fix(auth): inline onRequest hook in guardedRoutes scope to properly protect private routes

apps/api/src/index.ts

@@ -1,7 +1,6 @@
 import Fastify from 'fastify';
 import cors from '@fastify/cors';
 import rateLimit from '@fastify/rate-limit';
-import authPlugin from './plugins/auth';
 import { whatsappRoutes } from './routes/whatsapp';
 import { adminRoutes } from './routes/admin';
 import { aiRoutes } from './routes/ai';
@@ -26,12 +25,31 @@ server.register(rateLimit, {
 server.register(whatsappRoutes, { prefix: '/v1/whatsapp' });
 
 // ── Private Routes (require ADMIN_API_KEY) ─────────────────────────────────────
-// Each private scope gets its own auth guard — they cannot be bypassed
-server.register(async (privateScope) => {
-    privateScope.register(authPlugin);
-    privateScope.register(adminRoutes, { prefix: '/v1/admin' });
-    privateScope.register(aiRoutes, { prefix: '/v1/ai' });
-    privateScope.register(paymentRoutes, { prefix: '/v1/payments' });
+// Inline addHook on an isolated scope guarantees the auth check fires BEFORE
+// any child route handler, properly encapsulated in Fastify v4.
+server.register(async function guardedRoutes(scope) {
+    scope.addHook('onRequest', async (request, reply) => {
+        const apiKey = process.env.ADMIN_API_KEY;
+
+        if (!apiKey) {
+            request.log.error('ADMIN_API_KEY is not configured!');
+            return reply.code(503).send({ error: 'Service misconfigured' });
+        }
+
+        const authHeader = request.headers['authorization'];
+        if (!authHeader || !authHeader.startsWith('Bearer ')) {
+            return reply.code(401).send({ error: 'Unauthorized', message: 'Missing Authorization header' });
+        }
+
+        const token = authHeader.slice(7);
+        if (token !== apiKey) {
+            return reply.code(401).send({ error: 'Unauthorized', message: 'Invalid API key' });
+        }
+    });
+
+    scope.register(adminRoutes, { prefix: '/v1/admin' });
+    scope.register(aiRoutes, { prefix: '/v1/ai' });
+    scope.register(paymentRoutes, { prefix: '/v1/payments' });
 });
 
 // ── Health Routes (public) ─────────────────────────────────────────────────────