Walkthrough

This change introduces API key-based Bearer token authentication across the application. A new middleware validates incoming requests against an API_KEY environment variable using constant-time comparison, applied conditionally to REST and GraphQL routes when not in test mode. Supporting configuration, comprehensive test coverage, and OpenAPI documentation updates have been added.

Changes

Sequence Diagram

sequenceDiagram
    participant Client
    participant Middleware as apiKeyAuth<br/>(Middleware)
    participant Config as Environment<br/>(API_KEY)
    participant Handler as Route<br/>Handler

    Client->>Middleware: Request + Authorization:<br/>Bearer [token]
    Middleware->>Config: Read API_KEY
    alt API_KEY missing
        Middleware->>Client: 500 Server Error
    else Authorization header missing
        Middleware->>Client: 401 Unauthorized
    else Token invalid
        Middleware->>Client: 401 Invalid API key
    else Token valid (timing-safe compare)
        Middleware->>Handler: next()
        Handler->>Client: 200 Response
    end

Estimated Code Review Effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Poem

🐰 A bearer token hops through the gate,
Cryptographic checks won't hesitate,
Timing-safe and constant we compare,
No timing attacks shall venture there!
The warren's door now guards with care. 🔐

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

• 📝 Generate docstrings

middleware/auth.ts (1)

14-17: Consider using a generic error message for the 500 response.

The message "Server misconfigured: API_KEY not set" leaks internal configuration state to the caller. While the Joi validation in app.ts should prevent this in production, a defense-in-depth approach would use a generic message like "Internal server error" and log the details server-side instead.

🛡️ Proposed fix

   if (!apiKey) {
-    res.status(500).json({ error: 'Server misconfigured: API_KEY not set' });
+    console.error('API_KEY environment variable is not set');
+    res.status(500).json({ error: 'Internal server error' });
     return;
   }

openapi.json (1)

414-419: Security scheme correctly updated to reflect Bearer token authentication.

The change from apiKey type to http/bearer aligns with the middleware implementation. The global security reference on line 422 ensures all endpoints require authentication by default in the spec.

Minor nit: the scheme name ApiKeyAuth is slightly misleading now that it's an HTTP Bearer scheme rather than an API-key-in-header scheme. Consider renaming to BearerAuth for clarity, though this is cosmetic.

• X
• Mastodon
• Reddit
• LinkedIn

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.