fix: allow api token

vtex-apps · Jul 10, 2024 · 93dac59 · 93dac59
1 parent d4ab4c5
commit 93dac59
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 3 deletions.
diff --git a/node/directives/checkAdminAccess.ts b/node/directives/checkAdminAccess.ts
@@ -65,7 +65,7 @@ export class CheckAdminAccess extends SchemaDirectiveVisitor {
 
       sendAuthMetric(logger, auditMetric)
 
-      if (!hasAdminToken && !hasAdminTokenOnHeader) {
+      if (!hasAdminToken && !hasApiToken && !hasAdminTokenOnHeader) {
         logger.warn({
           message: 'CheckAdminAccess: No token provided',
           userAgent,
@@ -83,7 +83,11 @@ export class CheckAdminAccess extends SchemaDirectiveVisitor {
         throw new AuthenticationError('No token was provided')
       }
 
-      if (!hasCurrentValidAdminToken && !hasCurrentValidAdminTokenOnHeader) {
+      if (
+        !hasCurrentValidAdminToken &&
+        !hasValidApiToken &&
+        !hasCurrentValidAdminTokenOnHeader
+      ) {
         logger.warn({
           message: 'CheckAdminAccess: Invalid token',
           userAgent,

diff --git a/node/directives/checkUserAccess.ts b/node/directives/checkUserAccess.ts
@@ -68,7 +68,12 @@ export class CheckUserAccess extends SchemaDirectiveVisitor {
 
       sendAuthMetric(logger, auditMetric)
 
-      if (!hasAdminToken && !hasStoreToken && !hasAdminTokenOnHeader) {
+      if (
+        !hasAdminToken &&
+        !hasApiToken &&
+        !hasStoreToken &&
+        !hasAdminTokenOnHeader
+      ) {
         logger.warn({
           message: 'CheckUserAccess: No token provided',
           userAgent,
@@ -88,6 +93,7 @@ export class CheckUserAccess extends SchemaDirectiveVisitor {
 
       if (
         !hasCurrentValidAdminToken &&
+        !hasValidApiToken &&
         !hasCurrentValidStoreToken &&
         !hasCurrentValidAdminTokenOnHeader
       ) {