KC-APP/backend/src/sync/sync-secret.guard.ts

import { CanActivate, ExecutionContext, ForbiddenException, Injectable } from '@nestjs/common';
import { ConfigService } from '@nestjs/config';
import { Request } from 'express';

/// Server-to-server auth for /sync/*: a shared secret header, not a user token.
@Injectable()
export class SyncSecretGuard implements CanActivate {
  constructor(private readonly config: ConfigService) {}

  canActivate(context: ExecutionContext): boolean {
    const request = context.switchToHttp().getRequest<Request>();
    const expected = this.config.getOrThrow<string>('SYNC_SHARED_SECRET');
    if (request.headers['x-sync-secret'] !== expected) {
      throw new ForbiddenException('Invalid sync secret');
    }
    return true;
  }
}