[TCL][FLAG-1469] Add JWT auth

[willian-viana]

Overview

To prevent unauthorized access to the new data by other users, we're implementing a new auth, that restricts access to the admin account

[gtempus]

Yeah! This is what I was orginally thinking, @willian-viana! 💯

Do we need to modify utils/request.js since the Authorization header is already being added in pages/api/data/[...params].js?

The main reason I'm asking is that it means that the client will send a token to the server-side, and could be captured and used by someone else to access the data? 🤷

[willian-viana]

Yeah! This is what I was orginally thinking, @willian-viana! 💯

Do we need to modify utils/request.js since the Authorization header is already being added in pages/api/data/[...params].js?

The main reason I'm asking is that it means that the client will send a token to the server-side, and could be captured and used by someone else to access the data? 🤷

pages/api/data/[...params].js is a proxy for client requests. When the request is internal (server-side) it pass directly to the Data API.

//if isServer is true, then pass the Authorization alongisde the x-api-key
...(isServer && {
    baseURL: DATA_API_URL,
    headers: {
      'x-api-key': DATA_API_KEY,
      ...(GFW_DATA_API_TOKEN && {
        Authorization: `Bearer ${GFW_DATA_API_TOKEN}`,
      }),
    },
  }),

  // If not, call the proxy (pages/api/data/[...params].js)
  ...(!isServer && {
    baseURL: PROXIES.DATA_API,
  }),
  

[gtempus]

Thanks, @willian-viana! Let's give this a shot.