fix(security): the console channel enforced less than it claimed

apps/panel/src/modules/auth/guards/jwt-auth.guard.ts

@@ -95,6 +95,7 @@ export class JwtAuthGuard implements CanActivate {
       // reconnecte.
       role: session.user.role,
       sessionId: payload.sid,
+      authenticatedBy: 'session',
     };
 
     const requiredRole = this.reflector.getAllAndOverride<string>(REQUIRED_ROLE_KEY, [
@@ -146,6 +147,10 @@ export class JwtAuthGuard implements CanActivate {
       // A key opens no session: there is nothing to revoke on the session
       // side, and the identifier tells the origin apart in the logs.
       sessionId: `api-key:${key.id}`,
+      // Read by the console route, which refuses to mint a daemon credential
+      // for a key: a key's scope is decided from the HTTP verb, and the console
+      // is handed out by a GET.
+      authenticatedBy: 'api-key',
     };
 
     const requiredRole = this.reflector.getAllAndOverride<string>(REQUIRED_ROLE_KEY, [

apps/panel/src/modules/auth/request-user.ts

@@ -10,6 +10,20 @@ export interface RequestUser {
   email: string;
   role: 'ADMIN' | 'USER';
   sessionId: string;
+  /**
+   * Which credential authenticated this request.
+   *
+   * Stated as a field of its own rather than read off the shape of
+   * `sessionId`, which happens to be prefixed `api-key:` for one of the two.
+   * A route that has to refuse API keys — the console does — must rest on
+   * something a reader can find and a compiler can check, not on a string
+   * whose format reads like a logging detail and could be changed by someone
+   * improving the logs.
+   *
+   * Being required rather than optional is the point: a third way of
+   * authenticating cannot be added without deciding what it is worth here.
+   */
+  authenticatedBy: 'session' | 'api-key';
 }
 
 /**