// Shared-secret auth for the /api/bot/* routes — the inventory-capture
// Telegram bot (a separate Python service, not a browser) calls these, so
// it can't go through the Auth.js session/cookie flow the rest of the app
// uses (src/auth.ts). Deliberately a SEPARATE secret from AUTH_SECRET
// (session JWT signing key) and from the review-page User account's
// password — a machine credential, not a human one, so it can be rotated
// independently without touching either.
export function requireBotAuth(request: Request): boolean {
  const header = request.headers.get("authorization") ?? "";
  const expected = `Bearer ${process.env.BOT_INGEST_SECRET}`;
  return Boolean(process.env.BOT_INGEST_SECRET) && header === expected;
}