19 lines
633 B
TypeScript
19 lines
633 B
TypeScript
/**
|
|
* Shared-secret auth for the internal staff routes.
|
|
*
|
|
* Staff hit URLs of the form /staff/report?org=<id>&key=<secret>. The
|
|
* secret is read from the STAFF_REPORT_KEY env var. If unset, the routes
|
|
* refuse every request (closed by default).
|
|
*
|
|
* Stub mode (CIVI_* unset) does NOT bypass this check — we want to test
|
|
* the auth surface in dev too. For local dev, set STAFF_REPORT_KEY=dev in
|
|
* .env.local.
|
|
*/
|
|
|
|
export function isStaffKeyValid(key: string | null | undefined): boolean {
|
|
const expected = process.env.STAFF_REPORT_KEY;
|
|
if (!expected) return false;
|
|
if (!key) return false;
|
|
return key === expected;
|
|
}
|