aaronrene / knowtation public
canister-auth-headers.mjs
12 lines 558 B
Raw
sha256:fbe982a22c05c6fe2e93876f250deecdb43d883f648b4e1810c7546caa9f17db docs: activate KNOWTATION- board identity and preserve livi… Human minor ⚠ breaking 3 days ago
1 /**
2 * ICP canister HTTP expects X-Gateway-Auth matching canister `gateway_auth_secret`
3 * (see hub/icp `gatewayAuthorized` — SEC-KN-1 fail-closed: empty secret DENIES).
4 * The gateway proxy always merges this; direct fetch helpers must do the same.
5 * When CANISTER_AUTH_SECRET is empty, callers send no header and the canister returns
6 * GATEWAY_AUTH_REQUIRED on every protected route.
7 */
8 export function canisterAuthHeaders() {
9 const secret = process.env.CANISTER_AUTH_SECRET || '';
10 if (!secret) return {};
11 return { 'x-gateway-auth': secret };
12 }
File History 1 commit
sha256:fbe982a22c05c6fe2e93876f250deecdb43d883f648b4e1810c7546caa9f17db docs: activate KNOWTATION- board identity and preserve livi… Human minor ⚠ 3 days ago