Function validateAuthToken

src/server/web/auth.ts:7–16

(req: IncomingMessage)

 * If AUTH_TOKEN is not set, all connections are allowed.
 */
export function validateAuthToken(req: IncomingMessage): boolean {
  const authToken = process.env.AUTH_TOKEN;
  if (!authToken) {
    return true;
  }

  const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
  const token = url.searchParams.get("token");
  return token === authToken;
}

/**
 * Simple per-IP rate limiter for new connections.