Allow api key query fallback

tests/app.test.js

@@ -45,30 +45,6 @@ test("GET /loc returns count metadata", async () => {
   assert.equal(response.body.languages[0].language, "TypeScript");
 });
 
-test("GET /loc accepts query as a repo alias", async () => {
-  const app = createApp(baseConfig, {
-    getHealth: () => ({ cacheEntries: 0, inFlight: 0, maxConcurrentScans: 4, activeScans: 0, queuedScans: 0 }),
-    getPublicKey: async () => "ssh-ed25519 AAAA",
-    getDefaultKeyName: () => "loc_via_git_ed25519",
-    count: async (requestInput) => ({
-      repo: requestInput.repo,
-      ref: requestInput.ref,
-      sshKey: requestInput.sshKey,
-      cached: false,
-      lineCount: 2,
-      fileCount: 1,
-      languages: [{ language: "Plain Text", files: 1, lines: 2 }],
-      scannedAt: "2026-01-01T00:00:00.000Z",
-      durationMs: 10
-    })
-  });
-
-  const response = await request(app).get("/loc?query=https://example.com/query.git");
-
-  assert.equal(response.status, 200);
-  assert.equal(response.body.repo, "https://example.com/query.git");
-});
-
 test("GET /ssh/public-key returns text without auth", async () => {
   const app = createApp({ ...baseConfig, apiKey: "secret" }, {
     getHealth: () => ({ cacheEntries: 0, inFlight: 0, maxConcurrentScans: 4, activeScans: 0, queuedScans: 0 }),
@@ -99,3 +75,27 @@ test("GET /loc enforces api key when configured", async () => {
 
   assert.equal(response.status, 401);
 });
+
+test("GET /loc accepts api_key query param as an unsafe fallback", async () => {
+  const app = createApp({ ...baseConfig, apiKey: "secret" }, {
+    getHealth: () => ({ cacheEntries: 0, inFlight: 0, maxConcurrentScans: 4, activeScans: 0, queuedScans: 0 }),
+    getPublicKey: async () => "ssh-ed25519 AAAA",
+    getDefaultKeyName: () => "loc_via_git_ed25519",
+    count: async (requestInput) => ({
+      repo: requestInput.repo,
+      ref: requestInput.ref,
+      sshKey: requestInput.sshKey,
+      cached: false,
+      lineCount: 5,
+      fileCount: 1,
+      languages: [{ language: "Plain Text", files: 1, lines: 5 }],
+      scannedAt: "2026-01-01T00:00:00.000Z",
+      durationMs: 10
+    })
+  });
+
+  const response = await request(app).get("/loc?repo=https://example.com/repo.git&api_key=secret");
+
+  assert.equal(response.status, 200);
+  assert.equal(response.body.lineCount, 5);
+});