Class ApiKeyAdapter

src/server/web/auth/apikey-auth.ts:24–135

 *                 prefixes that receive the admin role
 */
export class ApiKeyAdapter implements AuthAdapter {
  private readonly store: SessionStore;
  private readonly adminUsers: ReadonlySet<string>;

  constructor(store: SessionStore) {
    this.store = store;
    this.adminUsers = new Set(
      (process.env.ADMIN_USERS ?? "")
        .split(",")
        .map((s) => s.trim())
        .filter(Boolean),
    );
  }

  authenticate(req: IncomingMessage): AuthUser | null {
    const session = this.store.getFromRequest(req);
    if (!session || !session.encryptedApiKey) return null;

    const apiKey = this.store.decrypt(session.encryptedApiKey);
    if (!apiKey) return null;

    return {
      id: session.userId,
      email: session.email,
      name: session.name,
      isAdmin:
        session.isAdmin ||
        this.adminUsers.has(session.userId),
      apiKey,
    };
  }

  setupRoutes(app: Application): void {
    const loginHtml = this.loadLoginPage();

    // GET /auth/login — serve the API key login form
    app.get("/auth/login", (_req, res) => {
      res.setHeader("Content-Type", "text/html");
      res.send(loginHtml);
    });

    // POST /auth/login — validate key, create encrypted session
    app.post(
      "/auth/login",
      // express.urlencoded is registered in pty-server.ts before setupRoutes
      (req: Request, res: Response) => {
        const apiKey = (req.body as Record<string, string>)?.api_key?.trim() ?? "";

        if (!apiKey.startsWith("sk-ant-")) {
          res.setHeader("Content-Type", "text/html");
          res.status(400).send(
            loginHtml.replace(
              "<!--ERROR-->",
              `<p class="error">Invalid API key format. Keys must start with <code>sk-ant-</code>.</p>`,
            ),
          );
          return;
        }