Function createInternalAuthHook

apps/desktop/main/internal-api.ts:360–376

* Auth hook for the Internal Server. ALL routes require Bearer token, no exceptions. * Independent from @openchatlab/http-routes auth (which uses global state for External Server).

(token: string)

 * Independent from @openchatlab/http-routes auth (which uses global state for External Server).
 */
function createInternalAuthHook(token: string) {
  return async function internalAuthHook(request: FastifyRequest, reply: FastifyReply): Promise<void> {
    if (request.method === 'OPTIONS') return

    const authHeader = request.headers.authorization
    if (!authHeader || !authHeader.startsWith('Bearer ')) {
      reply.code(401).send({ success: false, error: { code: 'UNAUTHORIZED', message: 'Missing or invalid token' } })
      return
    }

    const provided = authHeader.slice(7)
    if (!safeTokenCompare(provided, token)) {
      reply.code(401).send({ success: false, error: { code: 'UNAUTHORIZED', message: 'Invalid token' } })
      return
    }
  }
}