Function internalComputerOwner

src/http-personal-computers.ts:239–247

(request: Request, expectedOwner: string, env: CloudboxBindings)

// only by trusted internal callers until verified end-user delegation exists;
// these routes intentionally reject ordinary public API traffic.
function internalComputerOwner(request: Request, expectedOwner: string, env: CloudboxBindings): Response | null {
  const internalToken = env.CLOUDBOX_INTERNAL_TOKEN;
  const gotToken = request.headers.get("x-cloudbox-internal-token");
  const owner = request.headers.get("x-cloudbox-owner");
  if (!internalToken || gotToken !== internalToken || !owner || owner.toLowerCase() !== expectedOwner.toLowerCase()) {
    return jsonErrorResponse(403, "computer_internal_only", "durable computer slice requires trusted owner delegation");
  }
  return null;
}

function personalComputerId(owner: string): string {
  return `personal:${owner.trim().toLowerCase()}`;