backend/middleware/auth.js

import { config } from "../config/index.js";

export function authMiddleware(req, res, next) {
  if (!config.apiKey) return next();

  const header = req.header("authorization") ?? "";
  const token = header.startsWith("Bearer ") ? header.slice("Bearer ".length) : "";

  if (token !== config.apiKey) {
    res.status(401).json({ error: "unauthorized" });
    return;
  }

  next();
}