From 634f1842bd94f1f036b8191dcf94209d6c9be1d9 Mon Sep 17 00:00:00 2001
From: Zac Gaetano <zgaetano@wilddragon.net>
Date: Fri, 29 May 2026 01:57:39 +0000
Subject: [PATCH] fix: add Bearer auth to capture sidecar callback and pass
 CAPTURE_TOKEN

- capture/src/index.js: read MAM_API_TOKEN from env; include
  Authorization: Bearer header in shutdown callback fetches to mam-api
  (POST /assets and POST /assets/:id/mark-empty). Without this, mam-api
  AUTH_ENABLED=true rejects the callback with 401, leaving assets stuck in live
- recorders.js: pass MAM_API_TOKEN=${CAPTURE_TOKEN} in sidecar env so the
  capture container receives the token at boot
- api_tokens: inserted capture-sidecar token (unbound, prefix b3d3d3c4)
---
 services/capture/src/index.js            | 5 +++--
 services/mam-api/src/routes/recorders.js | 1 +
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/services/capture/src/index.js b/services/capture/src/index.js
index a56f115..010c4fd 100644
--- a/services/capture/src/index.js
+++ b/services/capture/src/index.js
@@ -9,6 +9,7 @@ dotenv.config();
 const app = express();
 const PORT = process.env.PORT || 3001;
 const MAM_API_URL = process.env.MAM_API_URL || 'http://mam-api:3000';
+const MAM_API_TOKEN = process.env.MAM_API_TOKEN || '';
 
 app.use(cors());
 app.use(express.json());
@@ -128,7 +129,7 @@ async function gracefulShutdown(signal) {
           try {
             await fetch(`${MAM_API_URL}/api/v1/assets/${liveAssetId}/mark-empty`, {
               method: 'POST',
-              headers: { 'Content-Type': 'application/json' },
+              headers: { 'Content-Type': 'application/json', ...(MAM_API_TOKEN ? { 'Authorization': `Bearer ${MAM_API_TOKEN}` } : {}) },
             });
           } catch (e) {
             console.error('[shutdown] failed to flag empty asset:', e.message);
@@ -138,7 +139,7 @@ async function gracefulShutdown(signal) {
         try {
           const res = await fetch(`${MAM_API_URL}/api/v1/assets`, {
             method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
+            headers: { 'Content-Type': 'application/json', ...(MAM_API_TOKEN ? { 'Authorization': `Bearer ${MAM_API_TOKEN}` } : {}) },
             body: JSON.stringify({
               projectId:  completed.projectId,
               binId:      completed.binId,
diff --git a/services/mam-api/src/routes/recorders.js b/services/mam-api/src/routes/recorders.js
index 7defc88..d6e66cb 100644
--- a/services/mam-api/src/routes/recorders.js
+++ b/services/mam-api/src/routes/recorders.js
@@ -402,6 +402,7 @@ router.post('/:id/start', async (req, res, next) => {
       `PROJECT_ID=${takeProjectId}`,
       `CLIP_NAME=${clipName}`,
       `ASSET_ID=${assetIdLive}`,
+      `MAM_API_TOKEN=${process.env.CAPTURE_TOKEN || ''}`,
       `GROWING_ENABLED=${growingEnabled ? 'true' : 'false'}`,
       `GROWING_PATH=/growing`,
     ];