resolve comments

apps/api/src/app/auth/api-key.strategy.ts

@@ -56,31 +56,20 @@ export class ApiKeyStrategy extends PassportStrategy(
   }
 
   private async validateApiKey(apiKey: string) {
-    if (!apiKey) {
-      throw new HttpException(
-        getReasonPhrase(StatusCodes.UNAUTHORIZED),
-        StatusCodes.UNAUTHORIZED
-      );
-    }
-
-    try {
-      const { id } = await this.apiKeyService.getUserByApiKey(apiKey);
-
-      const user = await this.userService.user({ id });
-
-      if (!user) {
-        throw new HttpException(
-          getReasonPhrase(StatusCodes.UNAUTHORIZED),
-          StatusCodes.UNAUTHORIZED
-        );
-      }
+    if (apiKey) {
+      try {
+        const { id } = await this.apiKeyService.getUserByApiKey(apiKey);
+        const user = await this.userService.user({ id });
 
-      return user;
-    } catch {
-      throw new HttpException(
-        getReasonPhrase(StatusCodes.UNAUTHORIZED),
-        StatusCodes.UNAUTHORIZED
-      );
+        if (user) {
+          return user;
+        }
+      } catch {}
     }
+
+    throw new HttpException(
+      getReasonPhrase(StatusCodes.UNAUTHORIZED),
+      StatusCodes.UNAUTHORIZED
+    );
   }
 }

apps/api/src/app/auth/auth.module.ts

@@ -117,10 +117,11 @@ import { OidcStrategy } from './oidc.strategy';
         const clientID = configurationService.get('OIDC_CLIENT_ID');
         const clientSecret = configurationService.get('OIDC_CLIENT_SECRET');
 
-        if (!issuer || !clientID || !clientSecret) {
+        if (!clientID || !clientSecret || !issuer) {
           logger.error(
             'OIDC configuration incomplete: issuer, clientID, or clientSecret missing'
           );
+
           throw new Error('OIDC configuration incomplete');
         }
 

apps/api/src/app/auth/oidc-state.store.ts

@@ -26,7 +26,6 @@ export class OidcStateStore implements SessionStore {
 
   /**
    * Store request state.
-   * Signature matches passport-openidconnect SessionStore
    */
   public store(
     _req: Request,
@@ -57,7 +56,6 @@ export class OidcStateStore implements SessionStore {
 
   /**
    * Verify request state.
-   * Signature matches passport-openidconnect SessionStore
    */
   public verify(
     _req: Request,