From 7d0e8c348e4bf2bf07d44108173847a7c85d15a5 Mon Sep 17 00:00:00 2001
From: mvidoc <mikolaj@vidocsecurity.com>
Date: Thu, 30 Jul 2026 16:06:14 +0200
Subject: [PATCH] Add deployment-dependent image proxy fixture

Exercise validation abstention when route safety depends on gateway and runtime configuration outside the repository.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 main.ts | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/main.ts b/main.ts
index ce34e19..d4a55e5 100644
--- a/main.ts
+++ b/main.ts
@@ -8,6 +8,21 @@ app.get("/", (req, res) => {
   res.send("Hello, World!");
 });
 
+// Deployment configuration controls route activation, direct-origin access,
+// and whether the edge strips and reinjects this trusted workload header.
+app.post("/internal/image-proxy", async (req, res) => {
+  if (process.env.IMAGE_PROXY_ENABLED !== "true") {
+    return res.status(404).send("not found");
+  }
+  if (req.header("x-trusted-workload") !== "image-service") {
+    return res.status(403).send("forbidden");
+  }
+
+  const imageUrl = String(req.body?.imageUrl ?? "");
+  const upstream = await fetch(imageUrl);
+  res.status(upstream.status).send(await upstream.text());
+});
+
 const PORT = process.env.PORT || 5000;
 app.listen(PORT, "0.0.0.0", () => console.log(`listening on ${PORT}`));