HotFix (untested) adding a preshared key

api/.env.sample

@@ -5,6 +5,8 @@ AUTH0_DOMAIN=auth0-domain
 AUTH0_AUDIENCE=auth0-audience
 AUTH0_ISSUER=auth0-issuer
 
+PRESHARED_GATEWAY_KEY=SECRET_STUFF
+
 NODE_ENV=development
 GENERATE_SOURCEMAP=false
 COMPOSE_HTTP_TIMEOUT=2000

api/src/errors/notAllowed.json

@@ -0,0 +1,8 @@
+{
+  "errors": [
+    {
+      "code": 401,
+      "message": "Wait, you're not supposed to be here, go through the gate as everyone else"
+    }
+  ]
+}

api/src/index.js

@@ -20,6 +20,8 @@ import { schemaDirectives } from './directives'
 import pubsub from './pubsub'
 import { logger } from './logger'
 
+import wrongPreshared from './errors/notAllowed.json'
+
 const GRAPHQL_ENDPOINT = '/graphql'
 const GRAPHQL_SUBSCRIPTIONS = '/graphql'
 const PORT = 4001
@@ -35,6 +37,14 @@ const db = new Prisma({
 
 const app = express()
 
+app.post(GRAPHQL_ENDPOINT, (req, res, next) => {
+  if (req.headers.preshared === process.env.PRESHARED_GATEWAY_KEY) {
+    next();
+  } else {
+    res.send(wrongPreshared);
+  }
+});
+
 app.post(GRAPHQL_ENDPOINT)
 
 const corsOptions = {