feat(auth): enforce capability scope on vector insert + search

src/handlers/vectors.cpp

@@ -7,10 +7,10 @@
 namespace svapi {
 namespace {
 CollectionMeta requireVectorCollection(ServerDeps* d, const httplib::Request& req,
-                                        std::string& projectOut, std::string& nameOut) {
+                                        std::string& projectOut, std::string& nameOut, KeyOp op) {
     ApiKey k = requireKey(*d, req);
     projectOut = req.matches[1]; nameOut = req.matches[2];
-    requireProjectAccess(k, projectOut);
+    requireCapability(*d, k, req, projectOut, nameOut, op);
     auto m = d->registry.get(projectOut, nameOut);
     if (!m) throw ApiError(ErrCode::NotFound, "not_found", "no such collection");
     if (m->kind != "vector") throw ApiError(ErrCode::Unprocessable, "not_vector", "collection is not a vector collection");
@@ -59,7 +59,7 @@ void registerVectorRoutes(ApiServer& s) {
     auto& svr = s.raw(); ServerDeps* d = &s.deps();
 
     svr.Post(R"(/api/v1/projects/([^/]+)/collections/([^/]+)/vectors)", [d](const httplib::Request& req, httplib::Response& res) {
-        std::string project, name; CollectionMeta meta = requireVectorCollection(d, req, project, name);
+        std::string project, name; CollectionMeta meta = requireVectorCollection(d, req, project, name, KeyOp::Insert);
         auto body = bodyJson(req);
         std::vector<float> vec = resolveVector(d, meta, body, "vector", "text", wantsNoStore(req));
         nlohmann::json doc = body.value("metadata", nlohmann::json::object());
@@ -72,7 +72,7 @@ void registerVectorRoutes(ApiServer& s) {
     });
 
     svr.Post(R"(/api/v1/projects/([^/]+)/collections/([^/]+)/search)", [d](const httplib::Request& req, httplib::Response& res) {
-        std::string project, name; CollectionMeta meta = requireVectorCollection(d, req, project, name);
+        std::string project, name; CollectionMeta meta = requireVectorCollection(d, req, project, name, KeyOp::Search);
         auto body = bodyJson(req);
         std::vector<float> q = resolveVector(d, meta, body, "query_vector", "query_text", wantsNoStore(req));
         uint32_t topK = body.value("top_k", 5u);