Deploy: 2026-05-21 18:06:46

whatsapp-gateway/server.js

@@ -28,11 +28,20 @@ app.use(express.json());
 
 const PORT = process.env.PORT || 3722;
 
-// Health check endpoint
+// Health check endpoint (Public)
 app.get('/health', (req, res) => {
     res.json({ status: 'healthy', service: 'Nabeh WhatsApp Gateway' });
 });
 
+// Security Middleware: Protect all /api/ routes
+app.use('/api', (req, res, next) => {
+    const secret = req.header('X-Webhook-Secret');
+    if (!process.env.WEBHOOK_SECRET || secret !== process.env.WEBHOOK_SECRET) {
+        return res.status(403).json({ error: 'Unauthorized gateway access' });
+    }
+    next();
+});
+
 // Start or retrieve a session
 app.post('/api/sessions/start', async (req, res) => {
     const { session_key, webhook_url } = req.body;