fix: use headscale.api_key where possible

app/server/db/pruner.ts

@@ -18,7 +18,7 @@ export async function pruneEphemeralNodes({ context, request }: Route.LoaderArgs
     return;
   }
 
-  const apiKey = context.auth.getHeadscaleApiKey(principal, context.oidc?.apiKey);
+  const apiKey = context.auth.getHeadscaleApiKey(principal);
   const api = context.hsApi.getRuntimeClient(apiKey);
   const nodes = await api.getNodes();
   const toPrune = nodes.filter((node) => {

app/server/index.ts

@@ -84,6 +84,7 @@ const appLoadContext = {
 
   auth: createAuthService({
     secret: config.server.cookie_secret,
+    headscaleApiKey,
     db,
     cookie: {
       name: "_hp_auth",
@@ -93,13 +94,13 @@ const appLoadContext = {
     },
   }),
 
+  headscaleApiKey,
   hsApi,
   agents,
   integration: await loadIntegration(config.integration),
   oidc:
     config.oidc && config.oidc.enabled !== false && headscaleApiKey
       ? {
-          apiKey: headscaleApiKey,
           connector: createLazyOidcConnector(
             config.server.base_url,
             config.oidc,

app/server/web/auth.ts

@@ -58,6 +58,7 @@ interface CookiePayload {
 
 export interface AuthServiceOptions {
   secret: string;
+  headscaleApiKey?: string;
   db: NodeSQLiteDatabase;
   cookie: {
     name: string;
@@ -230,21 +231,16 @@ export class AuthService {
     return this.encodeCookie({ sid, api_key: apiKey }, Math.floor(maxAge / 1000));
   }
 
-  /**
-   * Get the Headscale API key for making API calls.
-   * OIDC sessions use the configured oidc.headscale_api_key.
-   * API key sessions use the user-provided key stored in the cookie.
-   */
-  getHeadscaleApiKey(principal: Principal, oidcApiKey?: string): string {
+  getHeadscaleApiKey(principal: Principal): string {
     if (principal.kind === "api_key") {
       return principal.apiKey;
     }
 
-    if (!oidcApiKey) {
-      throw new Error("OIDC sessions require oidc.headscale_api_key");
+    if (!this.opts.headscaleApiKey) {
+      throw new Error("OIDC sessions require headscale.api_key to be configured");
     }
 
-    return oidcApiKey;
+    return this.opts.headscaleApiKey;
   }
 
   /**