Function getVerifiedApiObject

packages/web/src/middleware/withAuth.ts:236–265

(apiKeyString: string)

 * Supports both the current prefix (sbk_) and the legacy prefix (sourcebot-).
 */
export const getVerifiedApiObject = async (apiKeyString: string): Promise<ApiKey | undefined> => {
    let secret: string;

    if (apiKeyString.startsWith(API_KEY_PREFIX)) {
        secret = apiKeyString.slice(API_KEY_PREFIX.length);
        if (!secret) {
            return undefined;
        }
    } else if (apiKeyString.startsWith(LEGACY_API_KEY_PREFIX)) {
        secret = apiKeyString.slice(LEGACY_API_KEY_PREFIX.length);
        if (!secret) {
            return undefined;
        }
    } else {
        return undefined;
    }

    const hash = hashSecret(secret);
    const apiKey = await __unsafePrisma.apiKey.findUnique({
        where: {
            hash,
        },
    });

    if (!apiKey) {
        return undefined;
    }

    return apiKey;
}