From 2566c902b5968f90da8c670f33b9d92557ef1dd1 Mon Sep 17 00:00:00 2001 From: Zackary Lowery Date: Fri, 2 Oct 2026 20:19:15 -0400 Subject: [PATCH] fix(chat): return 401 without server env-var API-key fallback --- server/api/chat.post.ts | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/server/api/chat.post.ts b/server/api/chat.post.ts index f592f2b..a03ec5e 100644 --- a/server/api/chat.post.ts +++ b/server/api/chat.post.ts @@ -23,14 +23,9 @@ export default defineEventHandler(async (event) => { }) } - // Resolve API key: per-request client key takes precedence, fallback to server env - let apiKey = clientApiKey - if (!apiKey) { - if (provider === 'openai') apiKey = process.env.OPENAI_API_KEY - else if (provider === 'anthropic') apiKey = process.env.ANTHROPIC_API_KEY - else if (provider === 'google') apiKey = process.env.GEMINI_API_KEY || process.env.GOOGLE_GENERATIVE_AI_API_KEY - else if (provider === 'deepseek') apiKey = process.env.DEEPSEEK_API_KEY - } + // API keys are per-request (client-side Settings only); the server never + // reads keys from the environment (ADR 0012 full scope). + const apiKey = clientApiKey if (!apiKey) { throw createError({