Function getAPIKey

apps/api/src/core/functions/database/getAPIKey.ts:46–98

(
  id: string,
  pb: PBService<{ entries: any }>,
  callerModule?: { source: 'app' | 'core'; id: string }
)

async function getAPIKey(
  id: string,
  pb: PBService<{ entries: any }>,
  callerModule?: { source: 'app' | 'core'; id: string }
): Promise<string> {
  try {
    if (!callerModule) {
      throw new Error(
        'Unable to determine caller module for API key validation.'
      )
    }

    const rawPb = pb.instance as unknown as {
      _apiKeyCache?: Map<string, { key: string; exposable: boolean }>
    }

    if (!rawPb._apiKeyCache) {
      rawPb._apiKeyCache = new Map()
    }

    const cached = rawPb._apiKeyCache.get(id)

    if (cached !== undefined) {
      if (!cached.exposable) {
        await validateCallerAccess(callerModule, id)
      }

      return cached.key
    }

    const record = await pb.instance
      .collection('api_keys__entries')
      .getFirstListItem(`keyId = "${id}"`)
      .catch(err => {
        throw new Error(`Failed to retrieve API key for ${id}: ${err.message}`)
      })

    if (!record.exposable) {
      await validateCallerAccess(callerModule, id)
    }

    try {
      logger.info(
        `API key for ${chalk.blue(id)} retrieved by ${chalk.blue(callerModule.source)}:${chalk.blue(callerModule.id)}`
      )

      const decrypted = decrypt2(record.key, process.env.MASTER_KEY!)
      rawPb._apiKeyCache.set(id, {
        key: decrypted,
        exposable: record.exposable
      })

      return decrypted
    } catch {
      throw new Error(`Failed to decrypt API key for ${id}.`)
    }
  } catch (err) {
    throw new Error(