API Authentication Updates (2.0 edition)

[thejudge22]

Add Dual Authentication (Session + API Key) to All API Endpoints

Summary

This PR adds dual authentication support to all API endpoints, allowing users to authenticate using either session cookies (existing web UI behavior) or API keys via Bearer tokens (Authorization: Bearer nc_...).

Changes

New File

• src/lib/backend/auth-utils.ts - Shared authentication utilities
  • getAuthenticatedUserId(request) - Tries API key first, falls back to session cookie
  • tryGetAuthenticatedUserId(request) - Returns undefined instead of throwing for optional auth
  • getUserIdFromApiKey(authHeader) - Validates Bearer token and returns userId

Updated Endpoints (28 files)

Category	Endpoints
Assistants	GET, POST /api/assistants • PATCH, DELETE, POST /api/assistants/[id]
Projects	CRUD on /api/projects, /api/projects/[id], /api/projects/[id]/files, /api/projects/[id]/members
Database	conversations, messages, message-interactions, message-ratings, user-settings, user-keys, user-rules, user-models, model-performance
Storage	POST, DELETE /api/storage
Utilities	cancel-generation, enhance-prompt, cleanup-temp-conversations, generate-follow-up-questions
NanoGPT	balance, subscription-usage, model-providers, provider-preferences
User	upload-avatar, karakeep/save-chat, api-keys

Documentation

• Updated api-docs.md - Changed 46+ endpoint authentication labels to "Session or API Key"

Excluded Endpoints (Intentional)

Endpoint	Reason
/api/tts, /api/stt, /api/video/*	Use x-api-key for NanoGPT API, optional session for analytics
/api/storage/[id]	Public file serving (no auth required)
/api/artificial-analysis/benchmarks	Public endpoint
/api/generate-message	Already had dual auth (reference implementation)
/api/auth/*	Auth handler (login/signup)

Testing

# Test with API key
curl -X GET "http://localhost:3432/api/assistants" \
  -H "Authorization: Bearer nc_your_api_key"

# Test with session cookie (existing behavior)
curl -X GET "http://localhost:3432/api/assistants" \
  -b "session_cookie=your_session"

Verification

• ✅ npm run build passes
• ✅ All existing session-based authentication continues to work
• ✅ API key authentication works for all updated endpoints