From 3d0c211af814ee09497e71671c027e4f5a1dddbb Mon Sep 17 00:00:00 2001
From: Simon Axelsson <simon@siax.io>
Date: Mon, 7 Sep 2026 17:19:26 +0200
Subject: [PATCH] security: allow only authenticated internal access to
 canonical ER bridge

---
 middleware.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/middleware.ts b/middleware.ts
index 31968c3..b26b22a 100644
--- a/middleware.ts
+++ b/middleware.ts
@@ -26,6 +26,7 @@ const EXEMPT_PATTERNS: RegExp[] = [
 const INTERNAL_ONLY_ROUTES: RegExp[] = [
   /^\/api\/0pt\/quality\/bridge-run$/,
   /^\/api\/0pt\/internal\/evidence-outbox\/dispatch$/,
+  /^\/api\/0pt\/internal\/er\/candidates$/,
 ];
 
 let _authDiagCount = 0;