Add INTERNAL_API_KEY authentication for error_log_api; update all services to send key

error_log_api/index.js

@@ -32,6 +32,21 @@ const app = express();
 app.use(express.json({ limit: "64kb" }));
 app.use(cors());
 
+const INTERNAL_API_KEY = process.env.INTERNAL_API_KEY || "";
+
+function requireInternalKey(req, res, next) {
+  const key = req.headers["x-internal-api-key"];
+  if (!INTERNAL_API_KEY) {
+    log("error", "INTERNAL_API_KEY not configured on server");
+    return res.status(500).json({ error: "server misconfiguration" });
+  }
+  if (!key || key !== INTERNAL_API_KEY) {
+    log("warn", "Unauthorized error_log attempt", { ip: req.ip, path: req.originalUrl });
+    return res.status(401).json({ error: "unauthorized" });
+  }
+  next();
+}
+
 const ERROR_LOG_API_URL =
   process.env.ERROR_LOG_API_URL ||
   "https://error.xtransit.testinstance.nl/error_log";
@@ -48,7 +63,10 @@ async function reportError({ partofservice, error }) {
   try {
     await fetch(ERROR_LOG_API_URL, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        "Content-Type": "application/json",
+        "x-internal-api-key": process.env.INTERNAL_API_KEY || "",
+      },
       body: JSON.stringify({
         service: "error_log_api",
         partofservice,
@@ -142,7 +160,7 @@ app.get("/health", async (_req, res) => {
   }
 });
 
-app.post("/error_log", async (req, res) => {
+app.post("/error_log", requireInternalKey, async (req, res) => {
   try {
     const service = req.body?.service;
     const partofservice =