const secret = process.env.ONE_CHANNEL_SECRET;

export function validateBearer(authHeader: string | undefined): boolean {
  if (!secret) {
    // If no secret is configured, reject all requests for safety
    return false;
  }
  if (!authHeader) return false;
  const token = authHeader.replace(/^Bearer\s+/i, "");
  return token === secret;
}
