fix: ne plus exposer le jeton API au navigateur (recherche d'artiste)

.env.sample

@@ -3,7 +3,7 @@ API_URL=http://localhost:1337/api
 NEXT_PUBLIC_API_URL=$API_URL
 NEXT_PUBLIC_API_URL_ROOT=http://localhost:1337
 SITE_URL=http://localhost:3001
-NEXT_PUBLIC_READ_TOKEN=
+API_READ_TOKEN=
 
 # IDENTITÉ DU SITE (branding)
 NEXT_PUBLIC_SITE_NAME=PAWÒL-NU. Paroles et traductions.

app/api/awtis/__tests__/route.test.js

@@ -0,0 +1,23 @@
+import {describe, it, expect, vi, afterEach} from 'vitest'
+import {jwennToutAwtis} from '../../../../lib/oki-api'
+import {GET} from '../route'
+
+vi.mock('../../../../lib/oki-api', () => ({
+  jwennToutAwtis: vi.fn()
+}))
+
+describe('GET /api/awtis', () => {
+  afterEach(() => {
+    vi.restoreAllMocks()
+  })
+
+  it('renvoie les données de jwennToutAwtis en JSON, sans exposer de jeton', async () => {
+    jwennToutAwtis.mockResolvedValue({data: [{id: 1, alias: 'Foo'}], meta: {}})
+
+    const response = await GET()
+    const body = await response.json()
+
+    expect(body).toEqual({data: [{id: 1, alias: 'Foo'}], meta: {}})
+    expect(JSON.stringify(body)).not.toMatch(/bearer|token/i)
+  })
+})

app/api/awtis/route.js

@@ -0,0 +1,6 @@
+import {jwennToutAwtis} from '../../../lib/oki-api'
+
+export async function GET() {
+  const data = await jwennToutAwtis()
+  return Response.json(data)
+}

components/awtis/cheche-awtis.js

@@ -7,7 +7,6 @@ import Autocomplete from '@mui/material/Autocomplete'
 import Avatar from '@mui/material/Avatar'
 import Container from '@mui/material/Container'
 
-import {jwennToutAwtis} from '../../lib/oki-api'
 import {formatKuveti} from '../../lib/kuveti'
 
 const IMAGE_URL = process.env.NEXT_PUBLIC_API_URL_ROOT || 'http://localhost:1337'
@@ -27,7 +26,7 @@ export default function ChecheAwtis() {
 
     (async () => {
       try {
-        const {data} = await jwennToutAwtis()
+        const {data} = await fetch('/api/awtis').then(response => response.json())
 
         const filteredData = data.map(artiste => {
           const firstLetter = artiste.alias[0].toUpperCase()

lib/oki-api.js

@@ -2,7 +2,7 @@ import qs from 'qs'
 
 const OKI_API = process.env.NEXT_PUBLIC_API_URL || 'http://localhost:1337'
 const AWTIS_POU_CHAK_PAJ = process.env.NEXT_PUBLIC_AWTIS_POU_CHAK_PAJ || 6
-const readToken = process.env.NEXT_PUBLIC_READ_TOKEN || 'read-token'
+const readToken = process.env.API_READ_TOKEN || 'read-token'
 
 const headers = {
   next: {revalidate: 60},