/**
 * Shared dev server authentication middleware.
 * Validates Bearer token on all /api/* requests.
 * Token is auto-generated in scripts/dev.sh and injected via VITE_DEV_API_TOKEN.
 */
import type { IncomingMessage, ServerResponse } from 'http'

const DEV_TOKEN = process.env.VITE_DEV_API_TOKEN ?? ''

/** Validate Authorization header. Returns true if authorized, false if rejected (response already sent). */
export function validateDevAuth(req: IncomingMessage, res: ServerResponse): boolean {
  if (!DEV_TOKEN) return true // No token configured, skip auth
  const auth = req.headers.authorization
  if (auth === `Bearer ${DEV_TOKEN}`) return true
  res.writeHead(401, { 'Content-Type': 'application/json' })
  res.end(JSON.stringify({ error: 'Unauthorized' }))
  return false
}