Function authenticateApiKeyRequest

shared/auth/api-key.ts:202–271

(opts: {
    request: Request;
    env: ApiKeyAuthBindings;
    client?: VerifyApiKeyClient;
    ctx?: ExecutionContext;
})

}

export async function authenticateApiKeyRequest(opts: {
    request: Request;
    env: ApiKeyAuthBindings;
    client?: VerifyApiKeyClient;
    ctx?: ExecutionContext;
}): Promise<ApiKeyAuthResult | null> {
    const rawApiKey = extractApiKey(opts.request);
    if (!rawApiKey) return null;

    const client: VerifyApiKeyClient =
        opts.client ??
        (createApiKeyAuth(opts.env, opts.ctx) as unknown as VerifyApiKeyClient);
    const keyResult = await client.api.verifyApiKey({
        body: { key: rawApiKey },
    });

    if (!keyResult.valid || !keyResult.key) return null;

    const key = keyResult.key;
    const keyId = typeof key.id === "string" ? key.id : undefined;
    if (!keyId) return null;

    const db = drizzle(opts.env.DB, { schema });
    const userId = typeof key.userId === "string" ? key.userId : undefined;
    const byopClientKey = alias(schema.apikey, "byop_client_key");
    const [apiKeyExtra, userData] = await Promise.all([
        db
            .select({
                pollenBalance: schema.apikey.pollenBalance,
                byopClientKeyId: schema.apikey.byopClientKeyId,
                byopClientName: byopClientKey.name,
                byopClientUserId: byopClientKey.userId,
            })
            .from(schema.apikey)
            .leftJoin(
                byopClientKey,
                eq(byopClientKey.id, schema.apikey.byopClientKeyId),
            )
            .where(eq(schema.apikey.id, keyId))
            .get(),
        userId
            ? db
                  .select()
                  .from(schema.user)
                  .where(eq(schema.user.id, userId))
                  .get()
            : null,
    ]);

    if (userData) {
        assertNotBanned(userData);
    }
    assertStagingAccess(opts.env, userData);

    return {
        user: userData ?? undefined,
        apiKey: {
            id: keyId,