Bound client API key file reads

API keys are exactly 32 bytes. Reading malformed or special files in
full can otherwise consume unbounded memory. Read only enough bytes to
detect an oversized key.

Treat missing files separately from read and format errors. This keeps a
malformed configured key from being silently ignored in favor of a
default key.

Use the same open-first handling in the daemon so only NotFound triggers
key generation and all other open failures are reported.

This commit was created with assistance from Codex.

Author: tankyleo

ldk-server-cli/src/main.rs

@@ -617,10 +617,15 @@ async fn main() {
 		},
 	};
 
-	let api_key = resolve_api_key(cli.api_key, config.as_ref()).unwrap_or_else(|| {
-		eprintln!("API key not provided. Use --api-key or ensure the api_key file exists at {DEFAULT_DIR}/[network]/api_key");
-		std::process::exit(1);
-	});
+	let api_key = resolve_api_key(cli.api_key, config.as_ref())
+		.unwrap_or_else(|e| {
+			eprintln!("Failed to resolve API key: {e}");
+			std::process::exit(1);
+		})
+		.unwrap_or_else(|| {
+			eprintln!("API key not provided. Use --api-key or ensure the api_key file exists at {DEFAULT_DIR}/[network]/api_key");
+			std::process::exit(1);
+		});
 
 	let base_url = resolve_base_url(cli.base_url, config.as_ref());
 

ldk-server-client/src/config.rs

@@ -13,14 +13,16 @@
 //! locating the server's TLS certificate and API key on disk, so multiple clients (CLI, MCP
 //! bridge, etc.) can resolve connection credentials in a consistent way.
 
-use std::path::PathBuf;
+use std::io::{ErrorKind, Read};
+use std::path::{Path, PathBuf};
 
 use hex_conservative::DisplayHex;
 use serde::{Deserialize, Serialize};
 
 const DEFAULT_CONFIG_FILE: &str = "config.toml";
 const DEFAULT_CERT_FILE: &str = "tls.crt";
 const API_KEY_FILE: &str = "api_key";
+const API_KEY_LEN: usize = 32;
 
 /// Default address of the `ldk-server` gRPC endpoint when no explicit value is configured.
 pub const DEFAULT_GRPC_SERVICE_ADDRESS: &str = "127.0.0.1:3536";
@@ -146,18 +148,47 @@ pub fn resolve_base_url(override_url: Option<String>, config: Option<&Config>) -
 /// Prefers `override_key`, falls back to reading the API key file from the configured storage
 /// directory, and finally from the OS-specific default data directory. The raw bytes read from
 /// disk are lower-hex encoded before being returned.
-pub fn resolve_api_key(override_key: Option<String>, config: Option<&Config>) -> Option<String> {
-	override_key.or_else(|| {
-		let network =
-			config.and_then(|c| c.network().ok()).unwrap_or_else(|| "bitcoin".to_string());
-		storage_dir(config)
-			.map(|dir| api_key_path_for_storage_dir(dir, &network))
-			.and_then(|path| std::fs::read(&path).ok())
-			.or_else(|| {
-				get_default_api_key_path(&network).and_then(|path| std::fs::read(&path).ok())
-			})
-			.map(|bytes| bytes.to_lower_hex_string())
-	})
+///
+/// Returns an error if a candidate API key file exists but cannot be read or does not contain
+/// exactly 32 bytes.
+pub fn resolve_api_key(
+	override_key: Option<String>, config: Option<&Config>,
+) -> Result<Option<String>, String> {
+	if override_key.is_some() {
+		return Ok(override_key);
+	}
+
+	let network = config.and_then(|c| c.network().ok()).unwrap_or_else(|| "bitcoin".to_string());
+	if let Some(dir) = storage_dir(config) {
+		let path = api_key_path_for_storage_dir(dir, &network);
+		if let Some(api_key) = read_api_key(&path)? {
+			return Ok(Some(api_key));
+		}
+	}
+
+	match get_default_api_key_path(&network) {
+		Some(path) => read_api_key(&path),
+		None => Ok(None),
+	}
+}
+
+fn read_api_key(path: &Path) -> Result<Option<String>, String> {
+	let file = match std::fs::File::open(path) {
+		Ok(file) => file,
+		Err(e) if e.kind() == ErrorKind::NotFound => return Ok(None),
+		Err(e) => return Err(format!("Failed to read API key file '{}': {e}", path.display())),
+	};
+	let mut bytes = Vec::with_capacity(API_KEY_LEN + 1);
+	file.take((API_KEY_LEN + 1) as u64)
+		.read_to_end(&mut bytes)
+		.map_err(|e| format!("Failed to read API key file '{}': {e}", path.display()))?;
+	if bytes.len() != API_KEY_LEN {
+		return Err(format!(
+			"API key file '{}' must contain exactly {API_KEY_LEN} bytes",
+			path.display()
+		));
+	}
+	Ok(Some(bytes.to_lower_hex_string()))
 }
 
 /// Resolves the path to the server's TLS certificate (PEM).

ldk-server-mcp/src/config.rs

@@ -39,7 +39,7 @@ pub fn resolve_config(config_path: Option<String>) -> Result<ResolvedConfig, Str
 
 	let base_url = resolve_base_url(env_base_url, config.as_ref());
 
-	let api_key = resolve_api_key(env_api_key, config.as_ref()).ok_or_else(
+	let api_key = resolve_api_key(env_api_key, config.as_ref())?.ok_or_else(
 		|| "API key not provided. Set LDK_API_KEY or ensure the api_key file exists at ~/.ldk-server/[network]/api_key".to_string()
 	)?;
 
@@ -203,7 +203,7 @@ mod tests {
 
 		let cert_path = custom_storage.join("tls.crt");
 		std::fs::write(&cert_path, b"storage-cert").unwrap();
-		std::fs::write(custom_storage.join("regtest").join("api_key"), [0xAB, 0xCD]).unwrap();
+		std::fs::write(custom_storage.join("regtest").join("api_key"), [0xAB; 32]).unwrap();
 
 		std::fs::write(
 			&config_path,
@@ -226,7 +226,7 @@ mod tests {
 		let resolved = resolve_config(Some(config_path.display().to_string())).unwrap();
 
 		assert_eq!(resolved.base_url, DEFAULT_GRPC_SERVICE_ADDRESS);
-		assert_eq!(resolved.api_key, "abcd");
+		assert_eq!(resolved.api_key, "ab".repeat(32));
 		assert_eq!(resolved.tls_cert_pem, b"storage-cert");
 
 		std::fs::remove_dir_all(temp_dir).unwrap();

ldk-server/src/main.rs

@@ -895,8 +895,13 @@ fn upsert_payment_details(
 fn load_or_generate_api_key(storage_dir: &Path) -> std::io::Result<String> {
 	let api_key_path = storage_dir.join(API_KEY_FILE);
 
-	if api_key_path.exists() {
-		let file = fs::File::open(&api_key_path)?;
+	let file = match fs::File::open(&api_key_path) {
+		Ok(file) => Some(file),
+		Err(e) if e.kind() == std::io::ErrorKind::NotFound => None,
+		Err(e) => return Err(e),
+	};
+
+	if let Some(file) = file {
 		let mut key_bytes = Vec::with_capacity(API_KEY_LEN + 1);
 		file.take((API_KEY_LEN + 1) as u64).read_to_end(&mut key_bytes)?;
 		if key_bytes.len() != API_KEY_LEN {