import type { APIContext } from 'astro';
import { env } from '@/server/env';
import { verifyE2eProof } from '@/server/security/e2e-proof';

const NOT_FOUND = (): Response => new Response(null, { status: 404 });

/** 404 (stealth) unless the caller presents a valid time-bound, body-bound E2E proof. */
export async function requireE2eSecret(ctx: APIContext): Promise<Response | null> {
  return (await verifyE2eProof(ctx.request, env)) ? null : NOT_FOUND();
}