From 416032942ae3337e5e2224edb63859e279d9e91e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20FAMIBELLE-PRONZOLA?= <c.pronzola@tuta.io>
Date: Sat, 4 Jul 2026 09:55:45 +0400
Subject: [PATCH] fix: restreindre bulk-translate aux appels par token API

---
 .../policies/__tests__/is-api-token.test.js   | 19 +++++++++++++++++++
 src/api/parole/policies/is-api-token.js       |  5 +++++
 src/api/parole/routes/export.js               |  2 +-
 3 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100644 src/api/parole/policies/__tests__/is-api-token.test.js
 create mode 100644 src/api/parole/policies/is-api-token.js

diff --git a/src/api/parole/policies/__tests__/is-api-token.test.js b/src/api/parole/policies/__tests__/is-api-token.test.js
new file mode 100644
index 0000000..0008320
--- /dev/null
+++ b/src/api/parole/policies/__tests__/is-api-token.test.js
@@ -0,0 +1,19 @@
+import {describe, it, expect} from 'vitest'
+import isApiToken from '../is-api-token.js'
+
+describe('is-api-token policy', () => {
+  it('autorise une requête authentifiée par token API', () => {
+    const ctx = {state: {auth: {strategy: {name: 'api-token'}}}}
+    expect(isApiToken(ctx)).toBe(true)
+  })
+
+  it('refuse une requête authentifiée autrement (ex: JWT utilisateur)', () => {
+    const ctx = {state: {auth: {strategy: {name: 'users-permissions'}}}}
+    expect(isApiToken(ctx)).toBe(false)
+  })
+
+  it('refuse une requête non authentifiée', () => {
+    const ctx = {state: {}}
+    expect(isApiToken(ctx)).toBe(false)
+  })
+})
diff --git a/src/api/parole/policies/is-api-token.js b/src/api/parole/policies/is-api-token.js
new file mode 100644
index 0000000..ef061d2
--- /dev/null
+++ b/src/api/parole/policies/is-api-token.js
@@ -0,0 +1,5 @@
+'use strict';
+
+module.exports = policyContext => {
+  return policyContext.state?.auth?.strategy?.name === 'api-token'
+}
diff --git a/src/api/parole/routes/export.js b/src/api/parole/routes/export.js
index 3067d5a..18b242b 100644
--- a/src/api/parole/routes/export.js
+++ b/src/api/parole/routes/export.js
@@ -12,7 +12,7 @@ module.exports = {
       method: 'POST',
       path: '/paroles/bulk-translate',
       handler: 'parole.bulkTranslate',
-      config: { policies: [], middlewares: [] },
+      config: { policies: ['api::parole.is-api-token'], middlewares: [] },
     },
   ],
 };