From 01eafe27be0d0f56ee05f5b7339d9c34a767f496 Mon Sep 17 00:00:00 2001
From: Rohit Amarnath <88762+ramarnat@users.noreply.github.com>
Date: Wed, 1 Oct 2025 23:43:12 -0400
Subject: [PATCH] Fix Apollo GraphQL context to support API key authentication

Update token extraction in Apollo context to use getTokenByRequest()
instead of manual header checking. This enables API keys sent via
the Authorization header to work with GraphQL mutations like
createHighlight, while preserving existing cookie-based authentication
for the web frontend.

The getTokenByRequest() function checks three sources in order:
1. Omnivore-Authorization header (API keys)
2. Authorization header (standard auth)
3. cookies.auth (frontend sessions)

This fixes FORBIDDEN errors when using API keys to create highlights/notes.
---
 packages/api/src/apollo.ts | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/packages/api/src/apollo.ts b/packages/api/src/apollo.ts
index e51a6aef2..ab7c6cd8c 100644
--- a/packages/api/src/apollo.ts
+++ b/packages/api/src/apollo.ts
@@ -47,7 +47,7 @@ import { batchGetSubscriptionsByNames } from './services/subscriptions'
 import { batchGetUploadFilesByIds } from './services/upload_file'
 import { findUsersByIds } from './services/user'
 import { tracer } from './tracing'
-import { getClaimsByToken, setAuthInCookie } from './utils/auth'
+import { getClaimsByToken, setAuthInCookie, getTokenByRequest } from './utils/auth'
 import { SetClaimsRole } from './utils/dictionary'
 import { logger } from './utils/logger'
 
@@ -68,7 +68,8 @@ const contextFunc: ContextFunction<ExpressContext, ResolverContext> = async ({
     variables: req.body.variables,
   })
 
-  const token = req?.cookies?.auth || req?.headers?.authorization
+  // AIDEV-NOTE: api-key-auth - Use getTokenByRequest to support API keys while preserving cookie auth
+  const token = getTokenByRequest(req)
   const claims = await getClaimsByToken(token)
 
   httpContext.set('claims', claims)