// backend/src/api/middleware/auth.js (lines 8-9)
const DEFAULT_API_KEY = process.env.API_KEY || 'dev-api-key-change-in-production';

export function authenticate(options = { required: true }) {
  return (req, res, next) => {
    // ... validation logic using DEFAULT_API_KEY
  };
}

// backend/src/api/middleware/auth.js
const DEFAULT_API_KEY = process.env.API_KEY;

// Startup validation
if (!DEFAULT_API_KEY && process.env.NODE_ENV === 'production') {
  console.error('❌ FATAL: API_KEY environment variable is required in production');
  throw new Error('API_KEY environment variable required in production');
}

if (DEFAULT_API_KEY && DEFAULT_API_KEY.length < 32) {
  console.warn('⚠️  WARNING: API_KEY should be at least 32 characters for security');
}

// backend/src/api/middleware/auth.js
const API_KEYS = new Map([
  [process.env.API_KEY_ADMIN, { scope: 'admin', name: 'Admin Key' }],
  [process.env.API_KEY_TUI, { scope: 'tui', name: 'TUI Client' }],
  [process.env.API_KEY_BROWSER, { scope: 'browser', name: 'Browser Client' }],
  [process.env.API_KEY_READONLY, { scope: 'readonly', name: 'Read-Only Key' }]
].filter(([key]) => key)); // Remove undefined keys

export function authenticate(options = { required: true, scopes: [] }) {
  return (req, res, next) => {
    const apiKey = req.headers['x-api-key'];
    const keyInfo = API_KEYS.get(apiKey);
    
    if (!keyInfo) {
      return res.status(401).json({...});
    }
    
    // Scope validation
    if (options.scopes?.length && !options.scopes.includes(keyInfo.scope)) {
      return res.status(403).json({
        error: { message: 'Insufficient permissions' }
      });
    }
    
    req.clientId = keyInfo.name;
    req.scope = keyInfo.scope;
    next();
  };
}

// backend/src/api/middleware/auth.js
import crypto from 'crypto';

function hashApiKey(key) {
  return crypto.createHash('sha256').update(key).digest('hex').substring(0, 8);
}

// In session creation (line 45-56)
sessionData.apiKeyHash = hashApiKey(apiKey); // Don't store full key