fixup! Keep API keys within one instance

This commit was created with assistance from Codex.

Author: benthecarman

ldk-server-cli/src/main.rs

@@ -15,8 +15,9 @@ use clap_complete::{generate, Shell};
 use hex_conservative::{DisplayHex, FromHex};
 use ldk_server_client::client::LdkServerClient;
 use ldk_server_client::config::{
-	get_default_config_path, load_config, read_tls_certificate, resolve_api_key, resolve_base_url,
-	resolve_cert_path, Config, DEFAULT_GRPC_SERVICE_ADDRESS,
+	get_default_config_path, load_config, read_tls_certificate, resolve_api_key,
+	resolve_api_key_path, resolve_base_url, resolve_cert_path, Config,
+	DEFAULT_GRPC_SERVICE_ADDRESS,
 };
 use ldk_server_client::error::LdkServerError;
 use ldk_server_client::error::LdkServerErrorCode::{
@@ -644,13 +645,22 @@ async fn main() {
 		std::process::exit(1);
 	});
 
+	let api_key_path = resolve_api_key_path(config.as_ref());
 	let api_key = resolve_api_key(cli.api_key, config.as_ref())
 		.unwrap_or_else(|e| {
 			eprintln!("Failed to resolve API key: {e}");
 			std::process::exit(1);
 		})
 		.unwrap_or_else(|| {
-			eprintln!("API key not provided. Use --api-key or ensure the api_key file exists at {DEFAULT_DIR}/[network]/api_key");
+			match api_key_path {
+				Some(path) => eprintln!(
+					"API key not provided. Use --api-key or ensure the api_key file exists at '{}'",
+					path.display()
+				),
+				None => eprintln!(
+					"API key not provided. Use --api-key; no API key file path could be resolved from the configuration"
+				),
+			}
 			std::process::exit(1);
 		});
 

ldk-server-client/src/config.rs

@@ -155,9 +155,10 @@ pub fn resolve_base_url(override_url: Option<String>, config: Option<&Config>) -
 
 /// Resolves the API key used to authenticate against the `ldk-server` gRPC endpoint.
 ///
-/// Prefers `override_key`, falls back to reading the API key file from the configured storage
-/// directory, and finally from the OS-specific default data directory. The raw bytes read from
-/// disk are lower-hex encoded before being returned.
+/// Prefers `override_key`. Otherwise, reads the API key file from the configured storage
+/// directory when one is set, or from the OS-specific default data directory when one is not.
+/// A failed read from a configured storage directory does not fall back to the default data
+/// directory. The raw bytes read from disk are lower-hex encoded before being returned.
 ///
 /// Returns an error if a candidate API key file exists but cannot be read or does not contain
 /// exactly 32 bytes.
@@ -168,19 +169,24 @@ pub fn resolve_api_key(
 		return Ok(override_key);
 	}
 
+	match resolve_api_key_path(config) {
+		Some(path) => read_api_key(&path),
+		None => Ok(None),
+	}
+}
+
+/// Resolves the API key file path selected by [`resolve_api_key`] when no override is given.
+///
+/// Uses the configured storage directory when one is set. Uses the OS-specific default data
+/// directory only when no storage directory is configured.
+pub fn resolve_api_key_path(config: Option<&Config>) -> Option<PathBuf> {
 	let network = match config {
-		Some(config) => match config.network() {
-			Ok(network) => network,
-			Err(_) => return Ok(None),
-		},
+		Some(config) => config.network().ok()?,
 		None => "bitcoin".to_string(),
 	};
 	match storage_dir(config) {
-		Some(dir) => read_api_key(&api_key_path_for_storage_dir(dir, &network)),
-		None => match get_default_api_key_path(&network) {
-			Some(path) => read_api_key(&path),
-			None => Ok(None),
-		},
+		Some(dir) => Some(api_key_path_for_storage_dir(dir, &network)),
+		None => get_default_api_key_path(&network),
 	}
 }
 
@@ -254,7 +260,7 @@ mod tests {
 
 	use super::{
 		get_default_api_key_path, load_config, read_tls_certificate, resolve_api_key,
-		resolve_base_url, Config, API_KEY_FILE, CONFIG_FILE_SIZE_LIMIT,
+		resolve_api_key_path, resolve_base_url, Config, API_KEY_FILE, CONFIG_FILE_SIZE_LIMIT,
 		DEFAULT_GRPC_SERVICE_ADDRESS, TLS_CERT_FILE_SIZE_LIMIT,
 	};
 
@@ -426,6 +432,10 @@ mod tests {
 		))
 		.unwrap();
 
+		assert_eq!(
+			resolve_api_key_path(Some(&config)),
+			Some(configured_storage.join("regtest").join(API_KEY_FILE))
+		);
 		let resolved = resolve_api_key(None, Some(&config));
 
 		restore_env_var(&default_dir_env_var, old_default_dir);

ldk-server-mcp/src/config.rs

@@ -10,8 +10,8 @@
 use std::path::PathBuf;
 
 use ldk_server_client::config::{
-	get_default_config_path, load_config, read_tls_certificate, resolve_api_key, resolve_base_url,
-	resolve_cert_path,
+	get_default_config_path, load_config, read_tls_certificate, resolve_api_key,
+	resolve_api_key_path, resolve_base_url, resolve_cert_path,
 };
 
 pub struct ResolvedConfig {
@@ -48,9 +48,14 @@ pub fn resolve_config(config_path: Option<String>) -> Result<ResolvedConfig, Str
 
 	let base_url = resolve_base_url(env_base_url, config.as_ref());
 
-	let api_key = resolve_api_key(env_api_key, config.as_ref())?.ok_or_else(
-		|| "API key not provided. Set LDK_API_KEY or ensure the api_key file exists at ~/.ldk-server/[network]/api_key".to_string()
-	)?;
+	let api_key_path = resolve_api_key_path(config.as_ref());
+	let api_key = resolve_api_key(env_api_key, config.as_ref())?.ok_or_else(|| match api_key_path {
+		Some(path) => format!(
+			"API key not provided. Set LDK_API_KEY or ensure the api_key file exists at '{}'",
+			path.display()
+		),
+		None => "API key not provided. Set LDK_API_KEY; no API key file path could be resolved from the configuration".to_string(),
+	})?;
 
 	let tls_cert_path = resolve_cert_path(env_tls_cert_path, config.as_ref()).ok_or_else(|| {
 		"TLS cert path not provided. Set LDK_TLS_CERT_PATH or ensure config file exists at ~/.ldk-server/config.toml"
@@ -254,4 +259,41 @@ mod tests {
 
 		std::fs::remove_dir_all(temp_dir).unwrap();
 	}
+
+	#[test]
+	fn resolve_config_reports_missing_key_in_storage_dir() {
+		let _lock = ENV_LOCK.lock().unwrap();
+
+		let temp_dir = std::env::temp_dir()
+			.join(format!("ldk-server-mcp-missing-storage-key-{}", std::process::id()));
+		let custom_storage = temp_dir.join("custom-storage");
+		std::fs::create_dir_all(&custom_storage).unwrap();
+
+		let config_path = temp_dir.join("config.toml");
+		std::fs::write(
+			&config_path,
+			format!(
+				r#"
+					[node]
+					network = "regtest"
+
+					[storage.disk]
+					dir_path = "{}"
+				"#,
+				custom_storage.display()
+			),
+		)
+		.unwrap();
+
+		std::env::remove_var("LDK_API_KEY");
+		std::env::remove_var("LDK_TLS_CERT_PATH");
+		std::env::remove_var("LDK_BASE_URL");
+		let error = resolve_config(Some(config_path.display().to_string())).err().unwrap();
+
+		assert!(
+			error.contains(&custom_storage.join("regtest").join("api_key").display().to_string())
+		);
+
+		std::fs::remove_dir_all(temp_dir).unwrap();
+	}
 }