Auth-wrap POST /rest/v1/cre_csv_import (deprecate anonymous MyOpenCRE import)

[northdpole]

Context

RFC #876 adds authenticated MyOpenCRE upload at POST /rest/v2/myopencre/upload. Today, POST /rest/v1/cre_csv_import is public (no auth) and writes directly into the shared graph via myopencre_parser — intended for local/self-hosted use.

Maintainer decision: cre_csv_import must be auth-wrapped for online deployment. Anonymous CSV import into the shared CRE graph is not acceptable on opencre.org.

Requirements

• Add @login_required (or equivalent post-RFC TODO 1 session check) to POST /rest/v1/cre_csv_import
• Return 401/302 for anonymous requests (consistent with auth route migration — see auth /rest/v1/auth/* issue)
• Document that v1 import remains for authenticated admin/contributor use; per-user mapping flow is /rest/v2/myopencre/upload (RFC TODO 4)
• Frontend MyOpenCRE page: if using v1 import path today, switch to v2 upload when available or require login for v1
• Consider gating behind CRE_ALLOW_IMPORT and/or capabilities.myopencre in addition to login
• Update tests in web_main_test.py / MyOpenCRE frontend tests

Migration notes

• Local dev with NO_LOGIN=1 should continue to work for contributor workflows
• GET /rest/v1/cre_csv template download may stay public (read-only) — confirm during implementation

Related

• docs/rfc/user-auth-myopencre.md
• Add support for users #586
• application/web/web_main.py import_from_cre_csv

[skypank-coder]

@northdpole I'd like to take this too — it pairs naturally with #963, since the auth-wrapping here should use the same TODO 1 session check I'll be adding in that migration. I'll sequence it right after (or alongside) #963 so the 401/302 behavior is consistent between them.
One thing I'll confirm during implementation per your note: keeping GET /rest/v1/cre_csv (template download) public since it's read-only, and preserving NO_LOGIN=1 for local dev. I'll gate the import behind login plus the existing CRE_ALLOW_IMPORT / capabilities.myopencre flags, and cover both anonymous-rejected and authenticated-allowed cases in the tests.

[northdpole]

Thanks for volunteering on this — assigning to you.

We'll land #963 (session check) first; once that's in, this one is a natural follow-up. Your plan looks good to me: keep the GET template public, use NO_LOGIN=1 for local dev, and gate the import behind login plus CRE_ALLOW_IMPORT / capabilities.myopencre.

Looking forward to the PR!