21 lines
651 B
JavaScript
21 lines
651 B
JavaScript
/**
|
|
* VSSTA Integration Middleware
|
|
* Fails closed if the env var is missing or empty, and strictly compares header.
|
|
*/
|
|
const vsstaIntegrationMiddleware = (req, res, next) => {
|
|
const secret = process.env.VSSTA_INTEGRATION_SECRET;
|
|
if (typeof secret !== "string" || secret.length === 0) {
|
|
return res.status(500).send("Server misconfiguration");
|
|
}
|
|
|
|
const headerValue = req.headers["vssta-integration-secret"];
|
|
if (typeof headerValue !== "string" || headerValue.trim() !== secret) {
|
|
return res.status(401).send("Unauthorized");
|
|
}
|
|
|
|
req.isVsstaIntegrationAuthorized = true;
|
|
next();
|
|
};
|
|
|
|
module.exports = vsstaIntegrationMiddleware;
|