Add API key authentication to ApiServer by thechibuikem · Pull Request #13 · hyphae/apis-web

thechibuikem · 2026-07-03T18:24:37Z

Addresses hyphae/APIS#91 (item 1: Unauthenticated Control APIs)

Adds timing-safe X-API-Key header check to ApiServer's HTTP request handler, covering all three handlers (ErrorGeneration, DealGeneration, LogConfiguration) since the check runs before dispatch. Returns 500 if apiKey unconfigured, 401 on missing/invalid key.

Tests

Unit Tests

ApiServerAuthTest: missing key, empty key, missing header, wrong
header, valid header.

Manual Testing: ApiServer X-API-Key Authentication

Covers checkAuth() in ApiServer — the shared auth gate for /error, /deal, and /log. Tested against /log, but behavior is identical for the other two endpoints since auth runs before any handler-specific code.

Prerequisites

apis-web running (Docker or local)
.env configured with DEV_INTERNAL_API_KEY
curl available
Set once per session for convenience:

HOST=localhost
KEY="<your configured DEV_INTERNAL_API_KEY>"

Manual Testing: ApiServer X-API-Key Authentication

Covers checkAuth() in ApiServer — the shared auth gate for /error, /deal, and /log. Tested against /log, but behavior is identical for the other two endpoints since auth runs before any handler-specific code.

Prerequisites

apis-web running (Docker or local)
.env configured with DEV_INTERNAL_API_KEY
curl available

Set once per session for convenience:

HOST=localhost
KEY="<your configured DEV_INTERNAL_API_KEY>"

#	Case	Command	Expected
1	Valid key	`curl -i http://$HOST:9999/log -H "X-API-Key: $KEY"`	`200`, HTML form body
2	Missing key	`curl -i http://$HOST:9999/log`	`401`, `unauthorized`
3	Empty key	`curl -i http://$HOST:9999/log -H "X-API-Key: "`	`401`, `unauthorized`
4	Wrong key	`curl -i http://$HOST:9999/log -H "X-API-Key: wrong-value"`	`401`, `unauthorized`
5	No key configured server-side	Unset `DEV_INTERNAL_API_KEY`, restart server, then `curl -i http://$HOST:9999/log -H "X-API-Key: anything"`	`500`, `server misconfigured`

Screenshots

Valid key (200):

Missing key (401):

Empty key (401):

Wrong key (401):

Unconfigured server (500):

Notes

checkAuth() uses MessageDigest.isEqual for constant-time comparison — prevents key-length/prefix leakage via response-time analysis. No need to test this behaviorally; it's a code-level guarantee.
Auth runs once in ApiServer before path dispatch, so this behavior applies identically to /error and /deal — no need to repeat these cases per-endpoint.
Fixed: initial misconfiguration check ran before the DEV_INTERNAL_* env-var resolution, so an unset DEV_INTERNAL_API_KEY left apiKey null past that guard — causing an uncaught NPE instead of a 500. Added a second check after the swap.

@FlawzyByte @axmsoftware @subhramit

Follow-up (separate PRs)

apis-common: method to read API key from config Add apiServerApiKey to VertxConfig.java utility apis-common#28
Remaining #91 items (2–7) tracked separately

FlawzyByte · 2026-07-10T12:30:50Z

Interesting insight, I provided my answer through zulip
@subhramit Hi subha again, I appreciate your feedback on this. Thanks!

subhramit · 2026-07-10T16:58:37Z

Please revert the formatting changes to this file

subhramit · 2026-07-10T16:58:59Z

+        when(req.getHeader("X-API-Key")).thenReturn("secret");
+        assertNull(ApiServer.checkAuth(req, "secret"));
+    }
+}


Add a newline here. This can also be covered by Checkstyle eventually.

Hi @subhramit , thank you for the feedback!
I added a new-line in the most recent changes.

subhramit · 2026-07-10T17:00:07Z

+import static org.junit.Assert.*;
+import static org.mockito.Mockito.*;


Don't import *, just import the required methods

Hi Subhramit.
I appreciate your feedback! I addressed this in the most recent changes.

subhramit

Hey, can you provide some steps to manually test this?
Also can you look into if assertEquals needs explicit boxing for comparison? (Integer.valueOf)

Signed-off-by: Chukwuemeka David <[email protected]>

thechibuikem · 2026-07-14T21:51:27Z

Hi @subhramit.
I hope you're doing good.

Why assertEquals needs explicit boxing for comparison.

The build was failing with a compilation error: "reference to assertEquals is ambiguous". I researched and found out it happened because org.junit.Assert.assertEquals has overloaded method signatures for both primitives, assertEquals(long, long) and objects assertEquals(Object, Object).

Because the test was mixing a primitive type (like int) and a wrapper object type (like Long or Integer), Java's automatic type conversion (autoboxing) made both method signatures equally valid. The compiler couldn't determine which version to invoke, making the build fail.

Solution:
So I resolved the ambiguity by explicitly wrapping the primitive value using Integer.valueOf(). Forcing both arguments to be evaluated as objects, cleanly routing the call to the assertEquals(Object, Object) method and fixing the compilation error.

As to the steps to the manual testing, I updated the description of this PR to include it.
Thank you!

axmsoftware

@thechibuikem Please trace calls from apis-main_controller on the client side to apis-web, and how apis-web calls apis-main. Use debugger on the Java side with break points, and the Developer tools on the Python web app. Thanks!

Signed-off-by: Chukwuemeka David <[email protected]>

thechibuikem · 2026-07-20T13:22:34Z

@thechibuikem Please trace calls from apis-main_controller on the client side to apis-web, and how apis-web calls apis-main. Use debugger on the Java side with break points, and the Developer tools on the Python web app. Thanks!

Hi @axmsoftware.

According to my findings from tracing the calls sent by apis-main_controller to apis-web. I discovered that Apis-main_controller interacts with apis-web via the:

apis_emul_port (43900), and
apis_budo_port (43830)

Which are at jp.co.sony.csl.dcoes.apis.tools.web.EmulatorEmulator.java and jp.co.sony.csl.dcoes.apis.tools.web.BudoEmulator.java respectively.

The third port being exposed by apis-web, via the ApiServer (port 9999) at ApiServer.java . I couldn't find any caller for it inside apis-main, apis-main_controller, or apis-web — no self-calls, no client code anywhere in these three repos. Based on the code (each handler serves an HTML

on GET), it looks built for manual/external use e.g a human via browser or curl, likely for injecting test errors/deals — not part of the normal inter-service dataflow.

Signed-off-by: Chukwuemeka David <[email protected]>

subhramit

Lgtm

subhramit · 2026-07-22T11:27:45Z

 clean:
 	mvn clean
-	rm -f *.log *.err
+	rm -f *.log *.err


Please add the newline back

Thanks for the feedback @subhramit, I just resolved this in the latest changes.

Signed-off-by: Chukwuemeka David <[email protected]>

thechibuikem requested a review from FlawzyByte July 3, 2026 18:24

This was referenced Jul 5, 2026

Add apiServerApiKey to VertxConfig.java utility hyphae/apis-common#27

Closed

Add apiServerApiKey to VertxConfig.java utility hyphae/apis-common#28

Merged

subhramit reviewed Jul 10, 2026

View reviewed changes

Comment thread Makefile

subhramit Jul 10, 2026

Copy link
Copy Markdown

Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please revert the formatting changes to this file

subhramit reviewed Jul 10, 2026

View reviewed changes

subhramit requested changes Jul 10, 2026

View reviewed changes

thechibuikem force-pushed the vertex-4 branch from 8cd29ff to a31b1e3 Compare July 14, 2026 21:23

thechibuikem added 4 commits July 14, 2026 22:27

chore: resolve merge conflicts from stash

49239c5

Signed-off-by: Chukwuemeka David <[email protected]>

Add API key authentication to ApiServer with unit tests

2f6cc2b

Signed-off-by: Chukwuemeka David <[email protected]>

style: added new line at the end of file

a82fdd3

Signed-off-by: Chukwuemeka David <[email protected]>

refactor: replace wildcard imports with explicit named imports

5bb304f

Signed-off-by: Chukwuemeka David <[email protected]>

thechibuikem force-pushed the vertex-4 branch from a31b1e3 to 5bb304f Compare July 14, 2026 21:27

axmsoftware approved these changes Jul 17, 2026

View reviewed changes

thechibuikem added 3 commits July 20, 2026 11:51

config: added api-key to api-server at [config.json]

6633506

Signed-off-by: Chukwuemeka David <[email protected]>

config: added [sample env]

e9b625c

Signed-off-by: Chukwuemeka David <[email protected]>

refactor(api-server): load API key from environment variable

0b061ac

Signed-off-by: Chukwuemeka David <[email protected]>

fix: guard against NPE when DEV_INTERNAL_API_KEY unset

34bf4bb

Signed-off-by: Chukwuemeka David <[email protected]>

subhramit approved these changes Jul 22, 2026

View reviewed changes

subhramit reviewed Jul 22, 2026

View reviewed changes

thechibuikem added 2 commits July 28, 2026 04:40

Merge upstream vertex-4

3174e61

chore: re-add mockito dependency for API authentication tests

25ef35a

Signed-off-by: Chukwuemeka David <[email protected]>

thechibuikem force-pushed the vertex-4 branch from 9b7714e to 25ef35a Compare July 30, 2026 16:37

chore: add newline to the end of makefile

5ac9c71

Signed-off-by: Chukwuemeka David <[email protected]>

thechibuikem merged commit 6fc9acd into hyphae:vertex-4 Aug 5, 2026
1 check passed

		import static org.junit.Assert.*;
		import static org.mockito.Mockito.*;

Uh oh!

Conversation

thechibuikem commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Addresses hyphae/APIS#91 (item 1: Unauthenticated Control APIs)

Tests

Unit Tests

Manual Testing: ApiServer X-API-Key Authentication

Prerequisites

Manual Testing: ApiServer X-API-Key Authentication

Prerequisites

Screenshots

Notes

Follow-up (separate PRs)

Uh oh!

FlawzyByte commented Jul 10, 2026

Uh oh!

subhramit Jul 10, 2026

Choose a reason for hiding this comment

Uh oh!

subhramit Jul 10, 2026

Choose a reason for hiding this comment

Uh oh!

thechibuikem Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

subhramit Jul 10, 2026

Choose a reason for hiding this comment

Uh oh!

thechibuikem Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

subhramit left a comment

Choose a reason for hiding this comment

Uh oh!

thechibuikem commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

axmsoftware left a comment

Choose a reason for hiding this comment

Uh oh!

thechibuikem commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

subhramit left a comment

Choose a reason for hiding this comment

Uh oh!

subhramit Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

thechibuikem Jul 30, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

thechibuikem commented Jul 3, 2026 •

edited

Loading

thechibuikem Jul 14, 2026 •

edited

Loading

thechibuikem commented Jul 14, 2026 •

edited

Loading

thechibuikem commented Jul 20, 2026 •

edited

Loading