api-key.guard.ts

import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common';
import { Request } from 'express';
import { AppConfigService } from '../../config/app-config.service';
import { HEADERS } from '../constants/headers';
import { InvalidApiKeyException } from '../exceptions/invalid-api-key.exception';

/**
 * Guards write operations. The expected key comes from typed configuration
 * (never hardcoded) and is compared against the `x-api-key` request header.
 * A missing or wrong key yields a 401.
 */
@Injectable()
export class ApiKeyGuard implements CanActivate {
  constructor(private readonly config: AppConfigService) {}

  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest<Request>();
    const provided = request.header(HEADERS.ApiKey);

    if (!provided || provided !== this.config.apiKey) {
      throw new InvalidApiKeyException();
    }
    return true;
  }
}