feat: add env vars to disable render endpoints

BLOCKY_DISABLE_GLB/PNG/GIF/MP4 return 403 when set to true

internal/api/middleware.go

@@ -0,0 +1,35 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"blockyserver/internal/config"
+)
+
+// EndpointGuard creates middleware that returns 403 if endpoint is disabled
+func EndpointGuard(enabled bool, endpointName string) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if !enabled {
+				w.Header().Set("Content-Type", "application/json")
+				w.WriteHeader(http.StatusForbidden)
+				json.NewEncoder(w).Encode(ErrorResponse{
+					Error: endpointName + " endpoint is disabled",
+				})
+				return
+			}
+			next.ServeHTTP(w, r)
+		})
+	}
+}
+
+// NewEndpointGuards creates guards for all render endpoints based on config
+func NewEndpointGuards(cfg *config.EndpointConfig) map[string]func(http.Handler) http.Handler {
+	return map[string]func(http.Handler) http.Handler{
+		"glb": EndpointGuard(cfg.GLBEnabled, "/render/glb"),
+		"png": EndpointGuard(cfg.PNGEnabled, "/render/png"),
+		"gif": EndpointGuard(cfg.GIFEnabled, "/render/gif"),
+		"mp4": EndpointGuard(cfg.MP4Enabled, "/render/mp4"),
+	}
+}

internal/api/server.go

@@ -4,6 +4,7 @@ import (
 	"net/http"
 	"time"
 
+	"blockyserver/internal/config"
 	"blockyserver/internal/service"
 
 	"github.com/go-chi/chi/v5"
@@ -19,6 +20,10 @@ func NewServer(svc *service.MergeService) http.Handler {
 	r.Use(middleware.Recoverer)
 	r.Use(middleware.Timeout(60 * time.Second))
 
+	// Load endpoint config
+	cfg := config.LoadEndpointConfig()
+	guards := NewEndpointGuards(cfg)
+
 	// Create handlers
 	h := NewHandlers(svc)
 
@@ -26,10 +31,10 @@ func NewServer(svc *service.MergeService) http.Handler {
 	r.Get("/health", h.HandleHealth)
 	r.Get("/openapi.json", h.HandleOpenAPISpec)
 	r.Get("/docs", h.HandleSwaggerUI)
-	r.Post("/render/glb", h.HandleGLB)
-	r.Post("/render/png", h.HandlePNG)
-	r.Post("/render/gif", h.HandleGIF)
-	r.Post("/render/mp4", h.HandleMP4)
+	r.With(guards["glb"]).Post("/render/glb", h.HandleGLB)
+	r.With(guards["png"]).Post("/render/png", h.HandlePNG)
+	r.With(guards["gif"]).Post("/render/gif", h.HandleGIF)
+	r.With(guards["mp4"]).Post("/render/mp4", h.HandleMP4)
 
 	return r
 }