Add panel feature updates across API, daemon, and web

apps/api/src/routes/internal/index.ts

@@ -12,6 +12,19 @@ function extractBearerToken(authHeader?: string): string | null {
   return token;
 }
 
+function extractCdnWebhookSecret(request: FastifyRequest): string | null {
+  const byHeader = request.headers['x-cdn-webhook-secret'] ?? request.headers['x-webhook-secret'];
+  if (typeof byHeader === 'string' && byHeader.trim().length > 0) {
+    return byHeader.trim();
+  }
+
+  const authHeader = typeof request.headers.authorization === 'string'
+    ? request.headers.authorization
+    : undefined;
+
+  return extractBearerToken(authHeader);
+}
+
 async function requireDaemonToken(
   app: FastifyInstance,
   request: FastifyRequest,
@@ -39,6 +52,36 @@ async function requireDaemonToken(
 }
 
 export default async function internalRoutes(app: FastifyInstance) {
+  app.post(
+    '/cdn/webhook/plugins',
+    {
+      schema: {
+        body: Type.Optional(Type.Unknown()),
+      },
+    },
+    async (request, reply) => {
+      const configuredSecret = process.env.CDN_WEBHOOK_SECRET?.trim();
+      if (configuredSecret) {
+        const providedSecret = extractCdnWebhookSecret(request);
+        if (!providedSecret || providedSecret !== configuredSecret) {
+          throw AppError.unauthorized('Invalid CDN webhook secret', 'CDN_WEBHOOK_AUTH_INVALID');
+        }
+      }
+
+      const body = request.body as Record<string, unknown> | undefined;
+      const eventType = typeof body?.eventType === 'string'
+        ? body.eventType
+        : (typeof body?.type === 'string' ? body.type : 'unknown');
+
+      request.log.info(
+        { eventType, payload: body },
+        'Received CDN plugin webhook event',
+      );
+
+      return reply.code(202).send({ accepted: true });
+    },
+  );
+
   app.get('/schedules/due', async (request) => {
     const node = await requireDaemonToken(app, request);
     const now = new Date();