api/admin/scheduledTasks/runDue.php

@@ -1,7 +1,7 @@
 <?php
 require_once __DIR__ . '/../../helpers.php';
 require_once __DIR__ . '/_cronUtils.php';
-requireCronSecret();
+// No runAuth() — this is a cron/public endpoint
 
 /**
  * Process all due scheduled tasks.

api/helpers.php

@@ -300,30 +300,6 @@ function sendSMS(string $to, string $body): array {
     return ['success' => false, 'message' => $errMsg];
 }
 
-// ============================================
-// CRON AUTH
-// ============================================
-
-/**
- * Require a valid X-Cron-Secret header for cron/scheduled task endpoints.
- * The secret is read from the PAYFRIT_CRON_SECRET environment variable.
- * Aborts with 403 if missing or mismatched.
- */
-function requireCronSecret(): void {
-    $expected = trim(getenv('PAYFRIT_CRON_SECRET') ?: '');
-    if ($expected === '') {
-        error_log('[cron_auth] PAYFRIT_CRON_SECRET env var is not set. Blocking request.');
-        http_response_code(403);
-        jsonResponse(['OK' => false, 'ERROR' => 'cron_secret_not_configured'], 403);
-    }
-
-    $provided = headerValue('X-Cron-Secret');
-    if ($provided === '' || !hash_equals($expected, $provided)) {
-        http_response_code(403);
-        jsonResponse(['OK' => false, 'ERROR' => 'invalid_cron_secret'], 403);
-    }
-}
-
 // ============================================
 // AUTH MIDDLEWARE
 // ============================================
@@ -549,14 +525,18 @@ function runAuth(): void {
         $businessId = (int) $bizHeader;
     }
 
-    // Check if public route (exact match only)
+    // Check if public route
     $isPublic = false;
     foreach (PUBLIC_ROUTES as $route) {
-        if ($path === strtolower($route)) {
+        if (str_contains($path, strtolower($route))) {
             $isPublic = true;
             break;
         }
     }
+    // Also allow /api/admin/ paths
+    if (str_contains($path, '/api/admin/')) {
+        $isPublic = true;
+    }
 
     if (!$isPublic) {
         if ($userId <= 0) {

cron/expireStaleChats.php

@@ -1,6 +1,6 @@
 <?php
 require_once __DIR__ . '/../api/helpers.php';
-requireCronSecret();
+// No runAuth() — cron/public endpoint
 
 /**
  * Expire stale chats (older than 20 minutes with no recent activity).

cron/expireTabs.php

@@ -1,7 +1,7 @@
 <?php
 require_once __DIR__ . '/../api/helpers.php';
 require_once __DIR__ . '/../api/config/stripe.php';
-requireCronSecret();
+// No runAuth() — cron/public endpoint
 
 /**
  * Scheduled task to handle tab expiry and cleanup.