From faef1fe5e02e4b73a9a60031c6465116dc43125b Mon Sep 17 00:00:00 2001
From: alexpaynex <55271826-alexpaynex@users.noreply.replit.com>
Date: Thu, 19 Mar 2026 20:05:09 +0000
Subject: [PATCH] Add health check endpoint and production secret enforcement
 for relay policy

Adds a GET `/api/relay/policy` health check endpoint and enforces the `RELAY_POLICY_SECRET` environment variable in production to secure the POST `/api/relay/policy` endpoint.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 418bf6f8-212b-4bb0-a7a5-8231a061da4e
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Event-Id: 7ee87f59-1dfd-4a71-8c6f-5938330c7b4a
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/9f85e954-647c-46a5-90a7-396e495a805a/418bf6f8-212b-4bb0-a7a5-8231a061da4e/Q83Uqvu
Replit-Helium-Checkpoint-Created: true
---
 artifacts/api-server/src/routes/relay.ts | 35 ++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/artifacts/api-server/src/routes/relay.ts b/artifacts/api-server/src/routes/relay.ts
index 33b72a1..16e8351 100644
--- a/artifacts/api-server/src/routes/relay.ts
+++ b/artifacts/api-server/src/routes/relay.ts
@@ -30,6 +30,24 @@ const logger = makeLogger("relay-policy");
 const router = Router();
 
 const RELAY_POLICY_SECRET = process.env["RELAY_POLICY_SECRET"] ?? "";
+const IS_PROD = process.env["NODE_ENV"] === "production";
+
+// Production enforcement: RELAY_POLICY_SECRET must be set in production.
+// An unprotected relay policy endpoint in production allows any caller on the
+// network to whitelist events — a serious trust-system bypass.
+if (!RELAY_POLICY_SECRET) {
+  if (IS_PROD) {
+    logger.error(
+      "RELAY_POLICY_SECRET is not set in production — " +
+      "POST /api/relay/policy is open to any caller. " +
+      "Set this secret in the API server environment and in the relay-policy sidecar.",
+    );
+  } else {
+    logger.warn(
+      "RELAY_POLICY_SECRET not set — /api/relay/policy accepts local-only requests (dev mode)",
+    );
+  }
+}
 
 // ── Types ─────────────────────────────────────────────────────────────────────
 
@@ -64,6 +82,23 @@ function reject(id: string, msg: string): PolicyDecision {
   return { id, action: "reject", msg };
 }
 
+// ── GET /relay/policy ─────────────────────────────────────────────────────────
+// Health + roundtrip probe. Returns the relay's current policy state and runs
+// a synthetic event through evaluatePolicy() so operators can verify the full
+// sidecar → API path with: curl https://alexanderwhitestone.com/api/relay/policy
+//
+// Not secret-gated — it contains no privileged information.
+
+router.get("/relay/policy", (_req: Request, res: Response) => {
+  const probe = evaluatePolicy("0000000000000000000000000000000000000000000000000000000000000000", "probe", 1);
+  res.json({
+    ok: true,
+    secretConfigured: !!RELAY_POLICY_SECRET,
+    bootstrapDecision: probe.action,
+    bootstrapMsg: probe.msg,
+  });
+});
+
 // ── POST /relay/policy ────────────────────────────────────────────────────────
 
 router.post("/relay/policy", (req: Request, res: Response) => {