irs 990 doc prarsers and some web stuffHEADmaster

1 files changed, 21 insertions, 9 deletions

diff --git a/web/api/src/index.ts b/web/api/src/index.ts
index f30fda1..9e71dc5 100644
--- a/web/api/src/index.ts
+++ b/web/api/src/index.ts
@@ -1,20 +1,32 @@
 import { Hono } from 'hono';
-import { CORE_VERSION } from '@tidyindex/core';
+import { cors } from 'hono/cors';
 
-export interface Env {
-  // DATABASE_URL: string;
-  // KEY_CACHE: KVNamespace;
-  // ACCOUNT_METER: DurableObjectNamespace;
-}
+import { auth, type AuthVars } from './auth';
 
-const app = new Hono<{ Bindings: Env }>();
+const app = new Hono<{ Variables: AuthVars }>();
 
+// Permissive CORS. The API is a public paid service authed by Bearer
+// token, not cookies, so there is no origin trust boundary to defend.
+app.use('*', cors({ origin: '*' }));
+
+// Unauthenticated liveness endpoint.
 app.get('/', (c) =>
   c.json({
     name: 'tidyindex-api',
-    version: '0',
-    core: CORE_VERSION
+    version: '0'
   })
 );
 
+// Everything past here requires a valid API key.
+app.use('/ping', auth);
+app.get('/ping', (c) => {
+  const key = c.get('apiKey');
+  return c.json({
+    message: 'pong',
+    account: key.account.email ?? key.account.id,
+    plan: key.account.plan,
+    key: key.name
+  });
+});
+
 export default app;