feat(core): Add V2 Authentication to all available endpoints

[GauravRawat369]

Type of Change

• Bugfix
• New feature
• Enhancement
• Refactoring
• Dependency updates
• Documentation
• CI/CD

Description

This commit introduces V2 authentication mechanisms for various admin and client-side APIs :

• Added V2AdminApiAuth and modified AdminApiAuthWithMerchantIdFromRoute for V2
• Added V2ApiKeyAuth , V2AdminApiAuth and V2ClientAuth to the endpoints
• Refactored functions to support V2 Auth as well as V1 Auth

Additional Changes

• This PR modifies the API contract
• This PR modifies the database schema
• This PR modifies application configuration/environment variables

Motivation and Context

How did you test it?

For /v2/merchant-accounts

Request

curl --location 'http://localhost:8080/v2/merchant-accounts' \
--header 'x-organization-id: org_d2lZPiRPOGbIMmFcb59A' \
--header 'Content-Type: application/json' \
--header 'Authorization: admin-api-key=test_admin' \
--data '{
    "merchant_name": "cloth_seller"
}'

Response

{
    "id": "cloth_seller_KdjFPBxrxWyX09jri2VB",
    "merchant_name": "cloth_seller",
    "merchant_details": null,
    "publishable_key": "pk_dev_735cafe5f43446e88d22bedec15b0139",
    "metadata": null,
    "organization_id": "org_d2lZPiRPOGbIMmFcb59A",
    "recon_status": "not_requested",
    "product_type": "orchestration"
}

For /v2/organization

Request

curl --location 'http://localhost:8080/v2/organization' \
--header 'Authorization: admin-api-key=test_admin' \
--header 'Content-Type: application/json' \
--data '{
    "organization_name": "random_org_1741776562"
}'

Response

{
    "id": "org_m4fLYdEFb7PNHynIfmZO",
    "organization_name": "random_org_1741776558",
    "organization_details": null,
    "metadata": null,
    "modified_at": "2025-03-12 10:49:18.475431",
    "created_at": "2025-03-12 10:49:18.475424"
}

This is how V2AdminApiAuth looks like

pub struct V2AdminApiAuth;

#[async_trait]
impl<A> AuthenticateAndFetch<(), A> for V2AdminApiAuth
where
    A: SessionStateInfo + Sync,
{
    async fn authenticate_and_fetch(
        &self,
        request_headers: &HeaderMap,
        state: &A,
    ) -> RouterResult<((), AuthenticationType)> {
        let header_map_struct = HeaderMapStruct::new(&request_headers);
        let auth_string = header_map_struct.get_auth_string_from_header()?;
        let request_admin_api_key = auth_string
            .split(',')
            .find_map(|part| part.trim().strip_prefix("admin-api-key="))
            .ok_or_else(|| {
                report!(errors::ApiErrorResponse::Unauthorized)
                    .attach_printable("Unable to parse admin_api_key")
            })?;
        if request_admin_api_key.is_empty() {
            return Err(errors::ApiErrorResponse::Unauthorized)
                .attach_printable("Admin Api key is empty");
        }
        let conf = state.conf();

        let admin_api_key = &conf.secrets.get_inner().admin_api_key;

        if request_admin_api_key != admin_api_key.peek() {
            Err(report!(errors::ApiErrorResponse::Unauthorized)
                .attach_printable("Admin Authentication Failure"))?;
        }

        Ok(((), AuthenticationType::AdminApiKey))
    }
}

What changes are done in authorization header

How it was earlier?

api-key = {{api-key}}
client-secret={{client_secret}} 
api-key = {{admin_api_key}}

Changed version

Authorization = api-key={{api-key}} 
Authorization = admin-api-key={{admin_api_key}}
Authorization = publishable-key={{publishable_key}},client-secret={{client_secret}} 

Checklist

• I formatted the code cargo +nightly fmt --all
• I addressed lints thrown by cargo clippy
• I reviewed the submitted code
• I added unit tests for my changes where possible

[semanticdiff-com]

Review changes with  

Changed Files

File	Status
crates/router/src/routes/payments.rs	9% smaller
crates/router/src/routes/admin.rs	1% smaller
crates/router/src/core/errors.rs	0% smaller
crates/router/src/routes/api_keys.rs	0% smaller
crates/router/src/routes/customers.rs	0% smaller
crates/router/src/routes/ephemeral_key.rs	0% smaller
crates/router/src/routes/payment_methods.rs	0% smaller
crates/router/src/routes/routing.rs	0% smaller
crates/router/src/services/authentication.rs	0% smaller

[Narayanbhat166]

@GauravRawat369, can you add the request and response for the api endpoints that you tested, in the PR description?