From 8b6c6273ee57124e335855ccaf71f230089e04e4 Mon Sep 17 00:00:00 2001
From: Volnei Munhoz <volnei@cal.com>
Date: Tue, 2 Dec 2025 13:53:17 -0300
Subject: [PATCH] Fix api v1 block paths (#25554)

---
 apps/api/v1/middleware.ts | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 apps/api/v1/middleware.ts

diff --git a/apps/api/v1/middleware.ts b/apps/api/v1/middleware.ts
new file mode 100644
index 0000000000..90b2c98ffe
--- /dev/null
+++ b/apps/api/v1/middleware.ts
@@ -0,0 +1,25 @@
+import type { NextRequest } from "next/server";
+import { NextResponse } from "next/server";
+
+export const BLOCKED_ROUTE_SEGMENTS = ["_get", "_post", "_patch", "_delete", "_auth-middleware"] as const;
+
+const pathContainsBlockedSegment = (pathname: string) =>
+  pathname
+    .split("/")
+    .filter(Boolean)
+    .some((segment) => BLOCKED_ROUTE_SEGMENTS.includes(segment as (typeof BLOCKED_ROUTE_SEGMENTS)[number]));
+
+export function middleware(request: NextRequest) {
+  if (pathContainsBlockedSegment(request.nextUrl.pathname)) {
+    return NextResponse.json({ message: "Forbidden" }, { status: 403 });
+  }
+
+  return NextResponse.next();
+}
+
+export const config = {
+  matcher: BLOCKED_ROUTE_SEGMENTS.flatMap((segment) => [
+    `/:path*/${segment}/:rest*`,
+    `/:path*/${segment}`,
+  ]),
+};