Add auth controls and headers

source/index.ts

@@ -1,7 +1,9 @@
 import { Config } from './services/config.ts';
 import { Database, MigrationService } from './services/storage/index.ts';
+import { AuthSecp256k1 } from './auth/auth.ts';
 import { ApplicationRouter } from './services/router.ts';
 import { Logger } from './utils/logger.ts';
+import type { RouteModule } from './routes/types.ts';
 
 /** Application composition root. */
 export class App {
@@ -18,12 +20,15 @@ export class App {
         const migrations = new MigrationService(database, debug);
         await migrations.migrateToLatest();
 
-        const routes = [];
+        // Create an Auth instance that can be passed in for signature validation
+        const auth = await AuthSecp256k1.create({ database }, { timestampWindowMs: config.auth.timestampWindowMs });
+
+        const routes: RouteModule[] = [];
 
         // Route loading is an explicit startup phase, not first-request work.
         // ApplicationRouter.create validates every path and rejects duplicates
         // before any client can connect.
-        const router = await ApplicationRouter.create(routes);
+        const router = await ApplicationRouter.create({ auth }, routes);
 
         return new App(database, router);
     }
@@ -44,6 +49,16 @@ export class App {
         this.stopPromise ??= this.database.destroy();
         await this.stopPromise;
     }
+
+    startUniqueRequestCleanup(cleanupIntervalMs: number, timestampWindowMs: number): void {
+        // Every 10 seconds, we will cleanup the requests table
+        setInterval(async () => {
+            await this.database.db
+                .deleteFrom('authed_requests')
+                .where('timestamp', '<', Date.now() - timestampWindowMs)
+                .execute();
+        }, cleanupIntervalMs);
+    }
 }
 
 const app = await App.create();