fix(security): validate slicer worker API keys (fail closed) + stop leaking ApiKey (#652)

## Summary
Fixes a **Critical** pre-existing vulnerability (#650): the slicer
worker API-key filters failed **open** and `SlicersController` leaked
worker API keys.

## Problem
`[RequireSlicerApiKey]` / `[RequireSlicerServiceApiKey]` resolved
`ISlicerApiKeyValidator` via `GetService<>()` and, when it was null,
**passed the request through**. That validator was **never implemented
or registered**, so the filters always failed open → slicer worker REST
endpoints (register / rotate-key / heartbeat / deregister / list) were
effectively unauthenticated. `SlicersController.ListAsync()` also
returned `SlicerService` objects **including the worker `ApiKey`**,
exposing worker credentials to any caller.

## Fix
- **`SlicerApiKeyValidator`** implemented and registered in
`AddSlicerApiServices` (both monolith and slicer-host compositions), so
the filters actually validate:
- `[RequireSlicerServiceApiKey]` → shared registration key (config/env).
- `[RequireSlicerApiKey]` → the per-service key stored on
`SlicerService.ApiKey`, scoped to the requested service id; compared
with `CryptographicOperations.FixedTimeEquals`; null/empty rejected.
- **Filters fail CLOSED** — a missing validator returns 401 in
Production (explicit, logged Dev/Testing bypass only, keyed off
`IHostEnvironment`).
- **No more key leak** — `ListAsync`/`GetAsync` return a redacted
`SlicerServiceResponseDto`; only `register`/`rotate-key` return a
freshly-issued key to the worker.
- **Worker flow preserved** — shared-key/per-service-key resolution
treats blank config as absent and uses an aligned precedence on both the
worker client and the server validator, so Docker/prod workers (which
supply `WorkerAuth__SharedApiKey`) authenticate correctly. Docs updated
(`docs/SLICER_WORKER_API_KEYS.md`).

## Ops note
Because auth now fails closed, a deployment must configure the shared
worker key (`WorkerAuth:SharedKey`/`SharedApiKey`,
`SlicerRegistry:ApiKey`, or the
`WORKER_SHARED_API_KEY`/`SLICER_REGISTRATION_KEY` env). Documented in
`SLICER_WORKER_API_KEYS.md`.

## Validation
- `dotnet build` ✅; slicer module tests ✅ (612), worker tests ✅ (89),
focused auth tests ✅. No migration (response-DTO redaction only).

## Review
Mandatory 3-way adversarial gate; a round caught a real
worker-registration break (empty-`??` config precedence) which was
fixed. Final verdict unanimous **APPROVE**: Bishop (Opus) ✅ · Hicks
(GPT-5.5) ✅ · Vasquez (Gemini 3.1 Pro) ✅.

Closes #650

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: jpapiez

docs/SLICER_WORKER_API_KEYS.md

@@ -229,10 +229,18 @@ Docker Compose brings up 3 worker containers with corresponding keys.
 
 **Endpoint**: `POST /api/slicers/register`
 **Location**: `src/api/Controllers/SlicersController.cs`
-**Authentication**: 
-- Checks for `X-Slicer-ApiKey` header
-- Validates against static registry key (for registration) OR service-specific key (for updates)
-- Stores ApiKey in `SlicerService` record for future operations
+**Authentication**:
+- Checks for `X-Slicer-ApiKey` (legacy/current worker header) and
+  `X-Slicer-Api-Key` (compatibility header).
+- `GET /api/slicers` and `POST /api/slicers/register` require the configured
+  shared registration key (`WorkerAuth:SharedApiKey`, `WorkerAuth:SharedKey`,
+  `SlicerRegistry:ApiKey`, `WORKER_SHARED_API_KEY`, or
+  `SLICER_REGISTRATION_KEY`).
+- Per-service lifecycle endpoints (`GET /api/slicers/{id}`, heartbeat,
+  deregister, rotate-key) require the generated key stored on that
+  `SlicerService.ApiKey` record.
+- Read endpoints return a redacted DTO and do not include `apiKey`; register
+  and rotate-key responses still return the newly issued key to the worker.
 
 **Response**: 
 ```json
@@ -250,8 +258,10 @@ The worker registration flow is implemented in three files:
 - Registers SlicerRegistrationClient and RegistrationBackgroundService as hosted services
 
 **2. `src/orcaslicer-worker/Services/SlicerRegistrationClient.cs`** - HTTP communication
-- Reads SlicerRegistry:ApiKey from configuration
-- Sends X-Slicer-ApiKey header with registration requests
+- Reads `SlicerRegistry:ApiKey`, then falls back to `WorkerAuth:SharedApiKey`,
+  `WorkerAuth:SharedKey`, `WORKER_SHARED_API_KEY`, and
+  `SLICER_REGISTRATION_KEY` for registration.
+- Sends `X-Slicer-ApiKey` header with registration and lifecycle requests.
 
 **3. `src/orcaslicer-worker/Services/RegistrationBackgroundService.cs`** - Lifecycle management
 - Automatically calls RegisterAsync() on startup

src/orcaslicer-worker/Services/SlicerRegistrationClient.cs

@@ -96,14 +96,18 @@ public SlicerRegistrationClient(
             string json = JsonSerializer.Serialize(registrationDto);
             StringContent content = new StringContent(json, Encoding.UTF8, "application/json");
 
-            // Add API key header if configured
-            string? apiKey = _configuration["SlicerRegistry:ApiKey"];
-            if (!string.IsNullOrEmpty(apiKey))
+            using HttpRequestMessage request = new HttpRequestMessage(HttpMethod.Post, $"{_apiBaseUrl}/api/slicers/register")
             {
-                _httpClient.DefaultRequestHeaders.Add("X-Slicer-ApiKey", apiKey);
+                Content = content
+            };
+
+            string? apiKey = ResolveRegistrationApiKey(_configuration);
+            if (!string.IsNullOrWhiteSpace(apiKey))
+            {
+                request.Headers.Add("X-Slicer-ApiKey", apiKey);
             }
 
-            HttpResponseMessage response = await _httpClient.PostAsync($"{_apiBaseUrl}/api/slicers/register", content, cancellationToken);
+            HttpResponseMessage response = await _httpClient.SendAsync(request, cancellationToken);
 
             if (!response.IsSuccessStatusCode)
             {
@@ -211,4 +215,19 @@ private class RegistrationResponse
         [System.Text.Json.Serialization.JsonPropertyName("apiKey")]
         public string ApiKey { get; init; } = string.Empty;
     }
+
+    internal static string? ResolveRegistrationApiKey(IConfiguration configuration)
+    {
+        return FirstNonBlank(
+            configuration["WorkerAuth:SharedKey"],
+            configuration["WorkerAuth:SharedApiKey"],
+            configuration["SlicerRegistry:ApiKey"],
+            Environment.GetEnvironmentVariable("WORKER_SHARED_API_KEY"),
+            Environment.GetEnvironmentVariable("SLICER_REGISTRATION_KEY"));
+    }
+
+    private static string? FirstNonBlank(params string?[] candidates)
+    {
+        return candidates.FirstOrDefault(candidate => !string.IsNullOrWhiteSpace(candidate));
+    }
 }

src/slicer/Farm.Slicer.Module.Api/Controllers/SlicersController.cs

@@ -15,7 +15,6 @@ namespace Farm.Slicer.Module.Api.Controllers;
 
 // Slicer workers authenticate through the slicer API-key filters, not PrintFarmer bearer tokens.
 [AllowAnonymous]
-[RequireSlicerApiKey]
 public class SlicersController(ISlicersService service) : ControllerBase
 {
     private readonly ISlicersService _service = service ?? throw new ArgumentNullException(nameof(service));
@@ -24,17 +23,19 @@ public class SlicersController(ISlicersService service) : ControllerBase
     /// Lists all registered slicer services.
     /// </summary>
     [HttpGet]
+    [RequireSlicerApiKey]
     public async Task<IActionResult> ListAsync()
     {
         IReadOnlyList<SlicerService> list = await _service.ListAsync(HttpContext.RequestAborted);
-        return Ok(list);
+        return Ok(list.Select(ToResponseDto).ToList());
     }
 
     /// <summary>
     /// Registers a new slicer service.
     /// </summary>
     /// <param name="dto">Registration data.</param>
     [HttpPost("register")]
+    [RequireSlicerApiKey]
     public async Task<IActionResult> RegisterAsync([FromBody] RegisterSlicerDto dto)
     {
         CancellationToken ct = HttpContext.RequestAborted;
@@ -52,7 +53,7 @@ public async Task<IActionResult> RegisterAsync([FromBody] RegisterSlicerDto dto)
     public async Task<IActionResult> GetAsync(Guid id)
     {
         SlicerService? svc = await _service.GetAsync(id, HttpContext.RequestAborted);
-        return svc == null ? NotFound() : Ok(svc);
+        return svc == null ? NotFound() : Ok(ToResponseDto(svc));
     }
 
     /// <summary>
@@ -91,4 +92,26 @@ public async Task<IActionResult> RotateApiKeyAsync(Guid id)
         string? newApiKey = await _service.RotateApiKeyAsync(id, HttpContext.RequestAborted);
         return newApiKey == null ? NotFound() : Ok(new { id, apiKey = newApiKey });
     }
+
+    private static SlicerServiceResponseDto ToResponseDto(SlicerService service)
+    {
+        return new SlicerServiceResponseDto
+        {
+            Id = service.Id,
+            Name = service.Name,
+            SlicerType = service.SlicerType,
+            Version = service.Version,
+            Host = service.Host,
+            UiManifestUrl = service.UiManifestUrl,
+            CapabilitiesJson = service.CapabilitiesJson,
+            MaxConcurrentJobs = service.MaxConcurrentJobs,
+            Status = service.Status,
+            LastSeen = service.LastSeen,
+            ApiKeyRotatedAt = service.ApiKeyRotatedAt,
+            CreatedAt = service.CreatedAt,
+            UpdatedAt = service.UpdatedAt,
+            Tags = service.Tags,
+            InstanceId = service.InstanceId,
+        };
+    }
 }

src/slicer/Farm.Slicer.Module.Api/Filters/SlicerApiKeyFilters.cs

@@ -1,5 +1,7 @@
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.Filters;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
 
 namespace Farm.Slicer.Module.Api.Filters;
 
@@ -12,20 +14,28 @@ namespace Farm.Slicer.Module.Api.Filters;
 public sealed class RequireSlicerApiKeyAttribute : Attribute, IAsyncActionFilter
 {
     /// <summary>The header name for the slicer API key.</summary>
-    public const string HeaderName = "X-Slicer-Api-Key";
+    public const string HeaderName = "X-Slicer-ApiKey";
+
+    /// <summary>Alternate dashed header name accepted for compatibility.</summary>
+    public const string AlternateHeaderName = "X-Slicer-Api-Key";
 
     /// <inheritdoc />
     public async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next)
     {
         var validator = context.HttpContext.RequestServices.GetService<ISlicerApiKeyValidator>();
         if (validator is null)
         {
-            // No validator registered — pass through (development mode)
-            await next();
+            if (SlicerApiKeyFilterHelpers.AllowMissingValidatorInDevelopment(context, nameof(RequireSlicerApiKeyAttribute)))
+            {
+                await next();
+                return;
+            }
+
+            context.Result = new UnauthorizedObjectResult(new { error = "Slicer API key validation is not configured." });
             return;
         }
 
-        string? apiKey = context.HttpContext.Request.Headers[HeaderName].FirstOrDefault();
+        string? apiKey = SlicerApiKeyFilterHelpers.ReadHeader(context, HeaderName, AlternateHeaderName);
         if (!await validator.ValidateSharedKeyAsync(apiKey, context.HttpContext.RequestAborted))
         {
             context.Result = new UnauthorizedObjectResult(new { error = "Invalid or missing slicer API key." });
@@ -45,27 +55,80 @@ public async Task OnActionExecutionAsync(ActionExecutingContext context, ActionE
 public sealed class RequireSlicerServiceApiKeyAttribute : Attribute, IAsyncActionFilter
 {
     /// <summary>The header name for the per-service API key.</summary>
-    public const string HeaderName = "X-Slicer-Service-Api-Key";
+    public const string HeaderName = "X-Slicer-ApiKey";
+
+    /// <summary>Alternate service-specific header name accepted for compatibility.</summary>
+    public const string AlternateHeaderName = "X-Slicer-Service-Api-Key";
 
     /// <inheritdoc />
     public async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next)
     {
         var validator = context.HttpContext.RequestServices.GetService<ISlicerApiKeyValidator>();
         if (validator is null)
         {
-            await next();
+            if (SlicerApiKeyFilterHelpers.AllowMissingValidatorInDevelopment(context, nameof(RequireSlicerServiceApiKeyAttribute)))
+            {
+                await next();
+                return;
+            }
+
+            context.Result = new UnauthorizedObjectResult(new { error = "Slicer service API key validation is not configured." });
             return;
         }
 
-        string? apiKey = context.HttpContext.Request.Headers[HeaderName].FirstOrDefault();
-        if (!await validator.ValidateServiceKeyAsync(apiKey, context.HttpContext.RequestAborted))
+        string? apiKey = SlicerApiKeyFilterHelpers.ReadHeader(context, HeaderName, AlternateHeaderName, RequireSlicerApiKeyAttribute.AlternateHeaderName);
+        Guid? serviceId = TryGetServiceId(context);
+        if (!await validator.ValidateServiceKeyAsync(apiKey, serviceId, context.HttpContext.RequestAborted))
         {
             context.Result = new UnauthorizedObjectResult(new { error = "Invalid or missing service API key." });
             return;
         }
 
         await next();
     }
+
+    private static Guid? TryGetServiceId(ActionExecutingContext context)
+    {
+        if (context.RouteData.Values.TryGetValue("id", out object? routeId)
+            && Guid.TryParse(routeId?.ToString(), out Guid serviceId))
+        {
+            return serviceId;
+        }
+
+        return null;
+    }
+}
+
+internal static class SlicerApiKeyFilterHelpers
+{
+    public static string? ReadHeader(ActionExecutingContext context, params string[] headerNames)
+    {
+        foreach (string headerName in headerNames)
+        {
+            string? value = context.HttpContext.Request.Headers[headerName].FirstOrDefault();
+            if (!string.IsNullOrWhiteSpace(value))
+            {
+                return value;
+            }
+        }
+
+        return null;
+    }
+
+    public static bool AllowMissingValidatorInDevelopment(ActionExecutingContext context, string filterName)
+    {
+        IHostEnvironment? env = context.HttpContext.RequestServices.GetService<IHostEnvironment>();
+        ILogger? logger = context.HttpContext.RequestServices.GetService<ILoggerFactory>()?.CreateLogger(filterName);
+
+        if (env is not null && (env.IsDevelopment() || env.IsEnvironment("Testing")))
+        {
+            logger?.LogWarning("{FilterName} has no ISlicerApiKeyValidator registered; bypassing only because environment is {EnvironmentName}.", filterName, env.EnvironmentName);
+            return true;
+        }
+
+        logger?.LogError("{FilterName} has no ISlicerApiKeyValidator registered; rejecting request fail-closed.", filterName);
+        return false;
+    }
 }
 
 /// <summary>
@@ -78,5 +141,5 @@ public interface ISlicerApiKeyValidator
     Task<bool> ValidateSharedKeyAsync(string? apiKey, CancellationToken ct = default);
 
     /// <summary>Validate a per-service slicer API key.</summary>
-    Task<bool> ValidateServiceKeyAsync(string? apiKey, CancellationToken ct = default);
+    Task<bool> ValidateServiceKeyAsync(string? apiKey, Guid? serviceId, CancellationToken ct = default);
 }

src/slicer/Farm.Slicer.Module.Api/Services/SlicerApiKeyValidator.cs

@@ -0,0 +1,83 @@
+using System.Security.Cryptography;
+using System.Text;
+using Farm.Slicer.Module.Api.Filters;
+using Farm.Slicer.Module.Data;
+using Farm.Slicer.Module.Domain;
+using Farm.Slicer.Module.Services.Configuration;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+
+namespace Farm.Slicer.Module.Api.Services;
+
+/// <summary>
+/// Validates slicer registry shared keys and per-service worker keys.
+/// </summary>
+public sealed class SlicerApiKeyValidator(
+    IConfiguration configuration,
+    SlicerDbContext db,
+    IHostEnvironment env,
+    ILogger<SlicerApiKeyValidator> logger) : ISlicerApiKeyValidator
+{
+    private readonly string? _sharedKey = FirstNonBlank(
+        configuration.GetSection(WorkerAuthSettings.SectionName)["SharedKey"],
+        configuration.GetSection(WorkerAuthSettings.SectionName)["SharedApiKey"],
+        configuration["SlicerRegistry:ApiKey"],
+        Environment.GetEnvironmentVariable("WORKER_SHARED_API_KEY"),
+        Environment.GetEnvironmentVariable("SLICER_REGISTRATION_KEY"));
+
+    private readonly SlicerDbContext _db = db ?? throw new ArgumentNullException(nameof(db));
+    private readonly IHostEnvironment _env = env ?? throw new ArgumentNullException(nameof(env));
+    private readonly ILogger<SlicerApiKeyValidator> _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+
+    /// <inheritdoc />
+    public Task<bool> ValidateSharedKeyAsync(string? apiKey, CancellationToken ct = default)
+    {
+        if (string.IsNullOrWhiteSpace(_sharedKey))
+        {
+            bool bypass = _env.IsDevelopment() || _env.IsEnvironment("Testing");
+            if (bypass)
+            {
+                _logger.LogWarning("No slicer shared API key is configured; allowing request only because environment is {EnvironmentName}.", _env.EnvironmentName);
+            }
+
+            return Task.FromResult(bypass);
+        }
+
+        return Task.FromResult(FixedTimeEquals(apiKey, _sharedKey));
+    }
+
+    /// <inheritdoc />
+    public async Task<bool> ValidateServiceKeyAsync(string? apiKey, Guid? serviceId, CancellationToken ct = default)
+    {
+        if (string.IsNullOrWhiteSpace(apiKey) || serviceId is null)
+        {
+            return false;
+        }
+
+        SlicerService? service = await _db.SlicerServices
+            .AsNoTracking()
+            .FirstOrDefaultAsync(s => s.Id == serviceId.Value, ct);
+
+        return FixedTimeEquals(apiKey, service?.ApiKey);
+    }
+
+    private static bool FixedTimeEquals(string? presented, string? expected)
+    {
+        if (string.IsNullOrWhiteSpace(presented) || string.IsNullOrWhiteSpace(expected))
+        {
+            return false;
+        }
+
+        byte[] presentedBytes = Encoding.UTF8.GetBytes(presented);
+        byte[] expectedBytes = Encoding.UTF8.GetBytes(expected);
+        return presentedBytes.Length == expectedBytes.Length
+            && CryptographicOperations.FixedTimeEquals(presentedBytes, expectedBytes);
+    }
+
+    private static string? FirstNonBlank(params string?[] candidates)
+    {
+        return candidates.FirstOrDefault(candidate => !string.IsNullOrWhiteSpace(candidate));
+    }
+}

src/slicer/Farm.Slicer.Module.Api/SlicerApiExtensions.cs

@@ -56,6 +56,7 @@ public static IServiceCollection AddSlicerApiServices(this IServiceCollection se
         _ = services.AddScoped<ISlicersService, SlicersService>();
         _ = services.AddScoped<IProfilesService, ProfilesService>();
         _ = services.AddSingleton<IWorkerAuthService, WorkerAuthService>();
+        _ = services.AddScoped<Filters.ISlicerApiKeyValidator, SlicerApiKeyValidator>();
 
         // Artifact services
         _ = services.Configure<Farm.Infrastructure.Settings.ArtifactStorageSettings>(configuration.GetSection(Farm.Infrastructure.Settings.ArtifactStorageSettings.SectionName));