19 lines
786 B
TypeScript
19 lines
786 B
TypeScript
|
/**
|
||
|
|
* Shared dev server authentication middleware.
|
||
|
|
* Validates Bearer token on all /api/* requests.
|
||
|
|
* Token is auto-generated in scripts/dev.sh and injected via VITE_DEV_API_TOKEN.
|
||
|
|
*/
|
||
|
|
import type { IncomingMessage, ServerResponse } from 'http'
|
||
|
|
|
||
|
|
const DEV_TOKEN = process.env.VITE_DEV_API_TOKEN ?? ''
|
||
|
|
|
||
|
|
/** Validate Authorization header. Returns true if authorized, false if rejected (response already sent). */
|
||
|
|
export function validateDevAuth(req: IncomingMessage, res: ServerResponse): boolean {
|
||
|
|
if (!DEV_TOKEN) return true // No token configured, skip auth
|
||
|
|
const auth = req.headers.authorization
|
||
|
|
if (auth === `Bearer ${DEV_TOKEN}`) return true
|
||
|
|
res.writeHead(401, { 'Content-Type': 'application/json' })
|
||
|
|
res.end(JSON.stringify({ error: 'Unauthorized' }))
|
||
|
|
return false
|
||
|
|
}
|