Function PrecheckAPIKey

coderd/httpmw/apikey.go:209–230

PrecheckAPIKey extracts and fully validates the API key on every request (if present) and stores the result in context. It never writes error responses and always calls next. The rate limiter reads the stored result to key by user ID and check the Owner bypass header. Downstream ExtractAPIKeyMW rea

(cfg ValidateAPIKeyConfig)

// check the Owner bypass header. Downstream ExtractAPIKeyMW reads
// it to avoid redundant DB lookups and validation.
func PrecheckAPIKey(cfg ValidateAPIKeyConfig) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
			ctx := r.Context()

			// Already prechecked (shouldn't happen, but guard).
			if _, ok := ctx.Value(apiKeyPrecheckedContextKey{}).(APIKeyPrechecked); ok {
				next.ServeHTTP(rw, r)
				return
			}

			result, valErr := ValidateAPIKey(ctx, cfg, r)

			prechecked := APIKeyPrechecked{
				Result: result,
				Err:    valErr,
			}
			ctx = context.WithValue(ctx, apiKeyPrecheckedContextKey{}, prechecked)
			next.ServeHTTP(rw, r.WithContext(ctx))
		})
	}
}

// ValidateAPIKey extracts and validates the API key from the
// request. It performs all security-critical checks: