Require an API key on /api/*

[ashwinimanoj]

Every route under /api/* now requires Authorization: Bearer <key>, matched against a new API_KEY environment variable. /health and the HTML pages stay open.

What changed

File
src/auth.js	New. The requireApiKey middleware
src/app.js	One line — mounts it in front of apiRoutes
test/auth.test.js	15 cases, driven through the real app
test/helpers/supabase-stub.js	Stands in for PostgREST so tests need no network
package.json	npm test → node --test
README.md, .env.example	Documentation

Behaviour

Rejected requests get 401 and {"error":"Unauthorized"} — nothing more. The reason goes on the span as auth.rejected_reason:

Value	Meaning
missing	No Authorization header
malformed	Not Bearer <token>, or an empty token
mismatch	Well-formed but wrong — including when no key is configured

That separates a caller that forgot the header from one guessing keys, without telling the caller which it was.

Fails closed. With API_KEY unset, nothing can match it, so a deployment that never received the variable rejects everything rather than serving the dataset to the internet.

Rejections reuse the existing error handler, so they log at warn rather than error and the fault rate keeps measuring faults.

What this does not protect

The HTML pages read the same data the API serves and stay open, because a browser has nowhere to put a bearer token. This is an access gate on automation, not a security boundary around the dataset. Stated plainly in the README rather than left to be discovered.

Known consequence for tracing

A rejected request never reaches Express's router, so req.route is unset and nameSpanAfterRoute cannot rename the span. 401s keep the bare GET/POST name with no http.route. Filter on auth.rejected_reason instead of by route.

Tests

node:test, no new dependencies — engines already requires Node 20+.

Tests drive the real createApp() over HTTP rather than mounting the middleware on a throwaway app, which is what proves it is wired in front of the right routes. Verified by mutation: unwiring it from app.js fails 6 tests, weakening the key comparison fails 3.

ℹ tests 15
ℹ pass 15
ℹ fail 0

Rollout — order matters

The loadgen in office-k8s-workloads already sends Authorization: Bearer, and today's service ignores it, so the caller can be armed before the gate exists:

1. Generate a key: openssl rand -hex 32
2. kubectl create secret generic inventory-service -n observability --from-literal=token=<key>
3. Merge infraspecdev/office-k8s-workloads#44 — loadgen starts sending the header
4. Set API_KEY in the Vercel project
5. Merge this PR

Steps 4–5 before 2–3 gives a CrashLoopBackOff: the loadgen's startup call is not retried and exit(1)s on a non-OK response.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
vercel-demo	Ready	Preview	Aug 19, 2026 6:14pm