From b5a24a1dcf5cdce6da925bb30d57b9f2a124f1dd Mon Sep 17 00:00:00 2001
From: yyamashita <yyamashita@hetzner.yyamashita.com>
Date: Fri, 19 Jun 2026 23:28:00 +0900
Subject: Require Bearer token auth on POST /api/posts

Reuses REGISTER_TOKEN so the same secret covers both
passkey registration and API posting.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 app/routes/api.posts.tsx | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'app/routes/api.posts.tsx')

diff --git a/app/routes/api.posts.tsx b/app/routes/api.posts.tsx
index 2d5637c..8ef7639 100644
--- a/app/routes/api.posts.tsx
+++ b/app/routes/api.posts.tsx
@@ -14,6 +14,12 @@ export async function action({ request }: Route.ActionArgs) {
     return Response.json({ error: "Method not allowed" }, { status: 405 });
   }
 
+  const token = process.env.REGISTER_TOKEN;
+  const auth = request.headers.get("Authorization") ?? "";
+  if (!token || auth !== `Bearer ${token}`) {
+    return Response.json({ error: "Unauthorized" }, { status: 401 });
+  }
+
   let content: string;
   const ct = request.headers.get("content-type") ?? "";
   if (ct.includes("application/json")) {
-- 
cgit v1.2.3

