feat: add password gate

app/api/verify-access/route.ts

@@ -0,0 +1,45 @@
+import { NextResponse } from "next/server";
+
+/**
+ * GET /api/verify-access
+ *
+ * Returns whether password protection is enabled at runtime.
+ * This is called by the PasswordGate client component on mount
+ * to determine if it should show the password prompt.
+ */
+export async function GET() {
+  const accessKey = process.env.ACCESS_KEY;
+  const enabled = !!accessKey;
+  return NextResponse.json({ enabled });
+}
+
+/**
+ * POST /api/verify-access
+ *
+ * Validates a submitted key against the ACCESS_KEY environment variable.
+ * Returns { valid: true } if matched, { valid: false } otherwise.
+ *
+ * If ACCESS_KEY is not set, all keys are rejected (locked by default).
+ */
+export async function POST(request: Request) {
+  try {
+    const body = await request.json();
+    const submitted = body?.key;
+
+    if (typeof submitted !== "string" || !submitted) {
+      return NextResponse.json({ valid: false }, { status: 400 });
+    }
+
+    const accessKey = process.env.ACCESS_KEY;
+
+    // If no ACCESS_KEY is configured, reject everything
+    if (!accessKey) {
+      return NextResponse.json({ valid: false }, { status: 403 });
+    }
+
+    const valid = submitted === accessKey;
+    return NextResponse.json({ valid }, { status: valid ? 200 : 401 });
+  } catch {
+    return NextResponse.json({ valid: false }, { status: 400 });
+  }
+}