Extension `validateRcApiKey()` treats 404 as "valid in dev mode"

[AndresL230]

Extension validateRcApiKey() treats 404 as "valid in dev mode"

Severity: High
Affected repos: extension
Component boundary: extension ↔ API /auth/me

Symptom

validateRcApiKey() in extension/src/api-client.ts calls GET /auth/me and:

• On 200 → valid.
• On 401 → throws "invalid key".
• On 404 → returns null (treated as valid; documented as "dev mode where /auth/me is not deployed").
• On network error → throws.

The 404 branch was a development-time convenience. In production, the API does deploy /auth/me, but any unrelated server-side bug (e.g., the route stops being mounted, a typo in index.ts, a future refactor) that produces a 404 from this URL will silently mark every key as valid. The status bar shows "Connected". The user proceeds. The extension submits scans that the API will then reject for auth reasons.

Evidence

extension/src/api-client.ts — the validateRcApiKey() function's 404 handler returns null unconditionally, with no environment gating.

Impact

• A latent fail-open in the auth boundary. Today it costs nothing because /auth/me is healthy. Tomorrow, a route reordering or middleware change at the API silently disables key validation on every installed extension.
• Compounds critical/02/03: the auth path has multiple "trust by default" decisions; this one is in the extension and is easy to miss.

Fix recommendation

Gate the 404-as-valid branch behind an explicit environment signal:

if (response.status === 404) {
  if (process.env.RECOST_DEV_MODE !== "1") {
    throw new Error("Auth endpoint not found — extension cannot validate key.");
  }
  return null; // dev only
}

Or, simpler: remove the branch entirely. The API has deployed /auth/me for a while; the dev shim has served its purpose.

If you keep it, make it loud — emit a vscode.window.showWarningMessage exactly once per session when the 404 branch fires, so a real 404 outage in production is visible to users.

Verification

• Point the extension at a stub server that returns 404 on /auth/me. Without RECOST_DEV_MODE=1, the extension should refuse the key. With the flag, it should accept and show a warning.