbackH = handler.NewFeedbackHandler(feedbackSvc)
-	s.statsH = handler.NewStatsHandler(statsRepo, feedbackRepo, feedbackSvc)
+	s.statsH = handler.NewStatsHandler(statsRepo, feedbackRepo)
 
 	// Admin panel — read-mostly listing + notify/reply/resolve actions.
 	// Reuses the notification service (delivery) and mailer (feedback reply).
 	// Gated by RequireAuth + RequireAdmin in the router.
 	adminRepo := repository.NewAdminRepo(s.pg)
-	adminSvc := service.NewAdminService(adminRepo, notifSvc, mail, logger, cfg.FrontendURL)
+	adminSvc := service.NewAdminService(adminRepo, notifSvc, feedbackSvc, mail, logger, cfg.FrontendURL)
 	s.adminH = handler.NewAdminHandler(adminSvc)
 }
 
@@ -441,12 +441,10 @@ func (s *Server) setupRouter() {
 	// Currently unauthenticated by product decision; gate here if that
 	// ever needs to change.
 	if s.statsH != nil {
+		// Read-only public snapshot. The feedback acknowledge/resolve actions
+		// moved to the admin panel (POST /api/v1/admin/feedback/{id}/...) — they
+		// must not be exposed on this unauthenticated page.
 		r.Get("/stats", s.statsH.Render)
-		// One-way per-row feedback actions — POST so a refresh of /stats
-		// can't replay them. Both live at the same public access level as
-		// /stats itself (gate them together if that ever changes).
-		r.Post("/stats/feedback/{id}/acknowledge", s.statsH.AcknowledgeFeedback)
-		r.Post("/stats/feedback/{id}/resolve", s.statsH.ResolveFeedback)
 	}
 
 	// API v1
@@ -1002,6 +1000,8 @@ func (s *Server) setupRouter() {
 			r.Get("/collections", s.adminH.ListCollections)
 			r.Get("/feedback", s.adminH.ListFeedback)
 			r.Post("/feedback/{id}/reply", s.adminH.ReplyFeedback)
+			r.Post("/feedback/{id}/acknowledge", s.adminH.AcknowledgeFeedback)
+			r.Post("/feedback/{id}/resolve", s.adminH.ResolveFeedback)
 			r.Get("/reports", s.adminH.ListReports)
 			r.Post("/reports/{type}/{id}/resolve", s.adminH.ResolveReport)
 		})