From f8adbd534e46a0db06750b458ee20a35205dadde Mon Sep 17 00:00:00 2001
From: Nikola Bjelo <nikola@bjelo.ch>
Date: Fri, 2 Nov 2018 21:31:09 +0100
Subject: [PATCH] HotFix for not allowing people to access your module from the
 outside

---
 server/app.js                 | 11 +++++++++++
 server/errors/notAllowed.json |  8 ++++++++
 2 files changed, 19 insertions(+)
 create mode 100644 server/errors/notAllowed.json

diff --git a/server/app.js b/server/app.js
index ee748bbed..b6e2c3700 100644
--- a/server/app.js
+++ b/server/app.js
@@ -11,10 +11,21 @@ const mongodbConfig = require('./models/MongoDB')
 const checkJwt = require('./auth/middleware/jwt')
 const logger = require('./utils/logger')
 
+const wrongPreshared = require('./errors/notAllowed.json')
+
 const cors = require('cors')
 
 const app = express()
 
+// Checking preshared key
+app.post('/graphql', (req, res, next) => {
+  if (req.headers.preshared === process.env.PRESHARED_GATEWAY_KEY) {
+    next();
+  } else {
+    res.send(wrongPreshared);
+  }
+});
+
 // Allow crosss-origin requests
 app.use(cors())
 
diff --git a/server/errors/notAllowed.json b/server/errors/notAllowed.json
new file mode 100644
index 000000000..b76604aa2
--- /dev/null
+++ b/server/errors/notAllowed.json
@@ -0,0 +1,8 @@
+{
+  "errors": [
+    {
+      "code": 401,
+      "message": "Wait, you're not supposed to be here, go through the gate as everyone else"
+    }
+  ]
+}