From db3509ab4f2115795b72d3b8def147b3f5ed0c9c Mon Sep 17 00:00:00 2001
From: Simon <simon@siax.io>
Date: Wed, 16 Sep 2026 15:13:13 +0200
Subject: [PATCH] fix: add fail-closed preHandler auth check

---
 apps/api/src/index.ts | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/apps/api/src/index.ts b/apps/api/src/index.ts
index f932d37..9187b0e 100644
--- a/apps/api/src/index.ts
+++ b/apps/api/src/index.ts
@@ -11,6 +11,15 @@ async function main() {
     timestamp: new Date().toISOString(),
   }));
 
+  server.addHook("preHandler", async (request, reply) => {
+    if (request.url === "/health") return;
+    const auth = request.headers.authorization;
+    if (!auth || !auth.startsWith("Bearer ")) {
+      await reply.code(401).send({ error: "Unauthorized" });
+      return;
+    }
+  });
+
   server.get("/", async () => ({
     name: "c0py",
     version: "0.1.0",