feat(vercel): middleware verification (#9987)

* feat(vercel): verification for edge middleware

* add changeset

* Apply suggestions from code review

---------

Co-authored-by: Nate Moore <natemoo-re@users.noreply.github.com>

1 files changed, 13 insertions, 4 deletions

diff --git a/packages/integrations/vercel/src/serverless/middleware.ts b/packages/integrations/vercel/src/serverless/middleware.ts
index 648bc0d68..91d032873 100644
--- a/packages/integrations/vercel/src/serverless/middleware.ts
+++ b/packages/integrations/vercel/src/serverless/middleware.ts
@@ -1,7 +1,12 @@
 import { existsSync } from 'node:fs';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { builtinModules } from 'node:module';
-import { ASTRO_LOCALS_HEADER, ASTRO_PATH_HEADER, NODE_PATH } from './adapter.js';
+import {
+	ASTRO_MIDDLEWARE_SECRET_HEADER,
+	ASTRO_LOCALS_HEADER,
+	ASTRO_PATH_HEADER,
+	NODE_PATH,
+} from './adapter.js';
 
 /**
  * It generates the Vercel Edge Middleware file.
@@ -17,11 +22,13 @@ import { ASTRO_LOCALS_HEADER, ASTRO_PATH_HEADER, NODE_PATH } from './adapter.js'
 export async function generateEdgeMiddleware(
 	astroMiddlewareEntryPointPath: URL,
 	vercelEdgeMiddlewareHandlerPath: URL,
-	outPath: URL
+	outPath: URL,
+	middlewareSecret: string
 ): Promise<URL> {
 	const code = edgeMiddlewareTemplate(
 		astroMiddlewareEntryPointPath,
-		vercelEdgeMiddlewareHandlerPath
+		vercelEdgeMiddlewareHandlerPath,
+		middlewareSecret
 	);
 	// https://vercel.com/docs/concepts/functions/edge-middleware#create-edge-middleware
 	const bundledFilePath = fileURLToPath(outPath);
@@ -56,7 +63,8 @@ export async function generateEdgeMiddleware(
 
 function edgeMiddlewareTemplate(
 	astroMiddlewareEntryPointPath: URL,
-	vercelEdgeMiddlewareHandlerPath: URL
+	vercelEdgeMiddlewareHandlerPath: URL,
+	middlewareSecret: string
 ) {
 	const middlewarePath = JSON.stringify(
 		fileURLToPath(astroMiddlewareEntryPointPath).replace(/\\/g, '/')
@@ -85,6 +93,7 @@ export default async function middleware(request, context) {
 		fetch(new URL('${NODE_PATH}', request.url), {
 			headers: {
 				...Object.fromEntries(request.headers.entries()),
+				'${ASTRO_MIDDLEWARE_SECRET_HEADER}': '${middlewareSecret}',
 				'${ASTRO_PATH_HEADER}': request.url.replace(origin, ''),
 				'${ASTRO_LOCALS_HEADER}': trySerializeLocals(ctx.locals)
 			}