pook/compliancebot
1
0
Fork 0
Code Issues 1.1k Pull requests 82 Projects Releases Packages Wiki Activity Actions

feat: add API key auth middleware for /generate routes #133

Closed
pook wants to merge 1 commit from feat/api-key-auth-middleware into main
pull from: feat/api-key-auth-middleware
merge into: pook:main
Conversation 2 Commits 1 Files changed 3 +199 -1
pook commented 2026-04-08 21:04:49 -04:00
Owner
Copy link

Summary

  • Adds apiKeyAuth middleware (src/middleware/apiKeyAuth.ts) that validates Authorization: Bearer <key> or X-API-Key: <key> headers against comma-separated API_KEYS env var
  • Applied to all /generate/* routes; /health and other endpoints remain unauthenticated
  • Returns 401 { error: 'unauthorized', message: 'Valid API key required' } for missing/invalid keys
  • Attaches validated key to request context (c.set("apiKey", key)) for downstream logging

Test plan

  • Unit tests: missing header → 401
  • Unit tests: invalid key → 401
  • Unit tests: valid Bearer key → passes through with key on context
  • Unit tests: valid X-API-Key → passes through
  • Unit tests: /health remains unauthenticated
  • Edge cases: empty Bearer token, non-Bearer auth scheme → 401
  • All 8 tests passing

Closes #49

🤖 Generated with Claude Code

## Summary - Adds `apiKeyAuth` middleware (`src/middleware/apiKeyAuth.ts`) that validates `Authorization: Bearer <key>` or `X-API-Key: <key>` headers against comma-separated `API_KEYS` env var - Applied to all `/generate/*` routes; `/health` and other endpoints remain unauthenticated - Returns `401 { error: 'unauthorized', message: 'Valid API key required' }` for missing/invalid keys - Attaches validated key to request context (`c.set("apiKey", key)`) for downstream logging ## Test plan - [x] Unit tests: missing header → 401 - [x] Unit tests: invalid key → 401 - [x] Unit tests: valid Bearer key → passes through with key on context - [x] Unit tests: valid X-API-Key → passes through - [x] Unit tests: /health remains unauthenticated - [x] Edge cases: empty Bearer token, non-Bearer auth scheme → 401 - [x] All 8 tests passing Closes #49 🤖 Generated with [Claude Code](https://claude.com/claude-code)
feat: add API key auth middleware to protect /generate routes
Some checks are pending
agent-worker/pr-tests Running PR tests...
72221bbf78 
Unauthenticated /api/generate endpoints allow anyone to burn OpenAI credits.
This adds apiKeyAuth middleware that validates Bearer token or X-API-Key
header against API_KEYS env var, returning 401 for missing/invalid keys.

Closes #49

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
pook commented 2026-04-08 21:04:58 -04:00
Author
Owner
Copy link

⚠️ No Test Suite Detected

Commit: 72221bbf

No test script found in package.json. Add a test script to enable automated testing.

## ⚠️ No Test Suite Detected **Commit:** `72221bbf` No `test` script found in `package.json`. Add a test script to enable automated testing.
pook commented 2026-04-10 15:08:16 -04:00
Author
Owner
Copy link

Closed 2026-04-10 during pipeline triage.

Merge conflicts with current main were blocking the CEO agent's backlog view. The compliancebot repo had ~60 open PRs and 141 open agent-task issues. CEO couldn't see progress and kept duplicating work due to a git-push race in agent-worker (now fixed — runId threaded through dispatch pipeline for unique branch names).

Reopen / resubmit against current main if the work is still relevant. Shim /shim/ceo route now injects open issues + PRs into the CEO prompt and refuses dispatch when backlog exceeds 20.

Closed 2026-04-10 during pipeline triage. Merge conflicts with current main were blocking the CEO agent's backlog view. The compliancebot repo had ~60 open PRs and 141 open agent-task issues. CEO couldn't see progress and kept duplicating work due to a git-push race in agent-worker (now fixed — runId threaded through dispatch pipeline for unique branch names). Reopen / resubmit against current main if the work is still relevant. Shim `/shim/ceo` route now injects open issues + PRs into the CEO prompt and refuses dispatch when backlog exceeds 20.
pook closed this pull request 2026-04-10 15:08:16 -04:00
Some checks are pending
agent-worker/pr-tests Running PR tests...

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent-task

Task for autonomous agent execution

  
agent-task

Paperclip autonomous agent task

No labels
agent-task
agent-task
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
pook/compliancebot!133
No description provided.