From b6c5a8b4c1beab7b89e61c3a8450b2bbc31f85ac Mon Sep 17 00:00:00 2001
From: "gpt-engineer-app[bot]"
 <159125892+gpt-engineer-app[bot]@users.noreply.github.com>
Date: Thu, 23 Apr 2026 21:32:32 +0000
Subject: [PATCH] Changes

Co-authored-by: renee-png <262607627+renee-png@users.noreply.github.com>
---
 src/routes/lovable/email/transactional/send.ts | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/src/routes/lovable/email/transactional/send.ts b/src/routes/lovable/email/transactional/send.ts
index 93c9041..01c597f 100644
--- a/src/routes/lovable/email/transactional/send.ts
+++ b/src/routes/lovable/email/transactional/send.ts
@@ -53,10 +53,12 @@ export const Route = createFileRoute("/lovable/email/transactional/send")({
 
         const token = authHeader.slice('Bearer '.length).trim()
         const supabase = createClient(supabaseUrl, supabaseServiceKey)
-        const { data: { user }, error: authError } = await supabase.auth.getUser(token)
-
-        if (authError || !user) {
-          return Response.json({ error: 'Unauthorized' }, { status: 401 })
+        // Allow service-role key for server-to-server calls (cron, internal).
+        if (token !== supabaseServiceKey) {
+          const { data: { user }, error: authError } = await supabase.auth.getUser(token)
+          if (authError || !user) {
+            return Response.json({ error: 'Unauthorized' }, { status: 401 })
+          }
         }
 
         // Parse request body