Protect monitoring TG API with internal key

cmd/server/main.go

@@ -50,6 +50,7 @@ type config struct {
 	LLMTimeout          time.Duration
 	AIServiceURL        string
 	AIServiceToken      string
+	InternalAPIKey      string
 	MinioEndpoint       string
 	MinioAccessKey      string
 	MinioSecretKey      string
@@ -191,6 +192,9 @@ func (a *app) serveHTTP(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusNotFound, "not found")
 		return
 	}
+	if !a.checkInternalAuth(w, r) {
+		return
+	}
 
 	ctx := r.Context()
 	switch {
@@ -227,6 +231,18 @@ func (a *app) serveHTTP(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
+func (a *app) checkInternalAuth(w http.ResponseWriter, r *http.Request) bool {
+	want := strings.TrimSpace(a.cfg.InternalAPIKey)
+	if want == "" {
+		return true
+	}
+	if r.Header.Get("X-Internal-Key") != want {
+		writeError(w, http.StatusUnauthorized, "unauthorized")
+		return false
+	}
+	return true
+}
+
 func (a *app) apiPath(path string) string {
 	base := strings.TrimRight(a.cfg.PublicBasePath, "/")
 	if base != "" && strings.HasPrefix(path, base+"/") {
@@ -1873,6 +1889,7 @@ func loadConfig() config {
 		LLMTimeout:          time.Duration(envInt("LLM_TIMEOUT_SECONDS", 120)) * time.Second,
 		AIServiceURL:        env("AI_SERVICE_URL", ""),
 		AIServiceToken:      env("AI_SERVICE_TOKEN", ""),
+		InternalAPIKey:      env("INTERNAL_API_KEY", env("PORTAL_INTERNAL_API_KEY", "")),
 		MinioEndpoint:       env("MINIO_ENDPOINT", ""),
 		MinioAccessKey:      env("MINIO_ACCESS_KEY", ""),
 		MinioSecretKey:      env("MINIO_SECRET_KEY", ""),