feat: add static api key middleware for dev stats (CM-1055)

[ulemons]

Summary

Sets up the foundation for the DevStats public API:

• Adds CROWD_DEV_STATS_API_KEY static API key authentication middleware
• Mounts the dev-stats router under /v1/dev-stats with a temporary placeholder endpoint for testing

Test plan

• Call POST /api/v1/dev-stats/affiliations without a key → 401
• Call with wrong key → 401
• Call with correct key → 200

---

Note

Medium Risk
Introduces a new authentication path (API keys) and a new apiKeys persistence table; mistakes here could unintentionally grant/deny access or weaken protection on the new public endpoint.

Overview
Adds a new public v1/dev-stats route protected by a staticApiKeyMiddleware that validates Bearer API keys (hash lookup, revoked/expired checks) and sets req.actor scopes for downstream authorization.

Introduces an apiKeys database table plus data-access helpers to fetch keys by hash and update lastUsedAt, and adds the new read:affiliations scope used by a rate-limited placeholder POST /affiliations endpoint.

^{Written by Cursor Bugbot for commit 474c2ea. This will update automatically on new commits. Configure here.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Copilot]

Pull request overview

This PR introduces a new “DevStats” public API surface by adding a static API key authentication middleware and mounting a new /v1/dev-stats router with a placeholder endpoint.

Changes:

• Added devStats.apiKey configuration wiring via CROWD_DEV_STATS_API_KEY.
• Implemented staticApiKeyMiddleware and mounted the DevStats router at /v1/dev-stats.
• Added a placeholder POST /v1/dev-stats/affiliations endpoint for initial connectivity testing.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
backend/src/conf/index.ts	Exposes DEV_STATS_CONFIG from node-config.
backend/src/conf/configTypes.ts	Adds DevStatsConfiguration type.
backend/src/api/public/v1/dev-stats/index.ts	Introduces DevStats router with a placeholder POST /affiliations.
backend/src/api/public/middlewares/staticApiKeyMiddleware.ts	Adds static API key auth middleware and sets req.actor.
backend/src/api/public/index.ts	Mounts DevStats router behind the static API key middleware.
backend/config/default.json	Adds devStats config block.
backend/config/custom-environment-variables.json	Maps devStats.apiKey to CROWD_DEV_STATS_API_KEY.
backend/.env.dist.local	Adds local env template entry for CROWD_DEV_STATS_API_KEY.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

[cursor]

Async middleware missing try-catch causes request hang

High Severity

The staticApiKeyMiddleware is an async function, but Express 4.17.1 does not automatically catch rejected promises from async middleware. If optionsQx(req) or findApiKeyByHash throws (e.g., a database error), the rejection is unhandled and the request hangs indefinitely. The rest of the codebase wraps async handlers with safeWrap from errorMiddleware.ts to forward errors via next(err). This middleware needs a try/catch around the awaited calls that forwards caught errors to next.

 

[cursor]

Redundant index on unique-constrained keyHash column

Low Severity

The "keyHash" column is declared UNIQUE on line 4, which already creates an implicit unique B-tree index in PostgreSQL. The explicit CREATE INDEX "ix_apiKeys_keyHash" on the same column creates a second, redundant index that wastes storage and slows writes without any query benefit.