chore: use common internal auth

cmd/server/main.go

@@ -194,10 +194,11 @@ func (a *app) serveHTTP(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusNotFound, "not found")
 		return
 	}
-	if !a.checkInternalAuth(w, r) {
-		return
+	commonmw.InternalAuth(a.cfg.InternalAPIKey)(http.HandlerFunc(a.serveAPI)).ServeHTTP(w, r)
 }
 
+func (a *app) serveAPI(w http.ResponseWriter, r *http.Request) {
+	path := a.apiPath(r.URL.Path)
 	ctx := r.Context()
 	switch {
 	case r.Method == http.MethodGet && path == "/api/v1/access/me":
@@ -233,18 +234,6 @@ func (a *app) serveHTTP(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-func (a *app) checkInternalAuth(w http.ResponseWriter, r *http.Request) bool {
-	want := strings.TrimSpace(a.cfg.InternalAPIKey)
-	if want == "" {
-		return true
-	}
-	if r.Header.Get("X-Internal-Key") != want {
-		writeError(w, http.StatusUnauthorized, "unauthorized")
-		return false
-	}
-	return true
-}
-
 func (a *app) apiPath(path string) string {
 	base := strings.TrimRight(a.cfg.PublicBasePath, "/")
 	if base != "" && strings.HasPrefix(path, base+"/") {