Session 10: Internal auth refactor, prefetch cascade keys, Sentry, welcome email (1286 tests)

src/routes/corrections.js

@@ -25,19 +25,11 @@ const { __helpers: gradingHelpers } = require('./grading');
 const router = express.Router();
 const espnLimiter = createLimiter(API_BUDGETS.espn);
 
-const LOOPBACK_IPS = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1']);
-
-function requireInternal(req, res, next) {
-  const expected = process.env.VYNDR_INTERNAL_KEY;
-  if (!expected) return res.status(503).json({ error: 'Internal auth not configured' });
-  if (req.get('X-VYNDR-Internal-Key') !== expected) {
-    return res.status(401).json({ error: 'Invalid internal key' });
-  }
-  if (!LOOPBACK_IPS.has(req.ip || req.socket?.remoteAddress)) {
-    return res.status(403).json({ error: 'Origin not permitted' });
-  }
-  return next();
-}
+// Session 10 — uses src/middleware/internalAuth.js. /correct stays
+// loopback-restricted because the morning sweep runs co-located with
+// the API; n8n doesn't call this one.
+const { requireInternalAuth } = require('../middleware/internalAuth');
+const requireInternal = requireInternalAuth({ loopbackOnly: true });
 
 async function fetchBoxScore(sportCfg, gameId) {
   await espnLimiter.waitForToken();