feat(utils,types,framework,medusa): store endpoints should require publishable key (#9068)

* feat(utils,types,framework,medusa): store endpoints should require publishable key * chore: fix specs * chore: fix more specs * chore: update js-sdk * chore: fix specs wrt to default SC * chore: revert custom headers + change error message * chore: fix specs * chore: fix new store specs
2024-09-11 15:08:37 +02:00
parent fdd0543011
commit a729fb3fbb
29 changed files with 1037 additions and 464 deletions
@@ -0,0 +1,68 @@
+import {
+  MedusaNextFunction,
+  MedusaResponse,
+  MedusaStoreRequest,
+} from "@medusajs/framework"
+import {
+  ApiKeyType,
+  isPresent,
+  MedusaError,
+  PUBLISHABLE_KEY_HEADER,
+} from "@medusajs/utils"
+import { refetchEntity } from "../../api/utils/refetch-entity"
+
+export function ensurePublishableApiKey() {
+  return async (
+    req: MedusaStoreRequest,
+    _res: MedusaResponse,
+    next: MedusaNextFunction
+  ) => {
+    const publishableApiKey = req.get("x-publishable-api-key")
+
+    if (!isPresent(publishableApiKey)) {
+      try {
+        throw new MedusaError(
+          MedusaError.Types.NOT_ALLOWED,
+          `Publishable API key required in the request header: ${PUBLISHABLE_KEY_HEADER}. You can manage your keys in settings in the dashboard.`
+        )
+      } catch (e) {
+        return next(e)
+      }
+    }
+
+    // TODO: Replace this with the fancy new gql fetch
+    const apiKey = await refetchEntity(
+      "api_key",
+      {
+        token: publishableApiKey,
+        type: ApiKeyType.PUBLISHABLE,
+        $or: [
+          { revoked_at: { $eq: null } },
+          { revoked_at: { $gt: new Date() } },
+        ],
+      },
+      req.scope,
+      ["id", "token", "sales_channels_link.sales_channel_id"]
+    )
+
+    if (!apiKey) {
+      try {
+        throw new MedusaError(
+          MedusaError.Types.NOT_ALLOWED,
+          `A valid publishable key is required to proceed with the request`
+        )
+      } catch (e) {
+        return next(e)
+      }
+    }
+
+    req.publishable_key_context = {
+      key: apiKey.token,
+      sales_channel_ids: apiKey.sales_channels_link.map(
+        (link) => link.sales_channel_id
+      ),
+    }
+
+    return next()
+  }
+}