From 7cd5cd6cdf266dc29539be15de369be6b1a1c19b Mon Sep 17 00:00:00 2001
From: Joel Brock <joelbrock@gmail.com>
Date: Fri, 5 Jun 2026 16:09:57 -0700
Subject: [PATCH] Staff report: add shared-secret key validator

---
 lib/staff-auth.ts | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100644 lib/staff-auth.ts

diff --git a/lib/staff-auth.ts b/lib/staff-auth.ts
new file mode 100644
index 0000000..0fa79ae
--- /dev/null
+++ b/lib/staff-auth.ts
@@ -0,0 +1,18 @@
+/**
+ * Shared-secret auth for the internal staff routes.
+ *
+ * Staff hit URLs of the form /staff/report?org=<id>&key=<secret>. The
+ * secret is read from the STAFF_REPORT_KEY env var. If unset, the routes
+ * refuse every request (closed by default).
+ *
+ * Stub mode (CIVI_* unset) does NOT bypass this check — we want to test
+ * the auth surface in dev too. For local dev, set STAFF_REPORT_KEY=dev in
+ * .env.local.
+ */
+
+export function isStaffKeyValid(key: string | null | undefined): boolean {
+  const expected = process.env.STAFF_REPORT_KEY;
+  if (!expected) return false;
+  if (!key) return false;
+  return key === expected;
+}