From 8d192f8be32579c72a5bf7fb19e020fff50ddd5e Mon Sep 17 00:00:00 2001
From: Odweta <code.62rdl@aleeas.com>
Date: Sun, 22 Mar 2026 14:44:44 +0100
Subject: [PATCH] add auth middleware

---
 backend/main.go       |  4 ++--
 backend/middleware.go | 28 ++++++++++++++++++++++++++++
 2 files changed, 30 insertions(+), 2 deletions(-)
 create mode 100644 backend/middleware.go

diff --git a/backend/main.go b/backend/main.go
index 68ffb2f..27385d8 100644
--- a/backend/main.go
+++ b/backend/main.go
@@ -1,5 +1,3 @@
-// TODO: READ, UNDERSTAND AND ALTER
-
 package main
 
 import (
@@ -14,6 +12,8 @@ func main() {
 
 	r := chi.NewRouter()
 
+	r.Use(authMiddleware)
+
 	// routes
 	r.Get("/quotes", getQuotes)
 	r.Post("/quotes", createQuote)
diff --git a/backend/middleware.go b/backend/middleware.go
new file mode 100644
index 0000000..fbf2d45
--- /dev/null
+++ b/backend/middleware.go
@@ -0,0 +1,28 @@
+package main
+
+import (
+	"net/http"
+	"os"
+)
+
+func authMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+
+		expectedKey := os.Getenv("FRONTEND_API_KEY")
+		if expectedKey == "" {
+			http.Error(w, "server misconfigured", 500)
+			return
+		}
+
+		authHeader := r.Header.Get("Authorization")
+
+		expectedHeader := "Bearer " + expectedKey
+
+		if authHeader != expectedHeader {
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}