[fenix007]

Summary

• Enforce REQUIRE_API_KEY and reject invalid presented keys on canonical and provider-scoped image generation routes.
• Propagate validated API-key identity through request-scoped storage so every provider-specific image call log records api_key_id and api_key_name.
• Restore per-key no-log behavior for image generation calls.

Related Issues

• No linked issue; prompted by a production call-log attribution incident.

Validation

• npm run lint
• npm run test:unit (targeted route suite passes 13/13; full suite exits 1 on unrelated baseline/platform failures described below)
• npm run test:coverage (coverage thresholds pass, but the command exits 1 on the same unrelated test failures)
• Coverage is still >= 60% for statements, lines, functions, and branches
• SonarQube PR analysis is green or any remaining issues are explicitly documented below
• npm run typecheck:core
• npm run build

Tests Added Or Updated

• tests/unit/image-generation-route.test.ts
  • rejects missing keys when REQUIRE_API_KEY=true
  • rejects invalid presented keys
  • persists API-key id/name for canonical image generation
  • covers auth and attribution on the provider-scoped route

Coverage Notes

The updated route suite exercises both authentication branches and successful call-log attribution. Full coverage completed above the configured thresholds: 83.04% statements, 83.04% lines, 87.05% functions, and 78.18% branches.

The full unit/coverage command still exits 1 on failures unrelated to this change, including CRLF-sensitive golden snapshots on this checkout and tls-profiles-valid-5591 rejecting the existing chrome_149 profile while the installed wreq-js catalog ends at chrome_147.

Reviewer Notes

Image provider handlers emit call logs in many provider-specific branches. AsyncLocalStorage keeps the validated key identity request-scoped and concurrency-safe without threading attribution arguments through each handler. Explicit call-log API-key fields still take precedence. No schema or migration changes are required.

The local Husky scripts are checked out with CRLF and cannot execute under /usr/bin/env sh; their documented commands were run manually before committing. The pre-push hook is intentionally a no-op.

[diegosouzapw]

Thanks, @fenix007! 🙏 Closing — the branch is catastrophically drifted from the current release tip (543 files / +35k/-29k, almost all base-drift), so the actual image-generation API-key-auth change is buried and can't be merged safely. A fresh focused branch against the latest release/v3.8.49 would merge cleanly — please re-open that way and I'll fast-track it.

[fenix007]

Rebuilt from the latest release/v3.8.49 tip as requested, with a focused one-commit/five-file diff: #8306.