prehistoric-systems/omnivore
1
0
Fork 0
mirror of https://github.com/omnivore-app/omnivore.git synced 2026-03-11 08:54:26 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix Apollo GraphQL context to support API key authentication

Browse source 
Update token extraction in Apollo context to use getTokenByRequest()
instead of manual header checking. This enables API keys sent via
the Authorization header to work with GraphQL mutations like
createHighlight, while preserving existing cookie-based authentication
for the web frontend.

The getTokenByRequest() function checks three sources in order:
1. Omnivore-Authorization header (API keys)
2. Authorization header (standard auth)
3. cookies.auth (frontend sessions)

This fixes FORBIDDEN errors when using API keys to create highlights/notes.
This commit is contained in:
Rohit Amarnath 2025-10-01 23:43:12 -04:00
parent a9454182f9
commit 01eafe27be
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
packages/api/src/apollo.ts
View file

@ -47,7 +47,7 @@ import { batchGetSubscriptionsByNames } from './services/subscriptions'
import { batchGetUploadFilesByIds } from './services/upload_file'
import { findUsersByIds } from './services/user'
import { tracer } from './tracing'
import { getClaimsByToken, setAuthInCookie } from './utils/auth'
import { getClaimsByToken, setAuthInCookie, getTokenByRequest } from './utils/auth'
import { SetClaimsRole } from './utils/dictionary'
import { logger } from './utils/logger'
@ -68,7 +68,8 @@ const contextFunc: ContextFunction<ExpressContext, ResolverContext> = async ({
variables: req.body.variables,
})
const token = req?.cookies?.auth || req?.headers?.authorization
// AIDEV-NOTE: api-key-auth - Use getTokenByRequest to support API keys while preserving cookie auth
const token = getTokenByRequest(req)
const claims = await getClaimsByToken(token)
httpContext.set('claims', claims)