From 9321c5f068be9812706b7d54dfd442f322bc29e1 Mon Sep 17 00:00:00 2001
From: sax3l <simon@siax.io>
Date: Thu, 5 Nov 2026 23:52:54 +0100
Subject: [PATCH] fix(0pt): allow X-Internal-Token on internal ER candidates

P0ST and the acquisition workers call /api/0pt/internal/er/candidates with the shared service token; the route already verifies it, but middleware rejected it before the handler. Adds the route to the existing explicit allowlist.
---
 middleware.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/middleware.ts b/middleware.ts
index 1af30ef..23edfae 100644
--- a/middleware.ts
+++ b/middleware.ts
@@ -31,6 +31,7 @@ const INTERNAL_SERVICE_ROUTES: RegExp[] = [
   /^\/api\/0pt\/canonical\/facts$/,
   /^\/api\/0pt\/internal\/evidence-outbox\/dispatch$/,
   /^\/api\/0pt\/internal\/er\/candidates$/,
+  /^\/api\/0pt\/internal\/er\/candidates$/,
   /^\/api\/0pt\/search\/definitions$/,
 ];