fix: use headscale.api_key where possible

app/routes/acls/acl-action.ts

@@ -26,7 +26,7 @@ export async function aclAction({ request, context }: Route.ActionArgs) {
     });
   }
 
-  const apiKey = context.auth.getHeadscaleApiKey(principal, context.oidc?.apiKey);
+  const apiKey = context.auth.getHeadscaleApiKey(principal);
   const api = context.hsApi.getRuntimeClient(apiKey);
   try {
     const { policy, updatedAt } = await api.setPolicy(policyData);

app/routes/acls/acl-loader.ts

@@ -29,7 +29,7 @@ export async function aclLoader({ request, context }: Route.LoaderArgs) {
   };
 
   // Try to load the ACL policy from the API.
-  const apiKey = context.auth.getHeadscaleApiKey(principal, context.oidc?.apiKey);
+  const apiKey = context.auth.getHeadscaleApiKey(principal);
   const api = context.hsApi.getRuntimeClient(apiKey);
   try {
     const { policy, updatedAt } = await api.getPolicy();

app/routes/auth/oidc-callback.ts

@@ -107,7 +107,7 @@ export async function loader({ request, context }: Route.LoaderArgs) {
     });
 
     try {
-      const hsApi = context.hsApi.getRuntimeClient(context.oidc!.apiKey);
+      const hsApi = context.hsApi.getRuntimeClient(context.headscaleApiKey!);
       const hsUsers = await hsApi.getUsers();
       const hsUser = findHeadscaleUserBySubject(hsUsers, claims.sub, userInfo.email);
       if (hsUser) {

app/routes/home.tsx

@@ -28,7 +28,7 @@ export async function loader({ request, context }: Route.LoaderArgs) {
     principal.kind === "oidc" &&
     !principal.user.headscaleUserId
   ) {
-    const apiKey = context.auth.getHeadscaleApiKey(principal, context.oidc?.apiKey);
+    const apiKey = context.auth.getHeadscaleApiKey(principal);
     const api = context.hsApi.getRuntimeClient(apiKey);
 
     let headscaleUsers: { id: string; name: string }[] = [];
@@ -64,7 +64,7 @@ export async function loader({ request, context }: Route.LoaderArgs) {
   }
 
   // No UI access — show the download/connect page
-  const apiKey = context.auth.getHeadscaleApiKey(principal, context.oidc?.apiKey);
+  const apiKey = context.auth.getHeadscaleApiKey(principal);
   const api = context.hsApi.getRuntimeClient(apiKey);
 
   let linkedUserName: string | undefined;

app/routes/machines/machine-actions.ts

@@ -10,9 +10,7 @@ export async function machineAction({ request, context }: Route.ActionArgs) {
   const principal = await context.auth.require(request);
 
   const formData = await request.formData();
-  const api = context.hsApi.getRuntimeClient(
-    context.auth.getHeadscaleApiKey(principal, context.oidc?.apiKey),
-  );
+  const api = context.hsApi.getRuntimeClient(context.auth.getHeadscaleApiKey(principal));
 
   const action = formData.get("action_id")?.toString();
   if (!action) {

app/routes/machines/machine.tsx

@@ -38,9 +38,7 @@ export async function loader({ request, params, context }: Route.LoaderArgs) {
     }
   }
 
-  const api = context.hsApi.getRuntimeClient(
-    context.auth.getHeadscaleApiKey(principal, context.oidc?.apiKey),
-  );
+  const api = context.hsApi.getRuntimeClient(context.auth.getHeadscaleApiKey(principal));
   const [nodesSnap, usersSnap] = await Promise.all([
     context.hsLive.get(nodesResource, api),
     context.hsLive.get(usersResource, api),

app/routes/machines/overview.tsx

@@ -30,9 +30,7 @@ export async function loader({ request, context }: Route.LoaderArgs) {
 
   const writablePermission = context.auth.can(principal, Capabilities.write_machines);
 
-  const api = context.hsApi.getRuntimeClient(
-    context.auth.getHeadscaleApiKey(principal, context.oidc?.apiKey),
-  );
+  const api = context.hsApi.getRuntimeClient(context.auth.getHeadscaleApiKey(principal));
   const [nodesSnap, usersSnap] = await Promise.all([
     context.hsLive.get(nodesResource, api),
     context.hsLive.get(usersResource, api),

app/routes/settings/auth-keys/actions.ts

@@ -7,7 +7,7 @@ import type { Route } from "./+types/overview";
 
 export async function authKeysAction({ request, context }: Route.ActionArgs) {
   const principal = await context.auth.require(request);
-  const apiKey = context.auth.getHeadscaleApiKey(principal, context.oidc?.apiKey);
+  const apiKey = context.auth.getHeadscaleApiKey(principal);
   const api = context.hsApi.getRuntimeClient(apiKey);
 
   const canGenerateAny = context.auth.can(principal, Capabilities.generate_authkeys);

app/routes/settings/auth-keys/overview.tsx

@@ -20,7 +20,7 @@ import AddAuthKey from "./dialogs/add-auth-key";
 
 export async function loader({ request, context }: Route.LoaderArgs) {
   const principal = await context.auth.require(request);
-  const apiKey = context.auth.getHeadscaleApiKey(principal, context.oidc?.apiKey);
+  const apiKey = context.auth.getHeadscaleApiKey(principal);
   const api = context.hsApi.getRuntimeClient(apiKey);
 
   const usersSnap = await context.hsLive.get(usersResource, api);

app/routes/ssh/console.tsx

@@ -41,7 +41,7 @@ export async function loader({ request, context }: Route.LoaderArgs) {
     throw data("Only OAuth users are allowed to use WebSSH", 403);
   }
 
-  const apiKey = context.auth.getHeadscaleApiKey(principal, context.oidc?.apiKey);
+  const apiKey = context.auth.getHeadscaleApiKey(principal);
   const api = context.hsApi.getRuntimeClient(apiKey);
   const users = await api.getUsers();
 

app/routes/users/overview.tsx

@@ -54,7 +54,7 @@ export async function loader({ request, context }: Route.LoaderArgs) {
   let apiError: string | undefined;
 
   try {
-    const apiKey = context.auth.getHeadscaleApiKey(principal, context.oidc?.apiKey);
+    const apiKey = context.auth.getHeadscaleApiKey(principal);
     const api = context.hsApi.getRuntimeClient(apiKey);
     const [nodesSnap, usersSnap] = await Promise.all([
       context.hsLive.get(nodesResource, api),

app/routes/users/user-actions.ts

@@ -24,7 +24,7 @@ export async function userAction({ request, context }: Route.ActionArgs) {
     });
   }
 
-  const apiKey = context.auth.getHeadscaleApiKey(principal, context.oidc?.apiKey);
+  const apiKey = context.auth.getHeadscaleApiKey(principal);
   const api = context.hsApi.getRuntimeClient(apiKey);
   switch (action) {
     case "create_user": {

app/routes/util/live.ts

@@ -5,7 +5,7 @@ import type { Route } from "./+types/live";
 
 export async function loader({ request, context }: Route.LoaderArgs) {
   const principal = await context.auth.require(request);
-  const apiKey = context.auth.getHeadscaleApiKey(principal, context.oidc?.apiKey);
+  const apiKey = context.auth.getHeadscaleApiKey(principal);
   const api = context.hsApi.getRuntimeClient(apiKey);
 
   // Ensure resources are loaded before streaming