13 lines
739 B
TypeScript
13 lines
739 B
TypeScript
// Shared-secret auth for the /api/bot/* routes — the inventory-capture
|
|
// Telegram bot (a separate Python service, not a browser) calls these, so
|
|
// it can't go through the Auth.js session/cookie flow the rest of the app
|
|
// uses (src/auth.ts). Deliberately a SEPARATE secret from AUTH_SECRET
|
|
// (session JWT signing key) and from the review-page User account's
|
|
// password — a machine credential, not a human one, so it can be rotated
|
|
// independently without touching either.
|
|
export function requireBotAuth(request: Request): boolean {
|
|
const header = request.headers.get("authorization") ?? "";
|
|
const expected = `Bearer ${process.env.BOT_INGEST_SECRET}`;
|
|
return Boolean(process.env.BOT_INGEST_SECRET) && header === expected;
|
|
}
|