amosblomqvist
cbaf6df454
The auth/keys wave (2026-09-19): the server now owns the flat auth.json map directly (LH_AUTH_FILE from main.cjs; repo-root auth.json in dev, gitignored). The store reflects itself into the child's env at boot with fill-gap precedence — real env (incl. .env.local in dev) always wins — so every consumer keeps its plain process.env reads and saved keys take effect immediately, no restart; main.cjs's spawn-time injection retired (an env copy would shadow every settings-page change). Curated 4-key catalog (OpenRouter, Deepgram, Google search pair) with shape-only validation (no live pings — owner decision), 400s on bad pastes, last-4+length masking (plaintext never leaves the store), unknown file vars preserved + surfaced. Routes: GET /api/keys, PUT/DELETE /api/keys/:id. Tests: catalog/store/composition, with the env-sanitizing prologue (a dev shell may export real keys; tests use throwaway values only).
18 lines
657 B
TypeScript
18 lines
657 B
TypeScript
/**
|
|
* GET /api/keys — the auth page's key list (auth-keys wave, 2026-09-19).
|
|
*
|
|
* Every curated key (present or not) plus unknown file vars surfaced as
|
|
* generic rows. Masked only — last 4 + length; PLAINTEXT NEVER LEAVES THE
|
|
* STORE THROUGH THIS API (owner decision). `source` tells the page whether
|
|
* the live value comes from the environment (dev .env.local / launch env)
|
|
* or the file, and `shadowedByEnv` explains why a saved key is not the
|
|
* live one (env always wins).
|
|
*/
|
|
import { keyStatuses } from "@/src/server";
|
|
|
|
export const dynamic = "force-dynamic";
|
|
|
|
export async function GET() {
|
|
return Response.json({ keys: keyStatuses() });
|
|
}
|