make endpoints behind flag

Author: motatoes

backend/bootstrap/main.go

@@ -222,9 +222,11 @@ func Bootstrap(templates embed.FS, diggerController controllers.DiggerController
 	runsApiGroup.POST("/:run_id/approve", controllers.ApproveRun)
 
 	// internal endpoints not meant to be exposed to public and protected behind webhook secret
-	r.POST("_internal/update_repo_cache", middleware.InternalApiAuth(), diggerController.UpdateRepoCache)
-	r.POST("_internal/api/create_user", middleware.InternalApiAuth(), diggerController.CreateUserInternal)
-	r.POST("_internal/api/upsert_org", middleware.InternalApiAuth(), diggerController.UpsertOrgInternal)
+	if enableInternal := os.Getenv("DIGGER_ENABLE_INTERNAL_ENDPOINTS"); enableInternal == "true" {
+		r.POST("_internal/update_repo_cache", middleware.InternalApiAuth(), diggerController.UpdateRepoCache)
+		r.POST("_internal/api/create_user", middleware.InternalApiAuth(), diggerController.CreateUserInternal)
+		r.POST("_internal/api/upsert_org", middleware.InternalApiAuth(), diggerController.UpsertOrgInternal)
+	}
 
 	fronteggWebhookProcessor.POST("/create-org-from-frontegg", controllers.CreateFronteggOrgFromWebhook)