feat(auth): require API key alongside whitelisted hotkey#3
Conversation
Add a WORKER_API_KEY environment variable (required) that whitelisted hotkeys must provide via the X-Api-Key HTTP header to access protected endpoints. Authentication now requires both a valid whitelisted hotkey (X-Hotkey) and a matching API key (X-Api-Key) for submitting batches via POST /submit. This adds a second layer of request validation controlled by the worker operator. Changes: - auth.rs: Add api_key field to AuthHeaders, extract X-Api-Key header in extract_auth_headers, add InvalidApiKey variant to AuthError, and validate the API key in verify_request against the expected value. Added tests for invalid API key rejection and missing header detection. - config.rs: Add worker_api_key field to Config, loaded from WORKER_API_KEY env var (panics if unset). Log confirmation at startup. - handlers.rs: Pass worker_api_key from config to verify_request, update error message to list X-Api-Key as a required header. - AGENTS.md: Document WORKER_API_KEY env var and updated auth flow. - Cargo.lock: Version bump to 1.1.0.
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
🎉 This PR is included in version 1.2.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
1 participant
Summary
Add a mandatory API key verification step to the existing hotkey-based authentication flow. Whitelisted hotkeys must now also provide a valid API key via the
X-Api-Keyheader, configured through theWORKER_API_KEYenvironment variable.Changes
src/auth.rs: Addapi_keyfield toAuthHeaders, extractX-Api-Keyheader inextract_auth_headers(), and validate it against the expected key inverify_request(). AddInvalidApiKeyvariant toAuthErrorwith appropriate error messages and codes. Movesp_ss58_checksumhelper before the test module to fix clippyitems_after_test_modulelint.src/config.rs: Addworker_api_keyfield toConfig, loaded from the requiredWORKER_API_KEYenv var. Log confirmation that the key is configured on startup.src/handlers.rs: Passconfig.worker_api_keytoverify_request()and update the missing-headers error message to includeX-Api-Key.AGENTS.md: Document the newWORKER_API_KEYenv var and updated authentication requirements.Cargo.lock: Version bump to 1.1.0.Testing
test_verify_request_invalid_api_keyandtest_extract_auth_headers_missing_api_keyapi_keyfieldBreaking Changes
WORKER_API_KEYenvironment variable is now required — the server will panic on startup if it is not set.POST /submitrequests must include a validX-Api-Keyheader in addition to the existing auth headers.