Add authentication/authorization to API mutation endpoints

[rustydb]

Priority: P0 — Critical

Source

Senior Architect Code Review (2026-04-03)

Problem

All API endpoints — including mutation endpoints like POST /api/network-nodes/:id/solar-system and DELETE /api/network-nodes/:id/solar-system — are publicly accessible without any authentication or authorization.

The dashboard enforces wallet connection on the client side, but the API itself is wide open. Any internet user can mutate solar-system assignments directly via the API.

Affected Files

• apps/api/src/routes.ts
• apps/api/src/server.ts
• .github/workflows/deploy.yml

Recommendation

At minimum, add a shared API key validated via middleware on mutation endpoints. Longer term, consider JWT validation tied to the Eve Vault wallet session.

Options to evaluate:

1. Shared secret — X-API-Key header checked against a API_SECRET env var
2. JWT validation — verify a token signed by the Eve Vault session
3. Sui signature verification — require a signed message from the connected wallet

Acceptance Criteria

• Mutation endpoints (POST, DELETE) require authentication
• Read endpoints (GET) remain publicly accessible
• Secret is managed via environment variable, never hardcoded
• CI and deployment workflows pass the secret to Cloud Run
• Tests cover authenticated and unauthenticated requests