From 6601b00545b31fd0ee36a1f3d7533cfc4714dfab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20FAMIBELLE-PRONZOLA?= <c.pronzola@tuta.io>
Date: Sun, 5 Jul 2026 23:16:19 +0400
Subject: [PATCH] fix: ne plus exposer le jeton API au navigateur (recherche
 d'artiste)

---
 .env.sample                           |  2 +-
 app/api/awtis/__tests__/route.test.js | 23 +++++++++++++++++++++++
 app/api/awtis/route.js                |  6 ++++++
 components/awtis/cheche-awtis.js      |  3 +--
 lib/oki-api.js                        |  2 +-
 5 files changed, 32 insertions(+), 4 deletions(-)
 create mode 100644 app/api/awtis/__tests__/route.test.js
 create mode 100644 app/api/awtis/route.js

diff --git a/.env.sample b/.env.sample
index 65f689a..5685e9b 100644
--- a/.env.sample
+++ b/.env.sample
@@ -3,7 +3,7 @@ API_URL=http://localhost:1337/api
 NEXT_PUBLIC_API_URL=$API_URL
 NEXT_PUBLIC_API_URL_ROOT=http://localhost:1337
 SITE_URL=http://localhost:3001
-NEXT_PUBLIC_READ_TOKEN=
+API_READ_TOKEN=
 
 # IDENTITÉ DU SITE (branding)
 NEXT_PUBLIC_SITE_NAME=PAWÒL-NU. Paroles et traductions.
diff --git a/app/api/awtis/__tests__/route.test.js b/app/api/awtis/__tests__/route.test.js
new file mode 100644
index 0000000..6410992
--- /dev/null
+++ b/app/api/awtis/__tests__/route.test.js
@@ -0,0 +1,23 @@
+import {describe, it, expect, vi, afterEach} from 'vitest'
+import {jwennToutAwtis} from '../../../../lib/oki-api'
+import {GET} from '../route'
+
+vi.mock('../../../../lib/oki-api', () => ({
+  jwennToutAwtis: vi.fn()
+}))
+
+describe('GET /api/awtis', () => {
+  afterEach(() => {
+    vi.restoreAllMocks()
+  })
+
+  it('renvoie les données de jwennToutAwtis en JSON, sans exposer de jeton', async () => {
+    jwennToutAwtis.mockResolvedValue({data: [{id: 1, alias: 'Foo'}], meta: {}})
+
+    const response = await GET()
+    const body = await response.json()
+
+    expect(body).toEqual({data: [{id: 1, alias: 'Foo'}], meta: {}})
+    expect(JSON.stringify(body)).not.toMatch(/bearer|token/i)
+  })
+})
diff --git a/app/api/awtis/route.js b/app/api/awtis/route.js
new file mode 100644
index 0000000..8ff343b
--- /dev/null
+++ b/app/api/awtis/route.js
@@ -0,0 +1,6 @@
+import {jwennToutAwtis} from '../../../lib/oki-api'
+
+export async function GET() {
+  const data = await jwennToutAwtis()
+  return Response.json(data)
+}
diff --git a/components/awtis/cheche-awtis.js b/components/awtis/cheche-awtis.js
index 5cdad9a..17ee10f 100644
--- a/components/awtis/cheche-awtis.js
+++ b/components/awtis/cheche-awtis.js
@@ -7,7 +7,6 @@ import Autocomplete from '@mui/material/Autocomplete'
 import Avatar from '@mui/material/Avatar'
 import Container from '@mui/material/Container'
 
-import {jwennToutAwtis} from '../../lib/oki-api'
 import {formatKuveti} from '../../lib/kuveti'
 
 const IMAGE_URL = process.env.NEXT_PUBLIC_API_URL_ROOT || 'http://localhost:1337'
@@ -27,7 +26,7 @@ export default function ChecheAwtis() {
 
     (async () => {
       try {
-        const {data} = await jwennToutAwtis()
+        const {data} = await fetch('/api/awtis').then(response => response.json())
 
         const filteredData = data.map(artiste => {
           const firstLetter = artiste.alias[0].toUpperCase()
diff --git a/lib/oki-api.js b/lib/oki-api.js
index 7cfb76d..c6c9abc 100644
--- a/lib/oki-api.js
+++ b/lib/oki-api.js
@@ -2,7 +2,7 @@ import qs from 'qs'
 
 const OKI_API = process.env.NEXT_PUBLIC_API_URL || 'http://localhost:1337'
 const AWTIS_POU_CHAK_PAJ = process.env.NEXT_PUBLIC_AWTIS_POU_CHAK_PAJ || 6
-const readToken = process.env.NEXT_PUBLIC_READ_TOKEN || 'read-token'
+const readToken = process.env.API_READ_TOKEN || 'read-token'
 
 const headers = {
   next: {revalidate: 60},