Function apiKeyAuth

api/middleware/auth.ts:55–94

(req: Request, res: Response, next: NextFunction)

}

export function apiKeyAuth(req: Request, res: Response, next: NextFunction): void {
  const validKeys = getValidKeys()

  // If no keys configured, allow all requests (local dev mode)
  if (!validKeys) {
    req.apiKeyId = 'anonymous'
    const tier = resolveTier(null)
    req.tier = tier
    req.tierConfig = getTierConfig(tier)
    next()
    return
  }

  const authHeader = req.headers.authorization
  if (!authHeader || !authHeader.startsWith('Bearer ')) {
    res.status(401).json({
      error: 'Missing or invalid Authorization header. Use: Bearer <your-api-key>',
    })
    return
  }

  const key = authHeader.slice(7).trim()

  // C-1: Constant-time comparison to prevent timing attacks
  const match = validKeys.some(valid => safeEqual(key, valid))
  if (!match) {
    res.status(403).json({ error: 'Invalid API key' })
    return
  }

  // H-2: Hash the full key for rate-limit bucketing (never expose raw key material)
  req.apiKeyId = hashKey(key)

  // T-1: Resolve tier from raw key
  const tier = resolveTier(key)
  req.tier = tier
  req.tierConfig = getTierConfig(tier)

  next()
}