feat: forward X-API-Key header from Next.js proxy routes to ML service

All 12 Next.js API routes that proxy requests to the ML service
(INFERENCE_API_URL / localhost:8001) now include the X-API-Key header
read from process.env.API_KEY. Affected routes:
- /api/predict
- /api/predict/batch
- /api/model/info
- /api/model/load
- /api/training/start
- /api/training/runs
- /api/training/runs/[run_id] (DELETE)
- /api/training/dataset-info
- /api/training/active
- /api/training/build-dataset
- /api/patterns/available
- /api/patterns/detect

Marks task 3.3 as complete in openspec/changes/code-review-fix/tasks.md.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

openspec/changes/code-review-fix/tasks.md

@@ -21,7 +21,7 @@
 
 - [x] 3.1 `[sonnet]` Create `src/middleware.ts` with API key auth middleware: read `API_KEY` env var, check `X-API-Key` header on all `/api/*` routes except `/api/health`, return 401 if invalid
 - [x] 3.2 `[sonnet]` Add FastAPI `Depends()` API key dependency in `services/ml/app/main.py`: read `API_KEY` env var, check `X-API-Key` header, exempt `/health` endpoint
-- [ ] 3.3 `[sonnet]` Update all Next.js proxy routes to forward `X-API-Key` header to ML service
+- [x] 3.3 `[sonnet]` Update all Next.js proxy routes to forward `X-API-Key` header to ML service
 - [ ] 3.4 `[haiku]` Add `API_KEY` to `.env.example` with placeholder value and instructions
 
 ## 4. API Route Hardening (Next.js)

src/app/api/model/info/route.ts

@@ -14,6 +14,7 @@ export async function GET(request: NextRequest) {
         method: 'GET',
         headers: {
           'Content-Type': 'application/json',
+          'X-API-Key': process.env.API_KEY || '',
         },
         signal: controller.signal,
       });

src/app/api/model/load/route.ts

@@ -12,7 +12,7 @@ export async function POST(request: NextRequest) {
 
     const response = await fetch(`${INFERENCE_API_URL}/model/load`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', 'X-API-Key': process.env.API_KEY || '' },
       body: JSON.stringify(body),
       signal: controller.signal,
     });

src/app/api/patterns/available/route.ts

@@ -10,7 +10,7 @@ export async function GET(_request: NextRequest) {
   try {
     const response = await fetch(`${INFERENCE_API_URL}/patterns/available`, {
       method: 'GET',
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', 'X-API-Key': process.env.API_KEY || '' },
       signal: controller.signal,
     });
     clearTimeout(timeoutId);

src/app/api/patterns/detect/route.ts

@@ -13,7 +13,7 @@ export async function POST(request: NextRequest) {
 
     const response = await fetch(`${INFERENCE_API_URL}/patterns/detect`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', 'X-API-Key': process.env.API_KEY || '' },
       body: JSON.stringify(body),
       signal: controller.signal,
     });

src/app/api/predict/batch/route.ts

@@ -16,6 +16,7 @@ export async function POST(request: NextRequest) {
         method: 'POST',
         headers: {
           'Content-Type': 'application/json',
+          'X-API-Key': process.env.API_KEY || '',
         },
         body: JSON.stringify(body),
         signal: controller.signal,

src/app/api/predict/route.ts

@@ -16,6 +16,7 @@ export async function POST(request: NextRequest) {
         method: 'POST',
         headers: {
           'Content-Type': 'application/json',
+          'X-API-Key': process.env.API_KEY || '',
         },
         body: JSON.stringify(body),
         signal: controller.signal,

src/app/api/training/active/route.ts

@@ -10,7 +10,7 @@ export async function GET(_request: NextRequest) {
   try {
     const response = await fetch(`${INFERENCE_API_URL}/training/active`, {
       method: 'GET',
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', 'X-API-Key': process.env.API_KEY || '' },
       signal: controller.signal,
     });
     clearTimeout(timeoutId);

src/app/api/training/build-dataset/route.ts

@@ -10,7 +10,7 @@ export async function POST() {
   try {
     const response = await fetch(`${INFERENCE_API_URL}/training/build-dataset`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', 'X-API-Key': process.env.API_KEY || '' },
       signal: controller.signal,
     });
     clearTimeout(timeoutId);

src/app/api/training/dataset-info/route.ts

@@ -10,7 +10,7 @@ export async function GET(_request: NextRequest) {
   try {
     const response = await fetch(`${INFERENCE_API_URL}/training/dataset-info`, {
       method: 'GET',
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', 'X-API-Key': process.env.API_KEY || '' },
       signal: controller.signal,
     });
     clearTimeout(timeoutId);

src/app/api/training/runs/[run_id]/route.ts

@@ -24,6 +24,7 @@ export async function DELETE(
   try {
     const response = await fetch(`${INFERENCE_API_URL}/training/runs/${run_id}`, {
       method: 'DELETE',
+      headers: { 'X-API-Key': process.env.API_KEY || '' },
       signal: controller.signal,
     });
     clearTimeout(timeoutId);

src/app/api/training/runs/route.ts

@@ -10,7 +10,7 @@ export async function GET(_request: NextRequest) {
   try {
     const response = await fetch(`${INFERENCE_API_URL}/training/runs`, {
       method: 'GET',
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', 'X-API-Key': process.env.API_KEY || '' },
       signal: controller.signal,
     });
     clearTimeout(timeoutId);

src/app/api/training/start/route.ts

@@ -12,7 +12,7 @@ export async function POST(request: NextRequest) {
 
     const response = await fetch(`${INFERENCE_API_URL}/training/start`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', 'X-API-Key': process.env.API_KEY || '' },
       body: JSON.stringify(body),
       signal: controller.signal,
     });