Add API key authentication middleware to gate /api/generate endpoints #174

New issue

Closed

opened 2026-04-08 23:51:18 -04:00 by pook · 2 comments

pook commented

2026-04-08 23:51:18 -04:00

Owner

Issue #131 exists but has no PR and the endpoint is unprotected. This is a revenue/cost blocker — without auth, anyone can call the OpenAI-backed generation endpoint and run up API costs.

Create middleware that reads x-api-key header and validates against stored API keys in the database
Return 401 with { error: 'Missing API key' } if header is absent
Return 403 with { error: 'Invalid API key' } if key doesn't match
Apply middleware to POST /api/generate and any other generation routes
Add integration test: request without key → 401, invalid key → 403, valid key → passes through

Acceptance criteria:

All /api/generate routes require valid API key
Clear error responses for missing/invalid keys
Tests cover all three cases (missing, invalid, valid)

Generated by CEO Planner (priority: 3)

Issue #131 exists but has no PR and the endpoint is unprotected. This is a revenue/cost blocker — without auth, anyone can call the OpenAI-backed generation endpoint and run up API costs. 1. Create middleware that reads `x-api-key` header and validates against stored API keys in the database 2. Return 401 with `{ error: 'Missing API key' }` if header is absent 3. Return 403 with `{ error: 'Invalid API key' }` if key doesn't match 4. Apply middleware to POST /api/generate and any other generation routes 5. Add integration test: request without key → 401, invalid key → 403, valid key → passes through Acceptance criteria: - All /api/generate routes require valid API key - Clear error responses for missing/invalid keys - Tests cover all three cases (missing, invalid, valid) --- *Generated by CEO Planner (priority: 3)*

pook added the

agent-task

label

2026-04-08 23:51:18 -04:00

agent-bot referenced this issue from a commit

2026-04-08 23:56:50 -04:00

feat: issue #174 issue-131-exists-but-has-no-pr-and-the-e (agent task agent-ta)

pook commented

2026-04-09 06:07:00 -04:00

Author

Owner

⚠️ Stale Task Alert — This task has been open for 6h with no associated PR.

Possible causes:

Worker failed to execute (check logs)
Claude CLI produced no changes
Task may be too complex for single-session execution

The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.

— CEO Planner (automated)

⚠️ **Stale Task Alert** — This task has been open for 6h with no associated PR. Possible causes: - Worker failed to execute (check logs) - Claude CLI produced no changes - Task may be too complex for single-session execution The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped. *— CEO Planner (automated)*

pook referenced this issue

2026-04-09 06:08:04 -04:00

Close 10 stale tasks that have matching PRs or duplicate scope #251

pook commented

2026-04-09 06:12:17 -04:00

Author

Owner

Closing as duplicate of #131 (API key auth).

pook closed this issue

2026-04-09 06:12:17 -04:00

pook referenced this issue

2026-04-09 06:12:29 -04:00