pook/compliancebot

Fork 0

Add API key authentication middleware to gate document generation endpoints #131

New issue

Closed

opened 2026-04-08 21:01:09 -04:00 by pook · 1 comment

pook commented

2026-04-08 21:01:09 -04:00

Owner

Issue #49 has been stale for 8h. The /api/generate endpoint is completely unauthenticated — anyone can generate documents and burn OpenAI credits. This is a direct cost/revenue blocker.

Implement API key auth middleware:

Check for Authorization: Bearer <key> or X-API-Key: <key> header
Validate key against API_KEYS stored in environment (comma-separated list) or database lookup
Return 401 with { error: 'unauthorized', message: 'Valid API key required' } if missing/invalid
Attach the validated key identity to req.user for downstream logging

Acceptance criteria:

Middleware exported from src/middleware/apiKeyAuth.ts
Applied to all /api/generate routes
GET /health remains unauthenticated
Unit tests: missing header → 401, invalid key → 401, valid key → passes through
Reference #49 in PR description

Generated by CEO Planner (priority: 2)

Issue #49 has been stale for 8h. The /api/generate endpoint is completely unauthenticated — anyone can generate documents and burn OpenAI credits. This is a direct cost/revenue blocker. Implement API key auth middleware: 1. Check for `Authorization: Bearer <key>` or `X-API-Key: <key>` header 2. Validate key against API_KEYS stored in environment (comma-separated list) or database lookup 3. Return 401 with { error: 'unauthorized', message: 'Valid API key required' } if missing/invalid 4. Attach the validated key identity to req.user for downstream logging Acceptance criteria: - Middleware exported from src/middleware/apiKeyAuth.ts - Applied to all /api/generate routes - GET /health remains unauthenticated - Unit tests: missing header → 401, invalid key → 401, valid key → passes through - Reference #49 in PR description --- *Generated by CEO Planner (priority: 2)*

pook added the

agent-task

label

2026-04-08 21:01:09 -04:00

pook referenced this issue

2026-04-08 21:31:00 -04:00

Close duplicate and superseded issues — #112, #54, #59, #58, #49, #69 #141

pook referenced this issue

2026-04-08 21:32:17 -04:00

Add API key authentication middleware for protected generation endpoints #49

pook referenced this issue

2026-04-08 21:32:35 -04:00

[Agent] Issue #141: multiple open issues are duplicates of n #143

pook referenced this issue

2026-04-08 23:51:18 -04:00

Add API key authentication middleware to gate /api/generate endpoints #174

agent-bot referenced this issue from a commit

2026-04-08 23:55:34 -04:00

feat: add API key authentication to /generate routes

pook referenced this issue from a pull request that will close it,

2026-04-08 23:56:41 -04:00

feat: add API key auth to /generate routes (closes #131) #175

pook referenced this issue

2026-04-09 06:08:04 -04:00

Close 10 stale tasks that have matching PRs or duplicate scope #251

pook referenced this issue

2026-04-09 06:12:17 -04:00

Add API key authentication middleware to gate /api/generate endpoints #174

pook referenced this issue

2026-04-09 06:12:29 -04:00

[Agent] Issue #251: 10 issues are stale but many have duplic #253

pook commented

2026-04-10 14:48:28 -04:00

Author

Owner

Bulk-closed 2026-04-10 during pipeline triage.

Context: CEO agent had created 100 open agent-task issues against compliancebot, largely duplicates of each other and of the 50 currently-open PRs. Root cause traced to a git-push race in agent-worker executor (dispatch jobs collided on branch agent/dispatch/* because jobId prefix truncated to literal "dispatch"). Fix deployed: runId is now threaded from Paperclip shim through /dispatch → TaskJob → executor, and branches are keyed on a 12-char unique run key.

What to do next:

Triage the 50 open PRs at https://192.168.183.110:3000/pook/compliancebot/pulls — many are ready to merge
CEO should halt new task creation until open PRs drop below 10
Surviving kept issues: #313, #314, #315, #341, #342, #350, #351, #352 (PR review/merge tasks)

This issue was superseded, not abandoned. Reopen if still relevant after PR triage.

Bulk-closed 2026-04-10 during pipeline triage. **Context:** CEO agent had created 100 open agent-task issues against compliancebot, largely duplicates of each other and of the 50 currently-open PRs. Root cause traced to a git-push race in agent-worker executor (dispatch jobs collided on branch `agent/dispatch/*` because jobId prefix truncated to literal "dispatch"). Fix deployed: runId is now threaded from Paperclip shim through /dispatch → TaskJob → executor, and branches are keyed on a 12-char unique run key. **What to do next:** 1. Triage the 50 open PRs at https://192.168.183.110:3000/pook/compliancebot/pulls — many are ready to merge 2. CEO should halt new task creation until open PRs drop below 10 3. Surviving kept issues: #313, #314, #315, #341, #342, #350, #351, #352 (PR review/merge tasks) This issue was superseded, not abandoned. Reopen if still relevant after PR triage.

pook closed this issue

2026-04-10 14:48:28 -04:00

No labels

agent-task

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pook/compliancebot#131

No description provided.

Rows
Columns