feat: add hybx omnl stack and gas pmm tooling

services/token-aggregation/src/api/middleware/omnl-guards.test.ts

@@ -0,0 +1,37 @@
+import type { Request, Response } from 'express';
+import { omnlSensitiveRouteGuard } from './omnl-guards';
+
+describe('omnlSensitiveRouteGuard', () => {
+  const oldKey = process.env.OMNL_API_KEY;
+
+  afterEach(() => {
+    if (oldKey === undefined) delete process.env.OMNL_API_KEY;
+    else process.env.OMNL_API_KEY = oldKey;
+  });
+
+  it('passes when OMNL_API_KEY unset', () => {
+    delete process.env.OMNL_API_KEY;
+    const next = jest.fn();
+    omnlSensitiveRouteGuard({ headers: {}, query: {} } as unknown as Request, {} as Response, next);
+    expect(next).toHaveBeenCalled();
+  });
+
+  it('401 when key set and no auth', () => {
+    process.env.OMNL_API_KEY = 'abc';
+    const json = jest.fn();
+    const status = jest.fn().mockReturnValue({ json });
+    omnlSensitiveRouteGuard({ headers: {}, query: {} } as unknown as Request, { status } as unknown as Response, jest.fn());
+    expect(status).toHaveBeenCalledWith(401);
+  });
+
+  it('passes with Bearer token', () => {
+    process.env.OMNL_API_KEY = 'abc';
+    const next = jest.fn();
+    omnlSensitiveRouteGuard(
+      { headers: { authorization: 'Bearer abc' }, query: {} } as unknown as Request,
+      {} as Response,
+      next
+    );
+    expect(next).toHaveBeenCalled();
+  });
+});

services/token-aggregation/src/api/middleware/omnl-guards.ts

@@ -0,0 +1,21 @@
+import type { Request, Response, NextFunction } from 'express';
+
+/**
+ * When `OMNL_API_KEY` is set, require `Authorization: Bearer <key>` or `?access_token=<key>`.
+ * If unset, all requests pass (backwards compatible).
+ */
+export function omnlSensitiveRouteGuard(req: Request, res: Response, next: NextFunction): void {
+  const key = process.env.OMNL_API_KEY?.trim();
+  if (!key) {
+    next();
+    return;
+  }
+  const auth = String(req.headers.authorization || '');
+  const bearer = auth.startsWith('Bearer ') ? auth.slice(7).trim() : '';
+  const q = String(req.query.access_token ?? '').trim();
+  if (bearer === key || q === key) {
+    next();
+    return;
+  }
+  res.status(401).json({ error: 'Unauthorized', hint: 'Set Authorization: Bearer or access_token for OMNL_API_KEY' });
+}