22 lines
723 B
TypeScript
22 lines
723 B
TypeScript
import { NextRequest } from "next/server";
|
|
|
|
/**
|
|
* Device-scoped secret, distinct from AGENT_API_KEY — a POS device
|
|
* only needs checkout/catalog/sales access, not the full agent API
|
|
* surface, so it gets its own key rather than reusing the agent's.
|
|
*/
|
|
export function assertPosAuth(req: NextRequest) {
|
|
const expected = process.env.POS_API_KEY;
|
|
if (!expected) {
|
|
throw new Error("POS_API_KEY is not configured.");
|
|
}
|
|
|
|
const authHeader = req.headers.get("authorization") || "";
|
|
const token = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : "";
|
|
|
|
if (token !== expected) {
|
|
const error = new Error("Unauthorized");
|
|
(error as Error & { status?: number }).status = 401;
|
|
throw error;
|
|
}
|
|
}
|