From d5a0f1cb74e2e0898da9151c1d8a0a1cbd7cbf3f Mon Sep 17 00:00:00 2001 From: toanhoang Date: Wed, 19 Aug 2026 22:07:07 -0400 Subject: [PATCH] feat: add bot-secret auth helper for /api/bot/* routes Co-Authored-By: Claude Sonnet 5 --- src/lib/bot-auth.ts | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 src/lib/bot-auth.ts diff --git a/src/lib/bot-auth.ts b/src/lib/bot-auth.ts new file mode 100644 index 0000000..8865cf2 --- /dev/null +++ b/src/lib/bot-auth.ts @@ -0,0 +1,12 @@ +// Shared-secret auth for the /api/bot/* routes — the inventory-capture +// Telegram bot (a separate Python service, not a browser) calls these, so +// it can't go through the Auth.js session/cookie flow the rest of the app +// uses (src/auth.ts). Deliberately a SEPARATE secret from AUTH_SECRET +// (session JWT signing key) and from the review-page User account's +// password — a machine credential, not a human one, so it can be rotated +// independently without touching either. +export function requireBotAuth(request: Request): boolean { + const header = request.headers.get("authorization") ?? ""; + const expected = `Bearer ${process.env.BOT_INGEST_SECRET}`; + return Boolean(process.env.BOT_INGEST_SECRET) && header === expected; +}