28 lines
888 B
TypeScript
28 lines
888 B
TypeScript
import "server-only";
|
|
|
|
import { jsonError } from "@/lib/http/json";
|
|
|
|
/**
|
|
* Checks the Authorization header against AGENT_API_TOKEN.
|
|
*
|
|
* Same pattern as /api/cron/reconcile's CRON_SECRET check — a second secret
|
|
* of the same kind, for a second machine caller. Returns the Response to
|
|
* send when the caller must be refused, or null when the request may
|
|
* proceed, so every route starts with:
|
|
*
|
|
* const denied = requireAgentToken(request);
|
|
* if (denied) return denied;
|
|
*/
|
|
export function requireAgentToken(request: Request): Response | null {
|
|
const secret = process.env.AGENT_API_TOKEN;
|
|
if (!secret) {
|
|
console.error("[agent-api] AGENT_API_TOKEN is not set; refusing all requests");
|
|
return jsonError("Not configured", 500);
|
|
}
|
|
|
|
if (request.headers.get("authorization") !== `Bearer ${secret}`) {
|
|
return jsonError("Unauthorized", 401);
|
|
}
|
|
|
|
return null;
|
|
}
|