@fintekkers/ledger-models 0.4.13 → 0.4.15

package/node/wrappers/models/utils/requestcontext.auth.test.js

@@ -0,0 +1,182 @@
+"use strict";
+/**
+ * Unit tests for Issue #114: API key support in EnvConfig.
+ *
+ * No network access: grpc-js credential factories are spied on and the
+ * metadata generator / interceptor are invoked directly.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const grpc = __importStar(require("@grpc/grpc-js"));
+const requestcontext_1 = __importStar(require("./requestcontext"));
+const savedApiUrl = process.env.API_URL;
+const savedApiKey = process.env.API_KEY;
+function restoreEnv(name, value) {
+    if (value === undefined) {
+        delete process.env[name];
+    }
+    else {
+        process.env[name] = value;
+    }
+}
+beforeEach(() => {
+    restoreEnv('API_URL', undefined);
+    restoreEnv('API_KEY', undefined);
+});
+afterEach(() => {
+    restoreEnv('API_URL', savedApiUrl);
+    restoreEnv('API_KEY', savedApiKey);
+    jest.restoreAllMocks();
+});
+describe('EnvConfig.apiURL', () => {
+    test('uses API_URL as-is when it includes a port', () => {
+        process.env.API_URL = 'localhost:80';
+        expect(requestcontext_1.default.apiURL).toBe('localhost:80');
+    });
+    test('appends :8082 when API_URL has no port', () => {
+        process.env.API_URL = 'localhost';
+        expect(requestcontext_1.default.apiURL).toBe('localhost:8082');
+    });
+    test('defaults to api.fintekkers.org:8082 when API_URL is unset', () => {
+        expect(requestcontext_1.default.apiURL).toBe('api.fintekkers.org:8082');
+    });
+});
+describe('EnvConfig.apiKey', () => {
+    test('returns API_KEY when set', () => {
+        process.env.API_KEY = 'k';
+        expect(requestcontext_1.default.apiKey).toBe('k');
+    });
+    test('returns undefined when unset, without throwing', () => {
+        expect(() => requestcontext_1.default.apiKey).not.toThrow();
+        expect(requestcontext_1.default.apiKey).toBeUndefined();
+    });
+});
+describe('EnvConfig.apiCredentials', () => {
+    test.each(['localhost:80', '127.0.0.1:8085'])('uses insecure credentials for %s', (url) => {
+        process.env.API_URL = url;
+        const insecure = jest.spyOn(grpc.credentials, 'createInsecure');
+        const ssl = jest.spyOn(grpc.credentials, 'createSsl');
+        requestcontext_1.default.apiCredentials;
+        expect(insecure).toHaveBeenCalledTimes(1);
+        expect(ssl).not.toHaveBeenCalled();
+    });
+    test('uses SSL credentials when API_URL is unset', () => {
+        const insecure = jest.spyOn(grpc.credentials, 'createInsecure');
+        const ssl = jest.spyOn(grpc.credentials, 'createSsl');
+        requestcontext_1.default.apiCredentials;
+        expect(ssl).toHaveBeenCalledTimes(1);
+        expect(insecure).not.toHaveBeenCalled();
+    });
+});
+describe('EnvConfig.getAuthenticatedCredentials', () => {
+    test('metadata generator injects x-api-key', () => {
+        const generatorSpy = jest.spyOn(grpc.credentials, 'createFromMetadataGenerator');
+        const creds = requestcontext_1.default.getAuthenticatedCredentials('k');
+        expect(creds).toBeInstanceOf(grpc.ChannelCredentials);
+        expect(generatorSpy).toHaveBeenCalledTimes(1);
+        const generator = generatorSpy.mock.calls[0][0];
+        const callback = jest.fn();
+        generator({ service_url: 'https://api.fintekkers.org:8082' }, callback);
+        expect(callback).toHaveBeenCalledTimes(1);
+        const [err, metadata] = callback.mock.calls[0];
+        expect(err).toBeNull();
+        expect(metadata.get('x-api-key')).toEqual(['k']);
+    });
+    test.each(['localhost:80', '127.0.0.1:8085'])('throws InsecureChannelAuthError without leaking the key for %s', (url) => {
+        process.env.API_URL = url;
+        const secret = 'dummy-secret-123';
+        let caught;
+        try {
+            requestcontext_1.default.getAuthenticatedCredentials(secret);
+        }
+        catch (e) {
+            caught = e;
+        }
+        expect(caught).toBeInstanceOf(requestcontext_1.InsecureChannelAuthError);
+        const err = caught;
+        expect(err.message).not.toContain(secret);
+        expect(String(err)).not.toContain(secret);
+    });
+    test('never logs the key', () => {
+        const secret = 'dummy-secret-123';
+        const spies = [
+            jest.spyOn(console, 'log').mockImplementation(() => { }),
+            jest.spyOn(console, 'warn').mockImplementation(() => { }),
+            jest.spyOn(console, 'error').mockImplementation(() => { }),
+        ];
+        const generatorSpy = jest.spyOn(grpc.credentials, 'createFromMetadataGenerator');
+        requestcontext_1.default.getAuthenticatedCredentials(secret);
+        generatorSpy.mock.calls[0][0]({ service_url: '' }, () => { });
+        process.env.API_URL = 'localhost:80';
+        requestcontext_1.default.getAuthenticatedClientOptions(secret);
+        for (const spy of spies) {
+            for (const args of spy.mock.calls) {
+                expect(args.map(String).join(' ')).not.toContain(secret);
+            }
+        }
+    });
+});
+describe('EnvConfig.getAuthenticatedClientOptions', () => {
+    test.each(['localhost:80', '127.0.0.1:8085'])('uses insecure channel for %s', (url) => {
+        process.env.API_URL = url;
+        const insecure = jest.spyOn(grpc.credentials, 'createInsecure');
+        const ssl = jest.spyOn(grpc.credentials, 'createSsl');
+        const { interceptors } = requestcontext_1.default.getAuthenticatedClientOptions('k');
+        expect(insecure).toHaveBeenCalledTimes(1);
+        expect(ssl).not.toHaveBeenCalled();
+        expect(interceptors).toHaveLength(1);
+    });
+    test('uses SSL channel for api.fintekkers.org', () => {
+        process.env.API_URL = 'api.fintekkers.org';
+        const insecure = jest.spyOn(grpc.credentials, 'createInsecure');
+        const ssl = jest.spyOn(grpc.credentials, 'createSsl');
+        const { interceptors } = requestcontext_1.default.getAuthenticatedClientOptions('k');
+        expect(ssl).toHaveBeenCalledTimes(1);
+        expect(insecure).not.toHaveBeenCalled();
+        expect(interceptors).toHaveLength(0);
+    });
+    test('local interceptor injects x-api-key on start', () => {
+        process.env.API_URL = 'localhost:80';
+        const { interceptors } = requestcontext_1.default.getAuthenticatedClientOptions('k');
+        const nextStart = jest.fn();
+        const fakeNextCall = {
+            start: nextStart,
+            cancelWithStatus: jest.fn(),
+            getPeer: jest.fn(),
+            sendMessageWithContext: jest.fn(),
+            sendMessage: jest.fn(),
+            startRead: jest.fn(),
+            halfClose: jest.fn(),
+            setCredentials: jest.fn(),
+        };
+        const nextCall = jest.fn(() => fakeNextCall);
+        const call = interceptors[0]({}, nextCall);
+        call.start(new grpc.Metadata(), {});
+        expect(nextStart).toHaveBeenCalledTimes(1);
+        const sentMetadata = nextStart.mock.calls[0][0];
+        expect(sentMetadata.get('x-api-key')).toEqual(['k']);
+    });
+});
+//# sourceMappingURL=requestcontext.auth.test.js.map

package/node/wrappers/models/utils/requestcontext.auth.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestcontext.auth.test.js","sourceRoot":"","sources":["requestcontext.auth.test.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,oDAAsC;AACtC,mEAAuE;AAEvE,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;AACxC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;AAExC,SAAS,UAAU,CAAC,IAAY,EAAE,KAAyB;IACzD,IAAI,KAAK,KAAK,SAAS,EAAE;QACvB,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;KAC1B;SAAM;QACL,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;KAC3B;AACH,CAAC;AAED,UAAU,CAAC,GAAG,EAAE;IACd,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACjC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACnC,UAAU,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACnC,IAAI,CAAC,eAAe,EAAE,CAAC;AACzB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,IAAI,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACtD,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,cAAc,CAAC;QACrC,MAAM,CAAC,wBAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAClD,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,WAAW,CAAC;QAClC,MAAM,CAAC,wBAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACrE,MAAM,CAAC,wBAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,IAAI,CAAC,0BAA0B,EAAE,GAAG,EAAE;QACpC,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC;QAC1B,MAAM,CAAC,wBAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gDAAgD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,GAAG,EAAE,CAAC,wBAAS,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC7C,MAAM,CAAC,wBAAS,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC,kCAAkC,EAAE,CAAC,GAAG,EAAE,EAAE;QACxF,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAEtD,wBAAS,CAAC,cAAc,CAAC;QAEzB,MAAM,CAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAEtD,wBAAS,CAAC,cAAc,CAAC;QAEzB,MAAM,CAAC,GAAG,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,IAAI,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAChD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAC;QAEjF,MAAM,KAAK,GAAG,wBAAS,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;QAEzD,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACtD,MAAM,CAAC,YAAY,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAE9C,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;QAC3B,SAAS,CAAC,EAAE,WAAW,EAAE,iCAAiC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAExE,MAAM,CAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QACvB,MAAM,CAAE,QAA0B,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAC3C,gEAAgE,EAChE,CAAC,GAAG,EAAE,EAAE;QACN,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC;QAC1B,MAAM,MAAM,GAAG,kBAAkB,CAAC;QAElC,IAAI,MAAe,CAAC;QACpB,IAAI;YACF,wBAAS,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;SAC/C;QAAC,OAAO,CAAC,EAAE;YACV,MAAM,GAAG,CAAC,CAAC;SACZ;QAED,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,yCAAwB,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,MAAe,CAAC;QAC5B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC,CACF,CAAC;IAEF,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAC9B,MAAM,MAAM,GAAG,kBAAkB,CAAC;QAClC,MAAM,KAAK,GAAG;YACZ,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;YACvD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;YACxD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;SAC1D,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,6BAA6B,CAAC,CAAC;QAEjF,wBAAS,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;QAC9C,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,cAAc,CAAC;QACrC,wBAAS,CAAC,6BAA6B,CAAC,MAAM,CAAC,CAAC;QAEhD,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE;YACvB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE;gBACjC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;aAC1D;SACF;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yCAAyC,EAAE,GAAG,EAAE;IACvD,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC,8BAA8B,EAAE,CAAC,GAAG,EAAE,EAAE;QACpF,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAEtD,MAAM,EAAE,YAAY,EAAE,GAAG,wBAAS,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;QAEtE,MAAM,CAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACnC,MAAM,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACnD,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,oBAAoB,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QAEtD,MAAM,EAAE,YAAY,EAAE,GAAG,wBAAS,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;QAEtE,MAAM,CAAC,GAAG,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACxC,MAAM,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACxD,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,cAAc,CAAC;QACrC,MAAM,EAAE,YAAY,EAAE,GAAG,wBAAS,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC;QAEtE,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG;YACnB,KAAK,EAAE,SAAS;YAChB,gBAAgB,EAAE,IAAI,CAAC,EAAE,EAAE;YAC3B,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE;YAClB,sBAAsB,EAAE,IAAI,CAAC,EAAE,EAAE;YACjC,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE;YACtB,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE;YACpB,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE;YACpB,cAAc,EAAE,IAAI,CAAC,EAAE,EAAE;SACU,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC;QAE7C,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,EAA6B,EAAE,QAAQ,CAAC,CAAC;QACtE,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QAEpC,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAkB,CAAC;QACjE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/node/wrappers/models/utils/requestcontext.auth.test.ts

@@ -0,0 +1,194 @@
+/**
+ * Unit tests for Issue #114: API key support in EnvConfig.
+ *
+ * No network access: grpc-js credential factories are spied on and the
+ * metadata generator / interceptor are invoked directly.
+ */
+
+import * as grpc from '@grpc/grpc-js';
+import EnvConfig, { InsecureChannelAuthError } from './requestcontext';
+
+const savedApiUrl = process.env.API_URL;
+const savedApiKey = process.env.API_KEY;
+
+function restoreEnv(name: string, value: string | undefined) {
+  if (value === undefined) {
+    delete process.env[name];
+  } else {
+    process.env[name] = value;
+  }
+}
+
+beforeEach(() => {
+  restoreEnv('API_URL', undefined);
+  restoreEnv('API_KEY', undefined);
+});
+
+afterEach(() => {
+  restoreEnv('API_URL', savedApiUrl);
+  restoreEnv('API_KEY', savedApiKey);
+  jest.restoreAllMocks();
+});
+
+describe('EnvConfig.apiURL', () => {
+  test('uses API_URL as-is when it includes a port', () => {
+    process.env.API_URL = 'localhost:80';
+    expect(EnvConfig.apiURL).toBe('localhost:80');
+  });
+
+  test('appends :8082 when API_URL has no port', () => {
+    process.env.API_URL = 'localhost';
+    expect(EnvConfig.apiURL).toBe('localhost:8082');
+  });
+
+  test('defaults to api.fintekkers.org:8082 when API_URL is unset', () => {
+    expect(EnvConfig.apiURL).toBe('api.fintekkers.org:8082');
+  });
+});
+
+describe('EnvConfig.apiKey', () => {
+  test('returns API_KEY when set', () => {
+    process.env.API_KEY = 'k';
+    expect(EnvConfig.apiKey).toBe('k');
+  });
+
+  test('returns undefined when unset, without throwing', () => {
+    expect(() => EnvConfig.apiKey).not.toThrow();
+    expect(EnvConfig.apiKey).toBeUndefined();
+  });
+});
+
+describe('EnvConfig.apiCredentials', () => {
+  test.each(['localhost:80', '127.0.0.1:8085'])('uses insecure credentials for %s', (url) => {
+    process.env.API_URL = url;
+    const insecure = jest.spyOn(grpc.credentials, 'createInsecure');
+    const ssl = jest.spyOn(grpc.credentials, 'createSsl');
+
+    EnvConfig.apiCredentials;
+
+    expect(insecure).toHaveBeenCalledTimes(1);
+    expect(ssl).not.toHaveBeenCalled();
+  });
+
+  test('uses SSL credentials when API_URL is unset', () => {
+    const insecure = jest.spyOn(grpc.credentials, 'createInsecure');
+    const ssl = jest.spyOn(grpc.credentials, 'createSsl');
+
+    EnvConfig.apiCredentials;
+
+    expect(ssl).toHaveBeenCalledTimes(1);
+    expect(insecure).not.toHaveBeenCalled();
+  });
+});
+
+describe('EnvConfig.getAuthenticatedCredentials', () => {
+  test('metadata generator injects x-api-key', () => {
+    const generatorSpy = jest.spyOn(grpc.credentials, 'createFromMetadataGenerator');
+
+    const creds = EnvConfig.getAuthenticatedCredentials('k');
+
+    expect(creds).toBeInstanceOf(grpc.ChannelCredentials);
+    expect(generatorSpy).toHaveBeenCalledTimes(1);
+
+    const generator = generatorSpy.mock.calls[0][0];
+    const callback = jest.fn();
+    generator({ service_url: 'https://api.fintekkers.org:8082' }, callback);
+
+    expect(callback).toHaveBeenCalledTimes(1);
+    const [err, metadata] = callback.mock.calls[0];
+    expect(err).toBeNull();
+    expect((metadata as grpc.Metadata).get('x-api-key')).toEqual(['k']);
+  });
+
+  test.each(['localhost:80', '127.0.0.1:8085'])(
+    'throws InsecureChannelAuthError without leaking the key for %s',
+    (url) => {
+      process.env.API_URL = url;
+      const secret = 'dummy-secret-123';
+
+      let caught: unknown;
+      try {
+        EnvConfig.getAuthenticatedCredentials(secret);
+      } catch (e) {
+        caught = e;
+      }
+
+      expect(caught).toBeInstanceOf(InsecureChannelAuthError);
+      const err = caught as Error;
+      expect(err.message).not.toContain(secret);
+      expect(String(err)).not.toContain(secret);
+    }
+  );
+
+  test('never logs the key', () => {
+    const secret = 'dummy-secret-123';
+    const spies = [
+      jest.spyOn(console, 'log').mockImplementation(() => {}),
+      jest.spyOn(console, 'warn').mockImplementation(() => {}),
+      jest.spyOn(console, 'error').mockImplementation(() => {}),
+    ];
+    const generatorSpy = jest.spyOn(grpc.credentials, 'createFromMetadataGenerator');
+
+    EnvConfig.getAuthenticatedCredentials(secret);
+    generatorSpy.mock.calls[0][0]({ service_url: '' }, () => {});
+    process.env.API_URL = 'localhost:80';
+    EnvConfig.getAuthenticatedClientOptions(secret);
+
+    for (const spy of spies) {
+      for (const args of spy.mock.calls) {
+        expect(args.map(String).join(' ')).not.toContain(secret);
+      }
+    }
+  });
+});
+
+describe('EnvConfig.getAuthenticatedClientOptions', () => {
+  test.each(['localhost:80', '127.0.0.1:8085'])('uses insecure channel for %s', (url) => {
+    process.env.API_URL = url;
+    const insecure = jest.spyOn(grpc.credentials, 'createInsecure');
+    const ssl = jest.spyOn(grpc.credentials, 'createSsl');
+
+    const { interceptors } = EnvConfig.getAuthenticatedClientOptions('k');
+
+    expect(insecure).toHaveBeenCalledTimes(1);
+    expect(ssl).not.toHaveBeenCalled();
+    expect(interceptors).toHaveLength(1);
+  });
+
+  test('uses SSL channel for api.fintekkers.org', () => {
+    process.env.API_URL = 'api.fintekkers.org';
+    const insecure = jest.spyOn(grpc.credentials, 'createInsecure');
+    const ssl = jest.spyOn(grpc.credentials, 'createSsl');
+
+    const { interceptors } = EnvConfig.getAuthenticatedClientOptions('k');
+
+    expect(ssl).toHaveBeenCalledTimes(1);
+    expect(insecure).not.toHaveBeenCalled();
+    expect(interceptors).toHaveLength(0);
+  });
+
+  test('local interceptor injects x-api-key on start', () => {
+    process.env.API_URL = 'localhost:80';
+    const { interceptors } = EnvConfig.getAuthenticatedClientOptions('k');
+
+    const nextStart = jest.fn();
+    const fakeNextCall = {
+      start: nextStart,
+      cancelWithStatus: jest.fn(),
+      getPeer: jest.fn(),
+      sendMessageWithContext: jest.fn(),
+      sendMessage: jest.fn(),
+      startRead: jest.fn(),
+      halfClose: jest.fn(),
+      setCredentials: jest.fn(),
+    } as unknown as grpc.InterceptingCall;
+    const nextCall = jest.fn(() => fakeNextCall);
+
+    const call = interceptors[0]({} as grpc.InterceptorOptions, nextCall);
+    call.start(new grpc.Metadata(), {});
+
+    expect(nextStart).toHaveBeenCalledTimes(1);
+    const sentMetadata = nextStart.mock.calls[0][0] as grpc.Metadata;
+    expect(sentMetadata.get('x-api-key')).toEqual(['k']);
+  });
+});

package/node/wrappers/models/utils/requestcontext.d.ts

@@ -9,19 +9,36 @@ declare class EnvConfig {
      * otherwise :8082 is appended for backward compatibility.
      */
     static get apiURL(): string;
+    private static get isLocalURL();
     static get apiCredentials(): grpc.ChannelCredentials;
+    private static addApiKey;
     /**
-     * Returns channel credentials that inject `x-api-key: <apiKey>` into every
-     * call's metadata. Uses insecure transport for localhost, SSL otherwise.
+     * Returns SSL channel credentials combined with per-call credentials that
+     * inject `x-api-key: <apiKey>` into every call's metadata.
+     *
+     * Remote (SSL) hosts only: grpc-js cannot compose call credentials with
+     * insecure channel credentials. For localhost / 127.0.0.1 use
+     * {@link EnvConfig.getAuthenticatedClientOptions}, which sends the key via
+     * an interceptor instead.
+     *
+     * @throws {InsecureChannelAuthError} when apiURL is localhost / 127.0.0.1.
      */
+    static getAuthenticatedCredentials(apiKey: string): grpc.ChannelCredentials;
     /**
      * Returns credentials and interceptors for authenticated calls.
      * For local (insecure) channels, injects the API key via an interceptor.
-     * For remote (SSL) channels, uses combined channel + call credentials.
+     * For remote (SSL) channels, uses {@link EnvConfig.getAuthenticatedCredentials}.
      */
     static getAuthenticatedClientOptions(apiKey: string): {
         credentials: grpc.ChannelCredentials;
         interceptors: grpc.Interceptor[];
     };
 }
+/**
+ * Thrown by EnvConfig.getAuthenticatedCredentials when API_URL points at an
+ * insecure (local) channel. The message never includes the API key.
+ */
+export declare class InsecureChannelAuthError extends Error {
+    constructor();
+}
 export default EnvConfig;

package/node/wrappers/models/utils/requestcontext.js

@@ -23,6 +23,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
     return result;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.InsecureChannelAuthError = void 0;
 const dotenv = __importStar(require("dotenv"));
 dotenv.config();
 const grpc = __importStar(require("@grpc/grpc-js"));
@@ -50,46 +51,76 @@ class EnvConfig {
         const base = EnvConfig.getEnvVar('API_URL', 'api.fintekkers.org');
         return /:\d+$/.test(base) ? base : base + ':8082';
     }
+    static get isLocalURL() {
+        return /^localhost|^127\.0\.0\.1/.test(this.apiURL);
+    }
     static get apiCredentials() {
-        if (/^localhost|^127\.0\.0\.1/.test(this.apiURL)) {
+        if (this.isLocalURL) {
             return grpc.credentials.createInsecure();
         }
         else {
             return grpc.credentials.createSsl();
         }
     }
+    static addApiKey(metadata, apiKey) {
+        metadata.add('x-api-key', apiKey);
+    }
     /**
-     * Returns channel credentials that inject `x-api-key: <apiKey>` into every
-     * call's metadata. Uses insecure transport for localhost, SSL otherwise.
+     * Returns SSL channel credentials combined with per-call credentials that
+     * inject `x-api-key: <apiKey>` into every call's metadata.
+     *
+     * Remote (SSL) hosts only: grpc-js cannot compose call credentials with
+     * insecure channel credentials. For localhost / 127.0.0.1 use
+     * {@link EnvConfig.getAuthenticatedClientOptions}, which sends the key via
+     * an interceptor instead.
+     *
+     * @throws {InsecureChannelAuthError} when apiURL is localhost / 127.0.0.1.
      */
+    static getAuthenticatedCredentials(apiKey) {
+        if (this.isLocalURL) {
+            throw new InsecureChannelAuthError();
+        }
+        const callCreds = grpc.credentials.createFromMetadataGenerator((_params, callback) => {
+            const metadata = new grpc.Metadata();
+            EnvConfig.addApiKey(metadata, apiKey);
+            callback(null, metadata);
+        });
+        return grpc.credentials.combineChannelCredentials(grpc.credentials.createSsl(), callCreds);
+    }
     /**
      * Returns credentials and interceptors for authenticated calls.
      * For local (insecure) channels, injects the API key via an interceptor.
-     * For remote (SSL) channels, uses combined channel + call credentials.
+     * For remote (SSL) channels, uses {@link EnvConfig.getAuthenticatedCredentials}.
      */
     static getAuthenticatedClientOptions(apiKey) {
-        const isLocal = /^localhost|^127\.0\.0\.1/.test(this.apiURL);
-        if (isLocal) {
+        if (this.isLocalURL) {
             const interceptor = (_options, nextCall) => {
                 return new grpc.InterceptingCall(nextCall(_options), {
                     start(metadata, listener, next) {
-                        metadata.add('x-api-key', apiKey);
+                        EnvConfig.addApiKey(metadata, apiKey);
                         next(metadata, listener);
                     }
                 });
             };
             return { credentials: grpc.credentials.createInsecure(), interceptors: [interceptor] };
         }
-        const callCreds = grpc.credentials.createFromMetadataGenerator((_params, callback) => {
-            const metadata = new grpc.Metadata();
-            metadata.add('x-api-key', apiKey);
-            callback(null, metadata);
-        });
         return {
-            credentials: grpc.credentials.combineChannelCredentials(grpc.credentials.createSsl(), callCreds),
+            credentials: EnvConfig.getAuthenticatedCredentials(apiKey),
             interceptors: []
         };
     }
 }
+/**
+ * Thrown by EnvConfig.getAuthenticatedCredentials when API_URL points at an
+ * insecure (local) channel. The message never includes the API key.
+ */
+class InsecureChannelAuthError extends Error {
+    constructor() {
+        super('API key auth over an insecure channel requires getAuthenticatedClientOptions()');
+        this.name = 'InsecureChannelAuthError';
+        Object.setPrototypeOf(this, InsecureChannelAuthError.prototype);
+    }
+}
+exports.InsecureChannelAuthError = InsecureChannelAuthError;
 exports.default = EnvConfig;
 //# sourceMappingURL=requestcontext.js.map

package/node/wrappers/models/utils/requestcontext.js.map

@@ -1 +1 @@
-{"version":3,"file":"requestcontext.js","sourceRoot":"","sources":["requestcontext.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+CAAiC;AACjC,MAAM,CAAC,MAAM,EAAE,CAAC;AAEhB,oDAAsC;AAEtC,MAAM,SAAS;IACL,MAAM,CAAC,SAAS,CAAC,GAAW,EAAE,YAAqB;QACzD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,SAAS,EAAE;YACvB,IAAI,YAAY,KAAK,SAAS,EAAE;gBAC9B,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,cAAc,CAAC,CAAC;aAC5D;YACD,OAAO,YAAY,CAAC;SACrB;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,MAAM;QACf,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,MAAM,KAAK,MAAM;QACf,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;QAClE,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC;IACpD,CAAC;IAED,MAAM,KAAK,cAAc;QACvB,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YAChD,OAAO,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC;SAC1C;aACI;YACH,OAAO,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;SACrC;IACH,CAAC;IAED;;;OAGG;IACH;;;;OAIG;IACH,MAAM,CAAC,6BAA6B,CAAC,MAAc;QAIjD,MAAM,OAAO,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,OAAO,EAAE;YACX,MAAM,WAAW,GAAqB,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;gBAC3D,OAAO,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;oBACnD,KAAK,CAAC,QAAuB,EAAE,QAAuB,EAAE,IAAc;wBACpE,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;wBAClC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;oBAC3B,CAAC;iBACF,CAAC,CAAC;YACL,CAAC,CAAC;YACF,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;SACxF;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,2BAA2B,CAC5D,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YACpB,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAClC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC3B,CAAC,CACF,CAAC;QACF,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,yBAAyB,CACrD,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,EAC5B,SAAS,CACV;YACD,YAAY,EAAE,EAAE;SACjB,CAAC;IACJ,CAAC;CACF;AAED,kBAAe,SAAS,CAAC"}
+{"version":3,"file":"requestcontext.js","sourceRoot":"","sources":["requestcontext.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,+CAAiC;AACjC,MAAM,CAAC,MAAM,EAAE,CAAC;AAEhB,oDAAsC;AAEtC,MAAM,SAAS;IACL,MAAM,CAAC,SAAS,CAAC,GAAW,EAAE,YAAqB;QACzD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,SAAS,EAAE;YACvB,IAAI,YAAY,KAAK,SAAS,EAAE;gBAC9B,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,cAAc,CAAC,CAAC;aAC5D;YACD,OAAO,YAAY,CAAC;SACrB;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,MAAM;QACf,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACH,MAAM,KAAK,MAAM;QACf,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;QAClE,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,OAAO,CAAC;IACpD,CAAC;IAEO,MAAM,KAAK,UAAU;QAC3B,OAAO,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,KAAK,cAAc;QACvB,IAAI,IAAI,CAAC,UAAU,EAAE;YACnB,OAAO,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC;SAC1C;aACI;YACH,OAAO,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;SACrC;IACH,CAAC;IAEO,MAAM,CAAC,SAAS,CAAC,QAAuB,EAAE,MAAc;QAC9D,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAED;;;;;;;;;;OAUG;IACH,MAAM,CAAC,2BAA2B,CAAC,MAAc;QAC/C,IAAI,IAAI,CAAC,UAAU,EAAE;YACnB,MAAM,IAAI,wBAAwB,EAAE,CAAC;SACtC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,2BAA2B,CAC5D,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YACpB,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACtC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC3B,CAAC,CACF,CAAC;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,yBAAyB,CAC/C,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,EAC5B,SAAS,CACV,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,6BAA6B,CAAC,MAAc;QAIjD,IAAI,IAAI,CAAC,UAAU,EAAE;YACnB,MAAM,WAAW,GAAqB,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE;gBAC3D,OAAO,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;oBACnD,KAAK,CAAC,QAAuB,EAAE,QAAuB,EAAE,IAAc;wBACpE,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;wBACtC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;oBAC3B,CAAC;iBACF,CAAC,CAAC;YACL,CAAC,CAAC;YACF,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,EAAE,YAAY,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;SACxF;QACD,OAAO;YACL,WAAW,EAAE,SAAS,CAAC,2BAA2B,CAAC,MAAM,CAAC;YAC1D,YAAY,EAAE,EAAE;SACjB,CAAC;IACJ,CAAC;CACF;AAED;;;GAGG;AACH,MAAa,wBAAyB,SAAQ,KAAK;IACjD;QACE,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACxF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,wBAAwB,CAAC,SAAS,CAAC,CAAC;IAClE,CAAC;CACF;AAND,4DAMC;AAED,kBAAe,SAAS,CAAC"}

package/node/wrappers/models/utils/requestcontext.ts

@@ -30,8 +30,12 @@ class EnvConfig {
     return /:\d+$/.test(base) ? base : base + ':8082';
   }
 
+  private static get isLocalURL(): boolean {
+    return /^localhost|^127\.0\.0\.1/.test(this.apiURL);
+  }
+
   static get apiCredentials(): grpc.ChannelCredentials {
-    if (/^localhost|^127\.0\.0\.1/.test(this.apiURL)) {
+    if (this.isLocalURL) {
       return grpc.credentials.createInsecure();
     }
     else {
@@ -39,46 +43,75 @@ class EnvConfig {
     }
   }
 
+  private static addApiKey(metadata: grpc.Metadata, apiKey: string): void {
+    metadata.add('x-api-key', apiKey);
+  }
+
   /**
-   * Returns channel credentials that inject `x-api-key: <apiKey>` into every
-   * call's metadata. Uses insecure transport for localhost, SSL otherwise.
+   * Returns SSL channel credentials combined with per-call credentials that
+   * inject `x-api-key: <apiKey>` into every call's metadata.
+   *
+   * Remote (SSL) hosts only: grpc-js cannot compose call credentials with
+   * insecure channel credentials. For localhost / 127.0.0.1 use
+   * {@link EnvConfig.getAuthenticatedClientOptions}, which sends the key via
+   * an interceptor instead.
+   *
+   * @throws {InsecureChannelAuthError} when apiURL is localhost / 127.0.0.1.
    */
+  static getAuthenticatedCredentials(apiKey: string): grpc.ChannelCredentials {
+    if (this.isLocalURL) {
+      throw new InsecureChannelAuthError();
+    }
+    const callCreds = grpc.credentials.createFromMetadataGenerator(
+      (_params, callback) => {
+        const metadata = new grpc.Metadata();
+        EnvConfig.addApiKey(metadata, apiKey);
+        callback(null, metadata);
+      }
+    );
+    return grpc.credentials.combineChannelCredentials(
+      grpc.credentials.createSsl(),
+      callCreds
+    );
+  }
+
   /**
    * Returns credentials and interceptors for authenticated calls.
    * For local (insecure) channels, injects the API key via an interceptor.
-   * For remote (SSL) channels, uses combined channel + call credentials.
+   * For remote (SSL) channels, uses {@link EnvConfig.getAuthenticatedCredentials}.
    */
   static getAuthenticatedClientOptions(apiKey: string): {
     credentials: grpc.ChannelCredentials;
     interceptors: grpc.Interceptor[];
   } {
-    const isLocal = /^localhost|^127\.0\.0\.1/.test(this.apiURL);
-    if (isLocal) {
+    if (this.isLocalURL) {
       const interceptor: grpc.Interceptor = (_options, nextCall) => {
         return new grpc.InterceptingCall(nextCall(_options), {
           start(metadata: grpc.Metadata, listener: grpc.Listener, next: Function) {
-            metadata.add('x-api-key', apiKey);
+            EnvConfig.addApiKey(metadata, apiKey);
             next(metadata, listener);
           }
         });
       };
       return { credentials: grpc.credentials.createInsecure(), interceptors: [interceptor] };
     }
-    const callCreds = grpc.credentials.createFromMetadataGenerator(
-      (_params, callback) => {
-        const metadata = new grpc.Metadata();
-        metadata.add('x-api-key', apiKey);
-        callback(null, metadata);
-      }
-    );
     return {
-      credentials: grpc.credentials.combineChannelCredentials(
-        grpc.credentials.createSsl(),
-        callCreds
-      ),
+      credentials: EnvConfig.getAuthenticatedCredentials(apiKey),
       interceptors: []
     };
   }
 }
 
+/**
+ * Thrown by EnvConfig.getAuthenticatedCredentials when API_URL points at an
+ * insecure (local) channel. The message never includes the API key.
+ */
+export class InsecureChannelAuthError extends Error {
+  constructor() {
+    super('API key auth over an insecure channel requires getAuthenticatedClientOptions()');
+    this.name = 'InsecureChannelAuthError';
+    Object.setPrototypeOf(this, InsecureChannelAuthError.prototype);
+  }
+}
+
 export default EnvConfig;

package/node/wrappers/services/apikey.credentials.test.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Unit tests for Issue #114: each wrapper service hands the generated gRPC
+ * client the authenticated credentials when given an apiKey, and
+ * EnvConfig.apiCredentials otherwise.
+ *
+ * The generated *_grpc_pb clients are mocked, so no channel is opened.
+ */
+export {};