Add authorization token to API requests for security

Author: rickkoh

frontend/src/services/questionService.ts

@@ -1,5 +1,6 @@
 "use server";
 
+import { getAccessToken } from "@/lib/auth";
 import { CategoriesResponse, CategoriesResponseSchema } from "@/types/Category";
 import {
   Question,
@@ -17,12 +18,15 @@ import { cache } from "react";
 
 export async function getQuestion(slug: string): Promise<QuestionResponse> {
   try {
+    const access_token = await getAccessToken();
+
     const res = await fetch(
       process.env.PUBLIC_API_URL + `/api/questions/${slug}`,
       {
         method: "GET",
         headers: {
           "Content-Type": "application/json",
+          Authorization: `Bearer ${access_token}`,
         },
       }
     );
@@ -44,13 +48,16 @@ export async function getQuestions(): Promise<QuestionsResponse> {
   });
 
   try {
+    const access_token = await getAccessToken();
+
     const res: Response = await fetch(
       process.env.PUBLIC_API_URL + `/api/questions?${query}`,
       {
         cache: "no-cache",
         method: "GET",
         headers: {
           "Content-Type": "application/json",
+          Authorization: `Bearer ${access_token}`,
         },
       }
     );
@@ -69,13 +76,16 @@ export async function getQuestions(): Promise<QuestionsResponse> {
 export const getQuestionCategories = cache(
   async function (): Promise<CategoriesResponse> {
     try {
+      const access_token = await getAccessToken();
+
       const res: Response = await fetch(
         process.env.PUBLIC_API_URL + `/api/questions/categories`,
         {
           cache: "no-cache",
           method: "GET",
           headers: {
             "Content-Type": "application/json",
+            Authorization: `Bearer ${access_token}`,
           },
         }
       );
@@ -96,12 +106,15 @@ export async function createQuestion(
   question: NewQuestion
 ): Promise<QuestionResponse> {
   try {
+    const access_token = await getAccessToken();
+
     const res = await fetch(
       process.env.PUBLIC_API_URL + "/api/questions/create",
       {
         method: "POST",
         headers: {
           "Content-Type": "application/json",
+          Authorization: `Bearer ${access_token}`,
         },
         body: JSON.stringify(question),
       }
@@ -122,10 +135,13 @@ export async function createQuestion(
 
 export async function deleteQuestion(questionId: string): Promise<void> {
   try {
+    const access_token = await getAccessToken();
+
     await fetch(process.env.PUBLIC_API_URL + `/api/questions/${questionId}`, {
       method: "DELETE",
       headers: {
         "Content-Type": "application/json",
+        Authorization: `Bearer ${access_token}`,
       },
     });
 
@@ -137,13 +153,16 @@ export async function editQuestion(
   question: Question
 ): Promise<QuestionResponse> {
   try {
+    const access_token = await getAccessToken();
+
     const updatedQuestion = NewQuestionSchema.parse(question);
     const res = await fetch(
       process.env.PUBLIC_API_URL + `/api/questions/${question._id}`,
       {
         method: "PATCH",
         headers: {
           "Content-Type": "application/json",
+          Authorization: `Bearer ${access_token}`,
         },
         body: JSON.stringify(updatedQuestion),
       }