Added API key authentication.

src/web/graphql.js

@@ -1,3 +1,4 @@
+import config from 'config';
 import { format } from 'date-fns';
 
 import {
@@ -24,6 +25,8 @@ import {
 	fetchActorsByIdGraphql,
 } from './actors.js';
 
+import { verifyKey } from '../auth.js';
+
 const schema = buildSchema(`
 	type Query {
 		movies(
@@ -61,6 +64,13 @@ const DateScalar = new GraphQLScalarType({
 });
 
 export async function graphqlApi(req, res) {
+	if (!config.apiAccess.graphqlEnabled) {
+		res.status(404).send();
+		return;
+	}
+
+	await verifyKey(req.headers['api-user'], req.headers['api-key'], req);
+
 	const data = await graphql({
 		schema,
 		source: req.body.query,