From b08c4ca00d4d47e7bb6fc0bf39f4f4548cf063a8 Mon Sep 17 00:00:00 2001 From: Marcos Fargas Date: Thu, 15 Oct 2026 00:30:26 +0200 Subject: [PATCH] fix(middleware): permitir x-api-key en rutas /api/ para integraciones y tests --- src/middleware.ts | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/src/middleware.ts b/src/middleware.ts index ae24a4d..e513bf1 100644 --- a/src/middleware.ts +++ b/src/middleware.ts @@ -59,8 +59,19 @@ export async function middleware(req: NextRequest) { const url = req.nextUrl.clone(); const path = url.pathname; + const apiKeyHeader = + req.headers.get('x-api-key') || + req.headers.get('authorization')?.replace(/^Bearer\s+/i, ''); + const isApiKeyAuth = + Boolean(apiKeyHeader) && + apiKeyHeader === + (process.env.INTEGRATIONS_API_KEY || + process.env.N8N_API_KEY || + 'n8n_sec_4v_9a7d3b2c1f8e4a5d6c7b8a9e0f1a2b3c'); + // Public: login, attribution script, health, inbound webhooks (CRM), cron (Bearer CRON_SECRET), integrations (API Key) const isPublic = + (isApiKeyAuth && path.startsWith('/api/')) || path === '/login' || path === '/api/health' || path.startsWith('/api/webhooks/') ||