fix(auth): gate invalid-key check on isRequireApiKeyEnabled for embeddings and web-fetch (#7785) (#7810)

* fix(auth): gate invalid-key check on isRequireApiKeyEnabled for embeddings and web-fetch (#7785)

When REQUIRE_API_KEY=false, /v1/embeddings and /v1/web/fetch still returned
401 for invalid presented keys while all other client APIs allowed anonymous
access. The route-local invalid-key check was not gated on
isRequireApiKeyEnabled(), unlike the /v1/combos pattern.

Gate the invalid-key check on isRequireApiKeyEnabled() in both route files so
anonymous access works consistently across all client APIs.

Refs: https://github.com/diegosouzapw/OmniRoute/issues/7785

* fix(tests): set REQUIRE_API_KEY=true in embeddings-auth invalid-key subtest

The "should return 401 when an invalid API key is provided" test now
correctly sets REQUIRE_API_KEY="true" so the route-level gated check
is exercised. Before, the test asserted 401 when REQUIRE_API_KEY was
not set, which after #7785 fix now returns 400 (model validation fails)
instead of 401.

* test(auth): assert anonymous-passthrough in embeddings-auth legacy suite (#7785)

Per #7785's acceptance criteria, the pre-existing embeddings regression
test must assert BOTH enforcement states, not just the enforced-401
case. Add the missing REQUIRE_API_KEY=false + invalid-key subtest
alongside the already-fixed REQUIRE_API_KEY=true + invalid-key subtest,
matching the coverage already present in the dedicated
auth-policy-embeddings-webfetch-7785.test.ts suite.

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

---------

Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com>
Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

src/app/api/v1/embeddings/route.ts

@@ -54,12 +54,13 @@ async function postHandler(request, context) {
   }
   const body = validation.data;
 
-  // Auth check
+  // Auth check — when REQUIRE_API_KEY=false, ignore presented invalid keys
+  // so anonymous access works the same as all other client APIs (#7785).
   const apiKeyRaw = extractApiKey(request);
   if (isRequireApiKeyEnabled() && !apiKeyRaw) {
     return errorResponse(HTTP_STATUS.UNAUTHORIZED, "Authentication required");
   }
-  if (apiKeyRaw && !(await isValidApiKey(apiKeyRaw))) {
+  if (isRequireApiKeyEnabled() && apiKeyRaw && !(await isValidApiKey(apiKeyRaw))) {
     return errorResponse(HTTP_STATUS.UNAUTHORIZED, "Invalid API key");
   }
 

src/app/api/v1/web/fetch/route.ts

@@ -64,12 +64,14 @@ export async function POST(request: Request) {
   }
   const body = validation.data;
 
-  // Optional auth check
+  // Optional auth check — when REQUIRE_API_KEY=false, ignore presented
+  // invalid keys so anonymous access works the same as all other client
+  // APIs (#7785).
   const apiKeyRaw = extractApiKey(request);
   if (isRequireApiKeyEnabled() && !apiKeyRaw) {
     return errorResponse(HTTP_STATUS.UNAUTHORIZED, "Authentication required");
   }
-  if (apiKeyRaw && !(await isValidApiKey(apiKeyRaw))) {
+  if (isRequireApiKeyEnabled() && apiKeyRaw && !(await isValidApiKey(apiKeyRaw))) {
     return errorResponse(HTTP_STATUS.UNAUTHORIZED, "Invalid API key");
   }
 

tests/unit/auth-policy-embeddings-webfetch-7785.test.ts

@@ -0,0 +1,118 @@
+/**
+ * #7785 — Auth policy inconsistency on /v1/embeddings and /v1/web/fetch.
+ *
+ * When REQUIRE_API_KEY=false, all client APIs should allow anonymous access.
+ * However, embeddings and web-fetch routes still returned 401 for invalid
+ * presented keys because the invalid-key check was NOT gated on
+ * isRequireApiKeyEnabled() — unlike the combos route pattern.
+ *
+ * Fix: gate the route-local invalid-key check on isRequireApiKeyEnabled() in
+ * both route files, matching the /api/v1/combos pattern.
+ *
+ * These tests verify:
+ * 1. REQUIRE_API_KEY=false + invalid bearer key → NOT 401 (anonymous access)
+ * 2. REQUIRE_API_KEY=true  + invalid bearer key → 401 (auth enforced)
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omr-auth-policy-7785-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = process.env.API_KEY_SECRET || "auth-7785-api-secret";
+process.env.JWT_SECRET = "auth-7785-jwt-secret";
+
+// Ensure no env-var API key interferes with isValidApiKey results.
+delete process.env.OMNIROUTE_API_KEY;
+delete process.env.ROUTER_API_KEY;
+
+const core = await import("../../src/lib/db/core.ts");
+const { createProviderNode } = await import("../../src/lib/db/providers/nodes.ts");
+const { POST: embeddingsPOST } = await import("../../src/app/api/v1/embeddings/route.ts");
+const { POST: webFetchPOST } = await import("../../src/app/api/v1/web/fetch/route.ts");
+
+const INVALID_BEARER = "Bearer sk-invalid-key-that-does-not-exist-7785";
+
+test.after(() => {
+  core.resetDbInstance();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+function embeddingsRequest(): Request {
+  return new Request("http://localhost/v1/embeddings", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: INVALID_BEARER,
+    },
+    body: JSON.stringify({ model: "lanembed7785/nomic-embed-text", input: "hello" }),
+  });
+}
+
+function webFetchRequest(): Request {
+  return new Request("http://localhost/v1/web/fetch", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: INVALID_BEARER,
+    },
+    body: JSON.stringify({ url: "https://example.com" }),
+  });
+}
+
+// ── Embeddings route ──────────────────────────────────────────────────────
+
+test("#7785 embeddings: REQUIRE_API_KEY=false + invalid key → not 401", async () => {
+  process.env.REQUIRE_API_KEY = "false";
+
+  await createProviderNode({
+    type: "openai-compatible-embeddings",
+    name: "LAN Embed 7785",
+    prefix: "lanembed7785",
+    apiType: "embeddings",
+    baseUrl: "http://10.10.0.182:11434/v1",
+  });
+
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = async () =>
+    new Response(
+      JSON.stringify({
+        data: [{ object: "embedding", embedding: [0.1, 0.2], index: 0 }],
+        usage: { prompt_tokens: 3, total_tokens: 3 },
+      }),
+      { status: 200, headers: { "content-type": "application/json" } }
+    );
+
+  try {
+    const res = await embeddingsPOST(embeddingsRequest(), {});
+    assert.notEqual(res.status, 401, "invalid key must NOT cause 401 when REQUIRE_API_KEY=false");
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+test("#7785 embeddings: REQUIRE_API_KEY=true + invalid key → 401", async () => {
+  process.env.REQUIRE_API_KEY = "true";
+
+  const res = await embeddingsPOST(embeddingsRequest(), {});
+  assert.equal(res.status, 401, "invalid key must cause 401 when REQUIRE_API_KEY=true");
+});
+
+// ── Web-fetch route ───────────────────────────────────────────────────────
+
+test("#7785 web-fetch: REQUIRE_API_KEY=false + invalid key → not 401", async () => {
+  process.env.REQUIRE_API_KEY = "false";
+
+  const res = await webFetchPOST(webFetchRequest());
+  assert.notEqual(res.status, 401, "invalid key must NOT cause 401 when REQUIRE_API_KEY=false");
+});
+
+test("#7785 web-fetch: REQUIRE_API_KEY=true + invalid key → 401", async () => {
+  process.env.REQUIRE_API_KEY = "true";
+
+  const res = await webFetchPOST(webFetchRequest());
+  assert.equal(res.status, 401, "invalid key must cause 401 when REQUIRE_API_KEY=true");
+});

tests/unit/embeddings-auth.test.ts

@@ -53,17 +53,43 @@ test("POST /v1/embeddings authentication", async (t) => {
   const originalRequireApiKey = process.env.REQUIRE_API_KEY;
   const originalOmniKey = process.env.OMNIROUTE_API_KEY;
 
-  await t.test("should return 401 when an invalid API key is provided", async () => {
-    process.env.OMNIROUTE_API_KEY = "valid-key";
-    const req = new Request("http://localhost/v1/embeddings", {
-      method: "POST",
-      headers: { Authorization: "Bearer invalid-key" },
-      body: JSON.stringify({ model: "mistral/mistral-embed", input: "test" }),
-    });
-    const res = await POST(req);
-    assert.strictEqual(res.status, 401);
-    delete process.env.OMNIROUTE_API_KEY;
-  });
+  await t.test(
+    "should return 401 when an invalid API key is provided and REQUIRE_API_KEY is true",
+    async () => {
+      process.env.REQUIRE_API_KEY = "true";
+      process.env.OMNIROUTE_API_KEY = "valid-key";
+      const req = new Request("http://localhost/v1/embeddings", {
+        method: "POST",
+        headers: { Authorization: "Bearer invalid-key" },
+        body: JSON.stringify({ model: "mistral/mistral-embed", input: "test" }),
+      });
+      const res = await POST(req);
+      assert.strictEqual(res.status, 401);
+      delete process.env.OMNIROUTE_API_KEY;
+      delete process.env.REQUIRE_API_KEY;
+    }
+  );
+
+  await t.test(
+    "should NOT return 401 when an invalid API key is provided and REQUIRE_API_KEY is false (#7785)",
+    async () => {
+      process.env.REQUIRE_API_KEY = "false";
+      process.env.OMNIROUTE_API_KEY = "valid-key";
+      const req = new Request("http://localhost/v1/embeddings", {
+        method: "POST",
+        headers: { Authorization: "Bearer invalid-key" },
+        body: JSON.stringify({ model: "mistral/mistral-embed", input: "test" }),
+      });
+      const res = await POST(req);
+      assert.notStrictEqual(
+        res.status,
+        401,
+        "an invalid presented key must not 401 when REQUIRE_API_KEY=false (anonymous access)"
+      );
+      delete process.env.OMNIROUTE_API_KEY;
+      delete process.env.REQUIRE_API_KEY;
+    }
+  );
 
   await t.test(
     "should return 401 when no API key is provided and REQUIRE_API_KEY is true",