(key)
| 1852 | } |
| 1853 | |
| 1854 | export function validateApiKey(key) { |
| 1855 | let effectiveKey = config.apiKey; |
| 1856 | if (_apiKeyResolver) { |
| 1857 | try { |
| 1858 | const v = _apiKeyResolver(); |
| 1859 | if (typeof v === 'string') effectiveKey = v; |
| 1860 | } catch { /* keep env fallback */ } |
| 1861 | } |
| 1862 | if (!effectiveKey) return isLocalBindHost(_bindHost); |
| 1863 | if (!key) return false; |
| 1864 | return safeEqualString(key, effectiveKey); |
| 1865 | } |
| 1866 | |
| 1867 | // ─── Brute-force lockout (v2.0.56, CLIProxyAPI-style) ───────────────── |
| 1868 | // Track failed dashboard auth attempts per client IP. After |
no test coverage detected