check token on api post request

pages/api/admin.ts

@@ -1,15 +1,20 @@
 import type { NextApiRequest, NextApiResponse } from "next";
 import { store, html } from "@/store";
+import config from "@/config";
 
 export default function handler(
   req: NextApiRequest,
-  res: NextApiResponse<Record<string, string>>,
+  res: NextApiResponse<Record<string, string>>
 ) {
-  if (req.method === 'POST') {
+  if (req.method === "POST") {
+    if (req.headers.token !== config.token) {
+      res.status(403).json({ error: "wrong token" });
+      return;
+    }
     // update store
-    console.log('admin', req.body)
-    const json = req.body
-    store.update(json)
+    console.log("admin", req.body);
+    const json = req.body;
+    store.update(json);
   }
   res.status(200).json(store.get());
 }

pages/api/config.ts

@@ -3,6 +3,10 @@ import config from "@/config";
 
 export default function handler(req: NextApiRequest, res: NextApiResponse) {
   if (req.method === "POST") {
+    if (req.headers.token !== config.token) {
+      res.status(403).json({ error: "wrong token" });
+      return;
+    }
     // update config
     config.begin = req.body.begin ?? config.begin;
     config.limit = req.body.limit ?? config.limit;

pages/api/html.ts

@@ -1,8 +1,13 @@
 import type { NextApiRequest, NextApiResponse } from "next";
 import { html } from "@/store";
+import config from "@/config";
 
 export default function handler(req: NextApiRequest, res: NextApiResponse) {
   if (req.method === "POST") {
+    if (req.headers.token !== config.token) {
+      res.status(403).json({ error: "wrong token" });
+      return;
+    }
     html.set(req.body.html);
   }
   res.status(200).json({