Method setupRoutes

src/server/web/auth/apikey-auth.ts:56–107

(app: Application)

  }

  setupRoutes(app: Application): void {
    const loginHtml = this.loadLoginPage();

    // GET /auth/login — serve the API key login form
    app.get("/auth/login", (_req, res) => {
      res.setHeader("Content-Type", "text/html");
      res.send(loginHtml);
    });

    // POST /auth/login — validate key, create encrypted session
    app.post(
      "/auth/login",
      // express.urlencoded is registered in pty-server.ts before setupRoutes
      (req: Request, res: Response) => {
        const apiKey = (req.body as Record<string, string>)?.api_key?.trim() ?? "";

        if (!apiKey.startsWith("sk-ant-")) {
          res.setHeader("Content-Type", "text/html");
          res.status(400).send(
            loginHtml.replace(
              "<!--ERROR-->",
              `<p class="error">Invalid API key format. Keys must start with <code>sk-ant-</code>.</p>`,
            ),
          );
          return;
        }

        const userId = deriveUserId(apiKey);
        const isAdmin = this.adminUsers.has(userId);
        const encryptedApiKey = this.store.encrypt(apiKey);

        const sessionId = this.store.create({
          userId,
          isAdmin,
          encryptedApiKey,
        });

        this.store.setCookie(res as unknown as import("http").ServerResponse, sessionId);

        const next = (req.query as Record<string, string>)?.next;
        res.redirect(next && next.startsWith("/") ? next : "/");
      },
    );

    // POST /auth/logout — destroy session
    app.post("/auth/logout", (req, res) => {
      const id = this.store.getIdFromRequest(req as unknown as IncomingMessage);
      if (id) this.store.delete(id);
      this.store.clearCookie(res as unknown as import("http").ServerResponse);
      res.redirect("/auth/login");
    });
  }

  requireAuth(req: Request, res: Response, next: NextFunction): void {
    const user = this.authenticate(req as unknown as IncomingMessage);