Function apiKeyAuth

HF/api/middleware/auth.ts:25–52

(req: Request, res: Response, next: NextFunction)

}

export function apiKeyAuth(req: Request, res: Response, next: NextFunction): void {
  const validKeys = getValidKeys()

  // If no keys configured, allow all requests (local dev mode)
  if (!validKeys) {
    ;(req as any).apiKeyId = 'anonymous'
    next()
    return
  }

  const authHeader = req.headers.authorization
  if (!authHeader || !authHeader.startsWith('Bearer ')) {
    res.status(401).json({
      error: 'Missing or invalid Authorization header. Use: Bearer <your-api-key>',
    })
    return
  }

  const key = authHeader.slice(7).trim()
  if (!validKeys.has(key)) {
    res.status(403).json({ error: 'Invalid API key' })
    return
  }

  // Attach a key identifier for rate limiting (first 8 chars)
  ;(req as any).apiKeyId = key.slice(0, 8)
  next()
}