import { NextRequest } from "next/server";

/**
 * Shared API-key auth for /api/ext/* pipeline routes — same contract as the
 * existing ext endpoints (Authorization: Bearer <key> or X-Api-Key header).
 * One shared API_SECRET_KEY for now (studio decision 18.1-Q7).
 */
export function isExtAuthorized(req: NextRequest): boolean {
  const apiKey = process.env.API_SECRET_KEY;
  if (!apiKey) return false;
  const authHeader = req.headers.get("authorization") ?? "";
  if (authHeader.startsWith("Bearer ")) return authHeader.slice(7) === apiKey;
  return (req.headers.get("x-api-key") ?? "") === apiKey;
}