Feat/client authentication api key (#915)

* feat: Add Auth Admin routes to JS client

* include api key verification for admin

* undo changes

* undo file changes

* improve api key auth

* auth documentation in readme

* pr feedback

* typo

Co-authored-by: olivermrbl <oliver@mrbltech.com>

packages/medusa-js/src/request.ts

@@ -2,12 +2,18 @@ import axios, { AxiosError, AxiosInstance } from "axios"
 import * as rax from "retry-axios"
 import { v4 as uuidv4 } from "uuid"
 
+const unAuthenticatedAdminEndpoints = {
+  "/admin/auth": "POST",
+  "/admin/users/password-token": "POST",
+  "/admin/users/reset-password": "POST",
+  "/admin/invites/accept": "POST",
+}
 export interface Config {
   baseUrl: string
   maxRetries: number
+  apiKey?: string
 }
 export interface RequestOptions {
-  apiKey?: string
   timeout?: number
   numberOfRetries?: number
 }
@@ -83,6 +89,13 @@ class Client {
       .join("-")
   }
 
+  requiresAuthentication(path, method): boolean {
+    return (
+      path.startsWith("/admin") &&
+      unAuthenticatedAdminEndpoints[path] !== method
+    )
+  }
+
   /**
    * Creates all the initial headers.
    * We add the idempotency key, if the request is configured to retry.
@@ -101,10 +114,10 @@ class Client {
       "Content-Type": "application/json",
     }
 
-    // TODO: if route is an authenticated route, add api key
-    if (path.startsWith("/admin")) {
+    if (this.config.apiKey && this.requiresAuthentication(path, method)) {
       defaultHeaders = {
         ...defaultHeaders,
+        Authorization: `Bearer ${this.config.apiKey}`,
       }
     }