Add InternalAuthFilter for service-to-service endpoints

Shipped

April 18, 2026 at 3:48 PM UTC

Author

Kamo

Commit

657fe33

Validates X-Internal-Auth header on /api/email/templates/send and /api/email/templates/seed-org/* paths. Other paths bypass this filter (user session auth handles them). Secret comes from INTERNAL_AUTH_SECRET env var. Also adds transactional.smtp.user / transactional.smtp.pass config stubs consumed by EmailTemplateService — all three are sourced from the k8s configmap in production. Part of SP1.