From 43a0c90dacd1bf304088e090bd7d05f87fa8cbe9 Mon Sep 17 00:00:00 2001
From: Loi Phan <phanhuuloi15@gmail.com>
Date: Sun, 12 Jul 2026 21:08:14 +0700
Subject: [PATCH] fix: update the permission for request api key

---
 src/sse/services/auth.js                     | 10 +--
 tests/unit/api-key-credential-access.test.js | 67 ++++++++++++++++++++
 2 files changed, 72 insertions(+), 5 deletions(-)
 create mode 100644 tests/unit/api-key-credential-access.test.js

diff --git a/src/sse/services/auth.js b/src/sse/services/auth.js
index 32161818..7fdea2e4 100644
--- a/src/sse/services/auth.js
+++ b/src/sse/services/auth.js
@@ -14,7 +14,7 @@ let selectionMutex = Promise.resolve();
  * @param {string} provider - Provider name
  * @param {Set<string>|string|null} excludeConnectionIds - Connection ID(s) to exclude (for retry with next account)
  * @param {string|null} model - Model name for per-model rate limit filtering
- * @param {{ ownerId?: string|null }} options - API-key owner scope for credentials
+ * @param {{ ownerId?: string|null }} options - API-key owner for usage attribution; credential selection is system-wide
  */
 export async function getProviderCredentials(provider, excludeConnectionIds = null, model = null, options = {}) {
   // Normalize to Set for consistent handling
@@ -22,7 +22,6 @@ export async function getProviderCredentials(provider, excludeConnectionIds = nu
     ? excludeConnectionIds
     : (excludeConnectionIds ? new Set([excludeConnectionIds]) : new Set());
   const preferredConnectionId = options?.preferredConnectionId || null;
-  const ownerId = options?.ownerId;
   // Acquire mutex to prevent race conditions
   const currentMutex = selectionMutex;
   let resolveMutex;
@@ -61,9 +60,10 @@ export async function getProviderCredentials(provider, excludeConnectionIds = nu
       };
     }
 
-    const connectionFilter = { provider: providerId, isActive: true };
-    if (ownerId !== undefined) connectionFilter.ownerId = ownerId;
-    const connections = await getProviderConnections(connectionFilter);
+    // Provider credentials are a system-wide pool. API-key ownership is used
+    // for attribution only, so every user can route through credentials added
+    // by any other user or an administrator.
+    const connections = await getProviderConnections({ provider: providerId, isActive: true });
     log.debug("AUTH", `${provider} | total connections: ${connections.length}, excludeIds: ${excludeSet.size > 0 ? [...excludeSet].join(",") : "none"}, model: ${model || "any"}`);
 
     if (connections.length === 0) {
diff --git a/tests/unit/api-key-credential-access.test.js b/tests/unit/api-key-credential-access.test.js
new file mode 100644
index 00000000..e48d08f0
--- /dev/null
+++ b/tests/unit/api-key-credential-access.test.js
@@ -0,0 +1,67 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+let tempDir;
+const originalDataDir = process.env.DATA_DIR;
+
+beforeEach(() => {
+  tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "9router-api-key-credentials-"));
+  process.env.DATA_DIR = tempDir;
+  delete global._dbAdapter;
+  vi.resetModules();
+});
+
+afterEach(() => {
+  try { global._dbAdapter?.instance?.close?.(); } catch {}
+  delete global._dbAdapter;
+  fs.rmSync(tempDir, { recursive: true, force: true });
+  if (originalDataDir === undefined) delete process.env.DATA_DIR;
+  else process.env.DATA_DIR = originalDataDir;
+});
+
+describe("API-key credential access", () => {
+  it("allows a user API key to use the system-wide credential pool", async () => {
+    const db = await import("@/lib/db/index.js");
+    const { getProviderCredentials } = await import("@/sse/services/auth.js");
+    const admin = await db.createUser({ username: "credential-admin", password: "password", role: "admin" });
+    const userA = await db.createUser({ username: "credential-user-a", password: "password", role: "user" });
+    const userB = await db.createUser({ username: "credential-user-b", password: "password", role: "user" });
+    const userC = await db.createUser({ username: "credential-user-c", password: "password", role: "user" });
+    const adminConnection = await db.createProviderConnection({
+      provider: "antigravity",
+      authType: "oauth",
+      name: "admin-antigravity",
+      accessToken: "admin-token",
+      ownerId: admin.id,
+    });
+    const userAConnection = await db.createProviderConnection({
+      provider: "antigravity",
+      authType: "oauth",
+      name: "user-a-antigravity",
+      accessToken: "user-a-token",
+      ownerId: userA.id,
+    });
+    const userBConnection = await db.createProviderConnection({
+      provider: "antigravity",
+      authType: "oauth",
+      name: "user-b-antigravity",
+      accessToken: "user-b-token",
+      ownerId: userB.id,
+    });
+
+    const firstCredentials = await getProviderCredentials("antigravity", new Set(), "gemini-2.5-pro", {
+      ownerId: userC.id,
+    });
+    const secondCredentials = await getProviderCredentials("antigravity", new Set([firstCredentials.connectionId]), "gemini-2.5-pro", {
+      ownerId: userC.id,
+    });
+    const thirdCredentials = await getProviderCredentials("antigravity", new Set([firstCredentials.connectionId, secondCredentials.connectionId]), "gemini-2.5-pro", {
+      ownerId: userC.id,
+    });
+
+    expect([firstCredentials.connectionId, secondCredentials.connectionId, thirdCredentials.connectionId])
+      .toEqual(expect.arrayContaining([adminConnection.id, userAConnection.id, userBConnection.id]));
+  });
+});
\ No newline at end of file