mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-22 07:02:16 +03:00
ef78596876
The CLIENT_API auth layer accepts a plain `x-api-key` (no anthropic-version), but enforceApiKeyPolicy resolved the key via the Issue-#2225-gated extractApiKey(), which ignores that header — so a valid restricted key sent as a bare x-api-key passed auth while skipping its allowedModels / budget / rate-limit policy entirely. Resolve the ungated x-api-key / x-goog-api-key in the policy layer too; unknown keys still fail open, so only real keys are affected. extractApiKey() (used by MANAGEMENT routes) keeps its local-mode gating. Reported by @Benson-mk via GHSA-2phc-xp22-9f56 and GHSA-m3cj-q455-6wfr.