archetech / archon / 32401575820

95%

push

github

fix(keymaster-client): Send the admin key in the header the service reads (#906)

The server wallet demo installed the admin key as an Authorization bearer
token. The keymaster service reads X-Archon-Admin-Key and nothing else, and
that middleware sits ahead of every non-public router -- so with
ARCHON_ADMIN_API_KEY set, login succeeded (it is public) and then every call
after it 401'd. The demo only worked against a keymaster with no admin key,
which is why this went unnoticed.

KeymasterClient.connect already installs the right header from `apiKey`, so
pass it there instead of setting a header by hand.

Also correct the same header in scripts/did-resolution-benchmark.js. It is
inert today because the routes that script calls are unguarded, but a bearer
token there would silently stop working the day one of them is.

Fixes #904

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

3773 of 4247 branches covered (88.84%)

Branch coverage included in aggregate %.

8433 of 8728 relevant lines covered (96.62%)

686.98 hits per line