remove users debug and gate sync behind secret

server.go

@@ -84,36 +84,12 @@ func (s *Server) Routes() *http.ServeMux {
 	mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
 	})
-
-	// TEMPORARY: remove before deploy.
-	mux.HandleFunc("GET /debug/users", func(w http.ResponseWriter, r *http.Request) {
-		client, ok := s.st.(*Client)
-		if !ok {
-			http.Error(w, "not a real client", 500)
-			return
-		}
-		users, err := client.ListUsers(r.Context(), 0)
-		if err != nil {
-			http.Error(w, err.Error(), 500)
-			return
-		}
-		counts := map[string]int{}
-		eligible := 0
-		for _, u := range users {
-			if !u.Eligible(s.eligible) {
-				continue
-			}
-			eligible++
-			counts[fmt.Sprintf("%d|%s", u.ChapterID, normalizeDept(u.Department))]++
-		}
-		fmt.Fprintf(w, "%d users, %d eligible\n\n", len(users), eligible)
-		for k, n := range counts {
-			fmt.Fprintf(w, "%6d  %s\n", n, k)
-		}
-	})
-
 	// TEMPORARY: remove before deploy.
 	mux.HandleFunc("POST /debug/sync", func(w http.ResponseWriter, r *http.Request) {
+		if !s.validSecret(r) {
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			return
+		}
 		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
 		defer cancel()
 		if err := s.SyncRoster(ctx); err != nil {