@galatiq/demo-gateway-middleware 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Galatiq AI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,67 @@
+# @galatiq/demo-gateway-middleware
+
+Vercel Edge Middleware that admits only requests from Galatiq's [demo-gateway](https://github.com/galatiq-ai/galatiq-internal-platform-demo-gateway) via a shared header secret. Drop it into any Vercel-hosted Galatiq client demo to gate the public `*.vercel.app` URL behind gateway auth.
+
+## Install
+
+```bash
+npm install @galatiq/demo-gateway-middleware
+```
+
+## Use
+
+Create `middleware.js` (or `middleware.ts`) at the **root** of the Vercel project:
+
+```js
+export { default, config } from '@galatiq/demo-gateway-middleware';
+```
+
+That's the whole file. Both `default` (the handler) and `config` (the matcher) come from the package — Vercel auto-discovers them.
+
+## Configure
+
+Set these env vars in the Vercel project — **Settings → Environment Variables**:
+
+| Name | Value | Required |
+|---|---|---|
+| `GATEWAY_SECRET` | A long random string. Must match the value stored on this demo's row in demo-gateway's admin UI. Generate with `openssl rand -hex 32`. | ✅ |
+| `GATEWAY_URL` | Override the default gateway URL. Defaults to `https://galatiq-demo-gateway-production.up.railway.app`. | optional |
+
+Apply both to **Production** (and **Preview** if you want gating there).
+
+## How it works
+
+```
+Browser ──► demo-gateway (auth)
+              │ proxy fetch + x-demo-gateway-secret: <secret>
+              ▼
+          *.vercel.app ──► middleware verifies header ──► demo
+
+Browser ──► *.vercel.app directly  ──► middleware sees no header ──► 302 to /login
+```
+
+- Request carries `x-demo-gateway-secret: <secret>` matching `GATEWAY_SECRET` → request passes through to the demo.
+- Header missing or wrong → 302 redirect to `${GATEWAY_URL}/login`.
+- `GATEWAY_SECRET` env var not set → middleware fails **closed** with a 503 `Demo gateway not configured`. The demo is never served unprotected.
+
+The matcher gates every path except Vercel internals (`/_vercel/*`) and `/favicon.ico`. That includes static assets (`/js/*`, `/css/*`, etc.) and API routes (`/api/*`) — everything goes through gateway auth.
+
+## Rotating the secret
+
+1. Generate a new value: `openssl rand -hex 32`.
+2. Update `GATEWAY_SECRET` in Vercel → redeploy the demo.
+3. Update the demo's row in demo-gateway's admin UI → **Save Changes**.
+
+If you update Vercel first, gateway requests carrying the old secret get rejected until you also update the admin UI. Plan for ~30 seconds of "Demo unavailable" during a rotation, or update the admin UI first.
+
+## Versioning
+
+Standard SemVer:
+
+- **major** — change to the wire protocol (header name, redirect target shape) or breaking API change for consumers.
+- **minor** — new optional behavior, backwards compatible.
+- **patch** — bug fixes.
+
+## License
+
+MIT

package/index.js

@@ -0,0 +1,40 @@
+// @galatiq/demo-gateway-middleware
+//
+// Vercel Edge Middleware for Galatiq client demos. Admits only requests
+// carrying a matching `x-demo-gateway-secret` header (injected by
+// demo-gateway on every outbound proxy fetch). Direct visitors to the
+// public *.vercel.app URL get a 302 to demo-gateway's login page.
+//
+// Required env vars on the consuming demo's Vercel project:
+//   GATEWAY_SECRET   — long random string. Must match the value stored on
+//                      this demo's row in demo-gateway's admin UI.
+//   GATEWAY_URL      — (optional) override the default gateway URL.
+
+export const config = {
+  // Gate every path except Vercel internals and the favicon. Static assets
+  // (/js/*, /css/*, etc.) are gated too — they're served only via the
+  // gateway proxy, which injects the secret on every fetch.
+  matcher: '/((?!_vercel|favicon\\.ico).*)',
+};
+
+/**
+ * @param {Request} request
+ * @returns {Response | void}
+ */
+export default function middleware(request) {
+  const secret = process.env.GATEWAY_SECRET;
+  const gatewayUrl =
+    process.env.GATEWAY_URL ||
+    'https://galatiq-demo-gateway-production.up.railway.app';
+
+  // Fail closed if the secret env var is missing — never serve unprotected.
+  if (!secret) {
+    return new Response('Demo gateway not configured', { status: 503 });
+  }
+
+  if (request.headers.get('x-demo-gateway-secret') === secret) {
+    return; // pass through to the demo
+  }
+
+  return Response.redirect(`${gatewayUrl}/login`, 302);
+}

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "@galatiq/demo-gateway-middleware",
+  "version": "1.0.0",
+  "description": "Vercel Edge Middleware that admits only requests from Galatiq's demo-gateway via a shared header secret.",
+  "type": "module",
+  "main": "./index.js",
+  "exports": {
+    ".": "./index.js"
+  },
+  "files": [
+    "index.js",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/galatiq-ai/galatiq-internal-service-demo-gateway-middleware.git"
+  },
+  "homepage": "https://github.com/galatiq-ai/galatiq-internal-service-demo-gateway-middleware#readme",
+  "bugs": "https://github.com/galatiq-ai/galatiq-internal-service-demo-gateway-middleware/issues",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "vercel",
+    "edge",
+    "middleware",
+    "galatiq",
+    "demo-gateway"
+  ]
+}