Function validateApiKey

cli/src/hooks/use-auth-query.ts:64–114

({
  apiKey,
  getUserInfoFromApiKey = defaultGetUserInfoFromApiKey,
  logger = defaultLogger,
}: ValidateAuthParams)

 * Previously this was not exported, making it impossible to test in isolation
 */
export async function validateApiKey({
  apiKey,
  getUserInfoFromApiKey = defaultGetUserInfoFromApiKey,
  logger = defaultLogger,
}: ValidateAuthParams): Promise<ValidatedUserInfo> {
  const requestedFields = ['id', 'email'] as const

  try {
    const authResult = await getUserInfoFromApiKey({
      apiKey,
      fields: requestedFields,
      logger,
    })

    if (!authResult) {
      logger.error('❌ API key validation failed - invalid credentials')
      throw createAuthError('Invalid API key')
    }

    return authResult
  } catch (error) {
    const statusCode = getErrorStatusCode(error)

    if (isAuthenticationError(error)) {
      logger.error('❌ API key validation failed - authentication error')
      // Rethrow the original error to preserve statusCode for higher layers
      throw error
    }

    if (statusCode !== undefined && isRetryableStatusCode(statusCode)) {
      logger.error(
        {
          error: error instanceof Error ? error.message : String(error),
          statusCode,
        },
        '❌ API key validation failed - network error',
      )
      // Rethrow the original error to preserve statusCode for higher layers
      throw error
    }

    // Unknown error - wrap with statusCode for consistency
    logger.error(
      {
        error: error instanceof Error ? error.message : String(error),
      },
      '❌ API key validation failed - unknown error',
    )
    throw createServerError('Authentication failed')
  }
}

export interface UseAuthQueryDeps {
  getUserCredentials?: () => User | null