feat: add scoped image sync endpoint

node-hook/src/config.mjs

@@ -18,6 +18,35 @@ function secret(name, fileName) {
   return readFileSync(path, 'utf8').trim();
 }
 
+function syncClientSecrets() {
+  const entries = text('IMAGE_SYNC_CLIENT_SECRET_FILES', '')
+    .split(',')
+    .map((entry) => entry.trim())
+    .filter(Boolean);
+  if (entries.length === 0) {
+    throw new Error('IMAGE_SYNC_CLIENT_SECRET_FILES is required');
+  }
+
+  const result = Object.create(null);
+  for (const entry of entries) {
+    const separator = entry.indexOf('=');
+    const client = entry.slice(0, separator);
+    const path = entry.slice(separator + 1);
+    if (separator < 1 || !/^[a-z0-9][a-z0-9_-]{1,31}$/.test(client) || !path) {
+      throw new Error(`Invalid image sync client entry: ${entry}`);
+    }
+    const value = readFileSync(path, 'utf8').trim();
+    if (value.length < 32) {
+      throw new Error(`Image sync secret for ${client} must be at least 32 characters`);
+    }
+    if (result[client]) {
+      throw new Error(`Duplicate image sync client: ${client}`);
+    }
+    result[client] = value;
+  }
+  return result;
+}
+
 export function loadConfig() {
   const webhookSecret = secret('GITEA_WEBHOOK_SECRET', 'GITEA_WEBHOOK_SECRET_FILE');
   const adminSecret = secret('IMAGE_ADMIN_SECRET', 'IMAGE_ADMIN_SECRET_FILE');
@@ -44,6 +73,7 @@ export function loadConfig() {
       .filter(Boolean),
     webhookSecret,
     adminSecret,
+    syncClientSecrets: syncClientSecrets(),
     maxBodyBytes: Number(text('MAX_BODY_BYTES', '1048576')),
   };
 }