POST /api/agents/agent/uninstall (and its host alias) is a collector's
self-removal: a token holding agent:report removes the agent that token
owns. For any caller that is not a token, the handler instead takes the
administrative removal path and deletes any host agent by ID. The route
was only RequireAuth plus RequireScope(agent:report), and browser
sessions bypass token scopes, so a non-admin SSO, proxy or organization
member session could remove any agent, while the equivalent unlink and
delete routes require an admin.
The route now uses RequireAdmin like its neighbours. Token callers are
unchanged: RequireAdmin admits them and the agent:report scope check
still applies, so collector and install.ps1 self-uninstall keep working.
The existing non-admin proxy test gains the two uninstall routes, and a
new test keeps the token path reachable and the scope check in place.
Contract-Neutral: Behavioural fix that gives the administrative removal path the admin gate its sibling routes have; no new API surface or contract.
rcourtman