@galatiq/demo-gateway-middleware

Vercel Edge Middleware that admits only requests from Galatiq's demo-gateway via a shared header secret. Drop it into any Vercel-hosted Galatiq client demo to gate the public *.vercel.app URL behind gateway auth.

Install

npm install @galatiq/demo-gateway-middleware

Use

Create middleware.js (or middleware.ts) at the root of the Vercel project:

export { default, config } from '@galatiq/demo-gateway-middleware';

That's the whole file. Both default (the handler) and config (the matcher) come from the package — Vercel auto-discovers them.

Configure

Set these env vars in the Vercel project — Settings → Environment Variables:

| Name | Value | Required | |---|---|---| | GATEWAY_SECRET | A long random string. Must match the value stored on this demo's row in demo-gateway's admin UI. Generate with openssl rand -hex 32. | ✅ | | GATEWAY_URL | Override the default gateway URL. Defaults to https://galatiq-demo-gateway-production.up.railway.app. | optional |

Apply both to Production (and Preview if you want gating there).

How it works

Browser ──► demo-gateway (auth)
              │ proxy fetch + x-demo-gateway-secret: <secret>
              ▼
          *.vercel.app ──► middleware verifies header ──► demo

Browser ──► *.vercel.app directly  ──► middleware sees no header ──► 302 to /login

• Request carries x-demo-gateway-secret: <secret> matching GATEWAY_SECRET → request passes through to the demo.
• Header missing or wrong → 302 redirect to ${GATEWAY_URL}/login.
• GATEWAY_SECRET env var not set → middleware fails closed with a 503 Demo gateway not configured. The demo is never served unprotected.

The matcher gates every path except Vercel internals (/_vercel/*) and /favicon.ico. That includes static assets (/js/*, /css/*, etc.) and API routes (/api/*) — everything goes through gateway auth.

Rotating the secret

1. Generate a new value: openssl rand -hex 32.
2. Update GATEWAY_SECRET in Vercel → redeploy the demo.
3. Update the demo's row in demo-gateway's admin UI → Save Changes.

If you update Vercel first, gateway requests carrying the old secret get rejected until you also update the admin UI. Plan for ~30 seconds of "Demo unavailable" during a rotation, or update the admin UI first.

Versioning

Standard SemVer:

• major — change to the wire protocol (header name, redirect target shape) or breaking API change for consumers.
• minor — new optional behavior, backwards compatible.
• patch — bug fixes.

License

MIT