optimize api key queries

api/src/auth/auth.service.ts

@@ -401,6 +401,27 @@
     return this.apiKeyModel.findOne(params)
   }
 
+  /** Prefer exact masked match (see generateApiKey); fall back to legacy prefix regex. */
+  async findActiveApiKeyByClientKey(apiKeyString: string) {
+    const revokedClause = {
+      $or: [{ revokedAt: null }, { revokedAt: { $exists: false } }],
+    }
+    const prefix = apiKeyString.substring(0, 17)
+    const masked = `${prefix}${'*'.repeat(18)}`
+    const byMasked = await this.apiKeyModel.findOne({
+      apiKey: masked,
+      ...revokedClause,
+    })
+    if (byMasked) {
+      return byMasked
+    }
+    const regex = new RegExp(`^${prefix}`, 'g')
+    return this.apiKeyModel.findOne({
+      apiKey: { $regex: regex },
+      ...revokedClause,
+    })
+  }
+
   async findApiKeyById(apiKeyId: string) {
     return this.apiKeyModel.findById(apiKeyId)
   }

api/src/auth/guards/auth.guard.ts

@@ -35,11 +35,8 @@ export class AuthGuard implements CanActivate {
         )
       }
     } else if (apiKeyString) {
-      const regex = new RegExp(`^${apiKeyString.substr(0, 17)}`, 'g')
-      const apiKey = await this.authService.findApiKey({
-        apiKey: { $regex: regex },
-        $or: [{ revokedAt: null }, { revokedAt: { $exists: false } }],
-      })
+      const apiKey =
+        await this.authService.findActiveApiKeyByClientKey(apiKeyString)
 
       if (apiKey && bcrypt.compareSync(apiKeyString, apiKey.hashedApiKey)) {
         userId = apiKey.user

api/src/auth/guards/optional-auth.guard.ts

@@ -31,11 +31,8 @@ export class OptionalAuthGuard implements CanActivate {
         return true
       }
     } else if (apiKeyString) {
-      const regex = new RegExp(`^${apiKeyString.substr(0, 17)}`, 'g')
-      const apiKey = await this.authService.findApiKey({
-        apiKey: { $regex: regex },
-        $or: [{ revokedAt: null }, { revokedAt: { $exists: false } }],
-      })
+      const apiKey =
+        await this.authService.findActiveApiKeyByClientKey(apiKeyString)
 
       if (apiKey && bcrypt.compareSync(apiKeyString, apiKey.hashedApiKey)) {
         userId = apiKey.user

api/src/auth/schemas/api-key.schema.ts

@@ -31,3 +31,5 @@ export class ApiKey {
 }
 
 export const ApiKeySchema = SchemaFactory.createForClass(ApiKey)
+
+ApiKeySchema.index({ apiKey: 1 })