fix(auth): improve API key validation and authorization handling

feat(pulse-notify): add token support in event configuration and URL generation

Author: determined-001

.gitignore

@@ -4,4 +4,5 @@ dist
 build
 .next
 **/.env.local
-**/.env.development.local
+**/.env.development.local
+.claude

apps/server/src/auth.ts

@@ -8,14 +8,13 @@ export function requireApiKey(req: Request, res: Response, next: NextFunction):
     return;
   }
 
+  // Accept key via Authorization header (REST) or ?token= query param (EventSource/SSE)
   const authHeader = req.headers["authorization"];
-  if (!authHeader || !authHeader.startsWith("Bearer ")) {
-    res.status(401).json({ error: "Unauthorized" });
-    return;
-  }
+  const headerKey = authHeader?.startsWith("Bearer ") ? authHeader.slice("Bearer ".length) : null;
+  const queryKey = typeof req.query.token === "string" ? req.query.token : null;
+  const provided = headerKey ?? queryKey;
 
-  const provided = authHeader.slice("Bearer ".length);
-  if (provided !== apiKey) {
+  if (!provided || provided !== apiKey) {
     res.status(401).json({ error: "Unauthorized" });
     return;
   }

packages/pulse-notify/src/index.ts

@@ -7,6 +7,8 @@ export type UseEventConfig = {
   serverUrl: string;
   address: string;
   event?: string; // defaults to "*" — all events
+  /** API key forwarded as ?token= query param — required when the server has authentication enabled */
+  token?: string;
 };
 
 export type EventState = {
@@ -26,8 +28,9 @@ export function useStellarEvent(config: UseEventConfig): EventState {
   });
 
   useEffect(() => {
-    const { serverUrl, address, event: eventType = "*" } = config;
-    const url = `${serverUrl}/events/${address}`;
+    const { serverUrl, address, event: eventType = "*", token } = config;
+    const base = `${serverUrl}/events/${address}`;
+    const url = token ? `${base}?token=${encodeURIComponent(token)}` : base;
 
     const source = new EventSource(url);
 
@@ -60,7 +63,7 @@ export function useStellarEvent(config: UseEventConfig): EventState {
     return () => {
       source.close();
     };
-  }, [config.serverUrl, config.address, config.event]);
+  }, [config.serverUrl, config.address, config.event, config.token]);
 
   return state;
 }