Session 13: The Slate, Africa geo-restriction, OAuth providers, PropRow + GameCard (1311 tests)

web/src/middleware.ts

@@ -1,5 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
-import { LOCALES, DEFAULT_LOCALE, LOCALE_COOKIE, LOCALE_HEADER, isLocale, Locale } from '@/lib/locales';
+import { LOCALES, DEFAULT_LOCALE, LOCALE_COOKIE, LOCALE_HEADER, COUNTRY_HEADER, isLocale, Locale } from '@/lib/locales';
 
 /**
  * Locale-detection middleware (Session 12).
@@ -66,11 +66,17 @@ function resolveLocale(req: NextRequest): Locale {
 
 export function middleware(req: NextRequest) {
   const locale = resolveLocale(req);
-  // Stamp the request header so server components can read locale
-  // via `headers().get('x-vyndr-locale')`. NextResponse.next() with
-  // request headers is the canonical pattern for this.
+  // Session 13 — Cloudflare stamps `cf-ipcountry` on every edge
+  // request. We copy it onto `x-vyndr-country` so server components
+  // don't have to know about Cloudflare directly. Empty string when
+  // requests bypass Cloudflare (local dev, direct origin hits) —
+  // consumers MUST treat empty as "unknown" and degrade
+  // conservatively (the Africa-tier gate hides the card).
+  const country = (req.headers.get('cf-ipcountry') || '').toUpperCase();
+
   const requestHeaders = new Headers(req.headers);
   requestHeaders.set(LOCALE_HEADER, locale);
+  requestHeaders.set(COUNTRY_HEADER, country);
   return NextResponse.next({
     request: { headers: requestHeaders },
   });