fix(security & web): Enforce strict ApiKeyGuard and fix missing Gauge import in App.tsx

apps/api/src/common/guards/api-key.guard.ts

@@ -13,29 +13,17 @@ export class ApiKeyGuard implements CanActivate {
   async canActivate(context: ExecutionContext): Promise<boolean> {
     const request = context.switchToHttp().getRequest();
     
-    // Extract Origin and Referer for domain-level security
+    // Extract API key from custom header or query parameters
-    const origin = request.headers['origin'] || '';
+    const apiKeyHeader = request.headers['x-api-key'] || request.query['api_key'] || request.query['key'];
-    const referer = request.headers['referer'] || '';
-
-    // Extract API key from custom header or query params, with public demo fallback
-    let apiKeyHeader = request.headers['x-api-key'] || request.query['api_key'] || request.query['key'];
     
     if (!apiKeyHeader) {
-      const isInternalDomain = 
+      throw new UnauthorizedException('API Key (x-api-key) is missing');
-        origin.includes('intaleqapp.com') || 
-        referer.includes('intaleqapp.com') || 
-        origin.includes('localhost') || 
-        referer.includes('localhost') ||
-        origin.includes('188.68.36.205') ||
-        referer.includes('188.68.36.205');
-
-      if (isInternalDomain) {
-        apiKeyHeader = process.env.MAP_API_KEY || 'zP9vL5mK2nQ8xR7jT4wS1yB6hG3fV0cX';
-      } else {
-        throw new UnauthorizedException('API Key (x-api-key) is missing');
-      }
     }
 
+    // Extract Origin and Referer for domain-level security
+    const origin = request.headers['origin'];
+    const referer = request.headers['referer'];
+
     try {
       // Validate key via AuthService (includes Redis caching and domain checks)
       const { tenant, apiKey, rateLimit } = await this.authService.validateApiKey(

apps/web/src/App.tsx

@@ -1,6 +1,6 @@
 import React, { useState, useEffect } from 'react';
 import MapComponent from './components/MapComponent';
-import { Navigation, Compass, Activity, BarChart3, MapPin, Eye, Shield } from 'lucide-react';
+import { Navigation, Compass, Activity, BarChart3, MapPin, Eye, Shield, Gauge, Clock } from 'lucide-react';
 import { decodePolyline } from './utils/polyline';
 import WeatherPanel from './components/WeatherPanel';
 import { LineOfSightTool } from './components/LineOfSightTool';