Hamza/maps-saas
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(api): Allow trusted portal domains to use demo master API key seamlessly

Browse Source
This commit is contained in:
Hamza-Ayed
2026-08-21 00:02:54 +03:00
parent 9e65afae59
commit 50ecf9bfbf
1 changed files with 19 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/common/guards/api-key.guard.ts
+19 -7
View File
@@ -13,16 +13,28 @@ export class ApiKeyGuard implements CanActivate {
async canActivate(context: ExecutionContext): Promise<boolean> {
const request = context.switchToHttp().getRequest();
// Extract API key from custom header
const apiKeyHeader = request.headers['x-api-key'] || request.query['api_key'];
// Extract Origin and Referer for domain-level security
const origin = request.headers['origin'] || '';
const referer = request.headers['referer'] || '';
// Extract API key from custom header or query params, with public demo fallback
let apiKeyHeader = request.headers['x-api-key'] || request.query['api_key'] || request.query['key'];
if (!apiKeyHeader) {
throw new UnauthorizedException('API Key (x-api-key) is missing');
}
const isInternalDomain =
origin.includes('intaleqapp.com') ||
referer.includes('intaleqapp.com') ||
origin.includes('localhost') ||
referer.includes('localhost') ||
origin.includes('188.68.36.205') ||
referer.includes('188.68.36.205');
// Extract Origin and Referer for domain-level security
const origin = request.headers['origin'];
const referer = request.headers['referer'];
if (isInternalDomain) {
apiKeyHeader = process.env.MAP_API_KEY || 'zP9vL5mK2nQ8xR7jT4wS1yB6hG3fV0cX';
} else {
throw new UnauthorizedException('API Key (x-api-key) is missing');
}
}
try {
// Validate key via AuthService (includes Redis caching and domain checks)