fix: #3275 refuse on server side if hide user api key

app/api/auth.ts

@@ -46,6 +46,13 @@ export function auth(req: NextRequest) {
     };
   }
 
+  if (serverConfig.hideUserApiKey && !!apiKey) {
+    return {
+      error: true,
+      msg: "you are not allowed to access openai with your own api key",
+    };
+  }
+
   // if user does not provide an api key, inject system api key
   if (!apiKey) {
     const serverApiKey = serverConfig.isAzure