Stewardship

One shared secret, validated server-side on every request

All three apps share a single CROSS_APP_SECRET environment variable. Every cross-app fetch puts it in the Authorization header as a Bearer token. Every producer validates it before returning any data. The check happens inside the Next.js route handler — the browser never sees the secret and it never touches the client bundle.

export async function GET(req: Request) {
  const auth = req.headers.get('authorization');
  const secret = process.env.CROSS_APP_SECRET;
  if (!secret || auth !== `Bearer ${secret}`) {
    return NextResponse.json({ error: 'unauthorized' }, { status: 401 });
  }
  // ... return jobs
}

async function getJSON<T>(url: string | undefined, key: string): Promise<T[]> {
  const secret = process.env.CROSS_APP_SECRET;
  if (!url || !secret) return [];
  const res = await fetch(url, {
    headers: { Authorization: `Bearer ${secret}` },
    next: { revalidate: 300 },   // 5-min server-side cache
  });
  if (!res.ok) return [];
  const data = await res.json();
  return Array.isArray(data?.[key]) ? (data[key] as T[]) : [];
}

The next: { revalidate: 300 } call means Prosper caches the cross-app responses for 5 minutes at the server layer — fast enough to feel instant, not so aggressive that a new job or listing is stale for long. Graceful degradation is also explicit: any network failure or bad status returns an empty array, so the Planning page degrades cleanly rather than throwing.

One type mismatch between consumers

Prosper's Job interface includes salary_estimated?: boolean as an optional field. Provision's ContractJob interface doesn't define it — so Provision silently ignores the field even though Godspeed sends it. This doesn't break anything (Provision doesn't use that field), but it's a contract drift that a stricter shared-types package would prevent. In a team environment I'd extract the interfaces into a published internal package both consumers import from, so a producer changing its schema breaks the consumer's build before it breaks production.