From efb4048ea37026ca96ebb72f31f8b04bcb44f13d Mon Sep 17 00:00:00 2001
From: Nikola Bjelo <nikola@bjelo.ch>
Date: Fri, 2 Nov 2018 21:46:55 +0100
Subject: [PATCH] HotFix (untested) adding a preshared key

---
 api/.env.sample                |  2 ++
 api/src/errors/notAllowed.json |  8 ++++++++
 api/src/index.js               | 10 ++++++++++
 3 files changed, 20 insertions(+)
 create mode 100644 api/src/errors/notAllowed.json

diff --git a/api/.env.sample b/api/.env.sample
index 089a15249..6d0e4ce91 100644
--- a/api/.env.sample
+++ b/api/.env.sample
@@ -5,6 +5,8 @@ AUTH0_DOMAIN=auth0-domain
 AUTH0_AUDIENCE=auth0-audience
 AUTH0_ISSUER=auth0-issuer
 
+PRESHARED_GATEWAY_KEY=SECRET_STUFF
+
 NODE_ENV=development
 GENERATE_SOURCEMAP=false
 COMPOSE_HTTP_TIMEOUT=2000
diff --git a/api/src/errors/notAllowed.json b/api/src/errors/notAllowed.json
new file mode 100644
index 000000000..b76604aa2
--- /dev/null
+++ b/api/src/errors/notAllowed.json
@@ -0,0 +1,8 @@
+{
+  "errors": [
+    {
+      "code": 401,
+      "message": "Wait, you're not supposed to be here, go through the gate as everyone else"
+    }
+  ]
+}
diff --git a/api/src/index.js b/api/src/index.js
index 11ed3ea81..bdac90407 100644
--- a/api/src/index.js
+++ b/api/src/index.js
@@ -20,6 +20,8 @@ import { schemaDirectives } from './directives'
 import pubsub from './pubsub'
 import { logger } from './logger'
 
+import wrongPreshared from './errors/notAllowed.json'
+
 const GRAPHQL_ENDPOINT = '/graphql'
 const GRAPHQL_SUBSCRIPTIONS = '/graphql'
 const PORT = 4001
@@ -35,6 +37,14 @@ const db = new Prisma({
 
 const app = express()
 
+app.post(GRAPHQL_ENDPOINT, (req, res, next) => {
+  if (req.headers.preshared === process.env.PRESHARED_GATEWAY_KEY) {
+    next();
+  } else {
+    res.send(wrongPreshared);
+  }
+});
+
 app.post(GRAPHQL_ENDPOINT)
 
 const corsOptions = {