feat: add support for API keys in Authorization header for SSE clients

2026-05-09 09:37:55 +02:00
parent f4428afb9b
commit a207b3057e
1 changed files with 9 additions and 1 deletions
@@ -16,6 +16,14 @@ export class ApiKeyGuard implements CanActivate {
      apiKey = request.query['apiKey'];
    }
    // Fallback to Authorization: Bearer (used by SSE clients that can't set X-API-Key)
    if (!apiKey) {
      const auth: string | undefined = request.headers['authorization'];
      if (auth?.startsWith('Bearer ')) {
        apiKey = auth.slice(7);
      }
    }
    if (!apiKey) {
      throw new UnauthorizedException('API Key missing');
    }