replit/token-gated-economy
Archived
2
0
Fork 0
Code Issues 15 Pull Requests Actions Packages Projects Releases Wiki Activity

Add health check endpoint and production secret enforcement for relay policy

Browse Source 
Adds a GET `/api/relay/policy` health check endpoint and enforces the `RELAY_POLICY_SECRET` environment variable in production to secure the POST `/api/relay/policy` endpoint.

Replit-Commit-Author: Agent
Replit-Commit-Session-Id: 418bf6f8-212b-4bb0-a7a5-8231a061da4e
Replit-Commit-Checkpoint-Type: full_checkpoint
Replit-Commit-Event-Id: 7ee87f59-1dfd-4a71-8c6f-5938330c7b4a
Replit-Commit-Screenshot-Url: https://storage.googleapis.com/screenshot-production-us-central1/9f85e954-647c-46a5-90a7-396e495a805a/418bf6f8-212b-4bb0-a7a5-8231a061da4e/Q83Uqvu
Replit-Helium-Checkpoint-Created: true
This commit is contained in:
alexpaynex
2026-03-19 20:05:09 +00:00
parent cdd97922d5
commit faef1fe5e0
1 changed files with 35 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
artifacts/api-server/src/routes/relay.ts
View File

@@ -30,6 +30,24 @@ const logger = makeLogger("relay-policy");
const router = Router();
const RELAY_POLICY_SECRET = process.env["RELAY_POLICY_SECRET"] ?? "";
const IS_PROD = process.env["NODE_ENV"] === "production";
// Production enforcement: RELAY_POLICY_SECRET must be set in production.
// An unprotected relay policy endpoint in production allows any caller on the
// network to whitelist events — a serious trust-system bypass.
if (!RELAY_POLICY_SECRET) {
if (IS_PROD) {
logger.error(
"RELAY_POLICY_SECRET is not set in production — " +
"POST /api/relay/policy is open to any caller. " +
"Set this secret in the API server environment and in the relay-policy sidecar.",
);
} else {
logger.warn(
"RELAY_POLICY_SECRET not set — /api/relay/policy accepts local-only requests (dev mode)",
);
}
}
// ── Types ─────────────────────────────────────────────────────────────────────
@@ -64,6 +82,23 @@ function reject(id: string, msg: string): PolicyDecision {
return { id, action: "reject", msg };
}
// ── GET /relay/policy ─────────────────────────────────────────────────────────
// Health + roundtrip probe. Returns the relay's current policy state and runs
// a synthetic event through evaluatePolicy() so operators can verify the full
// sidecar → API path with: curl https://alexanderwhitestone.com/api/relay/policy
//
// Not secret-gated — it contains no privileged information.
router.get("/relay/policy", (_req: Request, res: Response) => {
const probe = evaluatePolicy("0000000000000000000000000000000000000000000000000000000000000000", "probe", 1);
res.json({
ok: true,
secretConfigured: !!RELAY_POLICY_SECRET,
bootstrapDecision: probe.action,
bootstrapMsg: probe.msg,
});
});
// ── POST /relay/policy ────────────────────────────────────────────────────────
router.post("/relay/policy", (req: Request, res: Response) => {