Whitelist bold client side api access to sending events

LostKobrakai · Dec 21, 2024 · f9747f5 · f9747f5
1 parent 9ac686c
commit f9747f5
Showing 1 changed file with 16 additions and 9 deletions.
diff --git a/lib/kobrakai_web/plugs/bold_video.ex b/lib/kobrakai_web/plugs/bold_video.ex
@@ -4,16 +4,23 @@ defmodule KobrakaiWeb.BoldVideo do
   def call(conn, _) do
     case conn.path_info do
       ["api", "bold" | rest] ->
-        conn
-        |> Plug.Conn.put_req_header("authorization", Kobrakai.Bold.api_key())
-        |> Plug.forward(
-          rest,
-          ReverseProxyPlug,
-          ReverseProxyPlug.init(
-            upstream: "https://app.boldvideo.io/",
-            response_mode: :buffer
+        if rest in [
+             ["api", "v1", "event"]
+           ] do
+          conn
+          |> Plug.Conn.put_req_header("authorization", Kobrakai.Bold.api_key())
+          |> Plug.forward(
+            rest,
+            ReverseProxyPlug,
+            ReverseProxyPlug.init(
+              upstream: "https://app.boldvideo.io/",
+              response_mode: :buffer
+            )
           )
-        )
+        else
+          conn
+          |> Plug.Conn.send_resp(401, "")
+        end
         |> Plug.Conn.halt()
 
       _ ->