Harden render server and import boundaries

src/lib/serverExport.ts

@@ -2,6 +2,7 @@ import type { Scene } from '@/types/scene'
 
 const DEFAULT_SERVER = 'http://localhost:6000'
 const SERVER_URL = (import.meta.env.VITE_RENDER_SERVER as string | undefined) ?? DEFAULT_SERVER
+const RENDER_TOKEN = import.meta.env.VITE_RENDER_TOKEN as string | undefined
 
 export interface ServerRenderOptions {
   onProgress?: (progress: number) => void
@@ -27,7 +28,10 @@ export async function renderOnServer(
   const baseUrl = SERVER_URL
   const startRes = await fetch(`${baseUrl}/render`, {
     method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
+    headers: {
+      'Content-Type': 'application/json',
+      ...(RENDER_TOKEN ? { Authorization: `Bearer ${RENDER_TOKEN}` } : {}),
+    },
     body: JSON.stringify({
       scene,
       options: {
@@ -42,18 +46,19 @@ export async function renderOnServer(
     const body = await startRes.text().catch(() => '')
     throw new Error(`Server start failed (${startRes.status}): ${body.slice(0, 200)}`)
   }
-  const { jobId } = (await startRes.json()) as { jobId: string }
-  if (!jobId) throw new Error('Server did not return a jobId')
+  const { jobId, accessToken } = (await startRes.json()) as { jobId: string; accessToken: string }
+  if (!jobId || !accessToken) throw new Error('Server did not return job credentials')
 
   const downloadUrl = await new Promise<string>((resolve, reject) => {
-    const es = new EventSource(`${baseUrl}/render/${jobId}/events`)
+    const jobToken = encodeURIComponent(accessToken)
+    const es = new EventSource(`${baseUrl}/render/${jobId}/events?token=${jobToken}`)
     const onAbort = () => {
       try {
         es.close()
       } catch {
         /* noop */
       }
-      fetch(`${baseUrl}/render/${jobId}`, { method: 'DELETE' }).catch(() => {})
+      fetch(`${baseUrl}/render/${jobId}?token=${jobToken}`, { method: 'DELETE' }).catch(() => {})
       reject(new DOMException('aborted', 'AbortError'))
     }
     if (opts.signal) {