@tungthedev/streams-server 0.2.0 → 0.2.1

package/SECURITY.md

@@ -22,7 +22,7 @@ When reporting a vulnerability, include:
 The full Prisma Streams server requires an explicit startup auth mode:
 
 - `--auth-strategy api-key` enables built-in API key authentication for every
-  request
+  request except `GET /health`
 - `--no-auth` disables built-in authentication for deployments that rely on a
   trusted external boundary
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tungthedev/streams-server",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Bun-only self-hosted Prisma Streams server.",
   "repository": {
     "type": "git",

package/src/auth.ts

@@ -5,10 +5,10 @@ export type AuthConfig =
   | {
       mode: "none";
     }
-	  | {
-	      mode: "api-key";
-	      apiKeyBytes: Buffer;
-	    };
+  | {
+      mode: "api-key";
+      apiKeyBytes: Buffer;
+    };
 
 export type AuthConfigError = {
   message: string;
@@ -111,6 +111,8 @@ function credentialsMatch(config: Extract<AuthConfig, { mode: "api-key" }>, cred
 
 export function authenticateRequest(config: AuthConfig, request: Request): Response | null {
   if (config.mode === "none") return null;
+  const url = new URL(request.url);
+  if (request.method === "GET" && url.pathname === "/health") return null;
   const credential = parseBearerCredential(request.headers.get("authorization"));
   if (credential == null || !credentialsMatch(config, credential)) {
     return unauthorized();