fix(api): require scraper API key for POST /ai/process

Batch summarization+embedding is an ops job, not an end-user feature.
Any signed-in JWT could previously trigger OpenAI spend. Protect the
route with ScraperKeyGuard (SCRAPER_API_KEY), same as POST /scraper/run.
Update Bruno docs and add e2e coverage that rejects missing auth, user
JWTs, and wrong keys.

Author: zavxai

apps/api/src/ai/ai.controller.ts

@@ -1,12 +1,18 @@
 import { Controller, Post, UseGuards } from '@nestjs/common';
 import { AiService } from './ai.service';
-import { JwtAuthGuard } from '../auth/jwt-auth.guard';
+import { ScraperKeyGuard } from '../scraper/scraper-key.guard';
 
 @Controller('ai')
 export class AiController {
   constructor(private readonly aiService: AiService) {}
 
-  @UseGuards(JwtAuthGuard)
+  /**
+   * Ops-only batch job: summarize + embed articles that still lack a summary.
+   * Protected with SCRAPER_API_KEY (same trust model as POST /scraper/run) so
+   * any signed-in end user cannot burn OpenAI quota by calling this repeatedly.
+   * Normal summarization also runs via cron and POST /scraper/run.
+   */
+  @UseGuards(ScraperKeyGuard)
   @Post('process')
   async process() {
     const result = await this.aiService.processUnsummarized();

apps/api/src/ai/ai.module.ts

@@ -1,11 +1,10 @@
-import { Module, forwardRef } from '@nestjs/common';
+import { Module } from '@nestjs/common';
 import { AiService } from './ai.service';
 import { AiController } from './ai.controller';
-import { AuthModule } from '../auth/auth.module';
+import { ScraperKeyGuard } from '../scraper/scraper-key.guard';
 
 @Module({
-  imports: [forwardRef(() => AuthModule)],
-  providers: [AiService],
+  providers: [AiService, ScraperKeyGuard],
   controllers: [AiController],
   exports: [AiService],
 })

apps/api/test/app.e2e-spec.ts

@@ -8,6 +8,7 @@ import { AppService } from '../src/app.service';
 
 import { ScraperController } from '../src/scraper/scraper.controller';
 import { ScraperService, ScrapeResult } from '../src/scraper/scraper.service';
+import { AiController } from '../src/ai/ai.controller';
 import { AiService } from '../src/ai/ai.service';
 import { FeedController } from '../src/feed/feed.controller';
 import { FeedService, FeedResponse } from '../src/feed/feed.service';
@@ -131,6 +132,68 @@ describe('API E2E (isolated modules)', () => {
     });
   });
 
+  describe('Ops-only AI process (AiController + ScraperKeyGuard)', () => {
+    let aiService: jest.Mocked<AiService>;
+
+    beforeEach(async () => {
+      aiService = {
+        processUnsummarized: jest.fn(),
+      } as any;
+
+      const moduleFixture: TestingModule = await Test.createTestingModule({
+        controllers: [AiController],
+        providers: [{ provide: AiService, useValue: aiService }],
+      }).compile();
+
+      app = moduleFixture.createNestApplication();
+      app.useGlobalPipes(
+        new ValidationPipe({ whitelist: true, transform: true }),
+      );
+      await app.init();
+    });
+
+    afterEach(async () => {
+      await app.close();
+    });
+
+    it('POST /ai/process requires SCRAPER_API_KEY (rejects missing, JWT, wrong key)', async () => {
+      const origKey = process.env.SCRAPER_API_KEY;
+      process.env.SCRAPER_API_KEY = 'test-scraper-key-xyz';
+
+      (aiService.processUnsummarized as jest.Mock).mockResolvedValue({
+        processed: 3,
+        failed: 0,
+      });
+
+      // no auth
+      await request(app.getHttpServer()).post('/ai/process').expect(401);
+
+      // user JWT must not work (this is ops-only, not end-user)
+      const { authHeader } = await getTestAuthContextForE2E();
+      await request(app.getHttpServer())
+        .post('/ai/process')
+        .set('Authorization', authHeader)
+        .expect(401);
+
+      // wrong scraper key
+      await request(app.getHttpServer())
+        .post('/ai/process')
+        .set('Authorization', 'Bearer wrong-key')
+        .expect(401);
+
+      // valid scraper key
+      await request(app.getHttpServer())
+        .post('/ai/process')
+        .set('Authorization', 'Bearer test-scraper-key-xyz')
+        .expect(201)
+        .expect({ processed: 3, failed: 0 });
+
+      expect(aiService.processUnsummarized).toHaveBeenCalledTimes(1);
+
+      process.env.SCRAPER_API_KEY = origKey;
+    });
+  });
+
   describe('Protected feed (JwtAuthGuard + FeedController)', () => {
     let feedService: jest.Mocked<FeedService>;
 

bruno/Process Summaries.bru

@@ -9,3 +9,8 @@ post {
   body: none
   auth: none
 }
+
+headers {
+  Authorization: Bearer {{scraperKey}}
+}
+

bruno/README.md

@@ -97,16 +97,17 @@ Constraints: `message` max 500 chars, `history` max 20 turns, each `content` max
 
 ### Process Summaries
 Manually trigger summarization + embedding for articles that have content but no summary yet.
+Ops-only — same key as the scraper (not a user JWT).
 
 ```
 POST /ai/process
-Authorization: Bearer {{authToken}}
+Authorization: Bearer {{scraperKey}}
 ```
 
 ---
 
 ## Notes
 
-- The scraper endpoint requires `SCRAPER_API_KEY` (not a user JWT). Set it as `scraperKey` in your Bruno environment.
+- The scraper and AI process endpoints require `SCRAPER_API_KEY` (not a user JWT). Set it as `scraperKey` in your Bruno environment.
 - Chat history `role` must be `"user"` or `"assistant"` — `"system"` is rejected at the API boundary.
 - Render's free tier sleeps after inactivity; the first request after a cold start may take ~30s.