feat(api): protect api-events with api-key

[kgajowy]

Protect Api-Events endpoints with custom guard of x-api-key header

Overview

It could be necessary to provide relevant envs on CI/staging/production

Designs

Link to the related design prototypes (if applicable)

Testing instructions

Please explain how to test the PR: ID of a dataset, steps to reach the feature, etc.

Feature relevant tickets

Link to the related task manager tickets

---

Checklist before submitting

• Meaningful commits and code rebased on develop.
• If this PR adds feature that should be tested for regressions when
  deploying to staging/production, please add brief testing instructions
  to the deploy checklist (docs/deployment-checklist.md)
• Update CHANGELOG file

[vercel]

This pull request is being automatically deployed with Vercel (learn more).
To see the status of your deployments, click below or on the icon next to each commit.

marxan – ./app

🔍 Inspect: https://vercel.com/vizzuality1/marxan/Gto1KATjFaRPwLjBTQwak2yS27wf
✅ Preview: https://marxan-git-feat-api-events-intercom-vizzuality1.vercel.app

marxan-storybook – ./app

🔍 Inspect: https://vercel.com/vizzuality1/marxan-storybook/2m8URMNH3YB3z6uNTaEpeCHPtWMX
✅ Preview: https://marxan-storybook-git-feat-api-events-intercom-vizzuality1.vercel.app

[hotzevzl]

@kgajowy thank you, looks great.

[hotzevzl]

actually, may it make sense to get this prop from env only once at app startup, rather than per-request in the guard?

[kgajowy]

actually, may it make sense to get this prop from env only once at app startup, rather than per-request in the guard?

Could be, if we are fine to restart the deployed unit if we need to change the secret ;)

fixed in 7000961

[hotzevzl]

actually, may it make sense to get this prop from env only once at app startup, rather than per-request in the guard?

Could be, if we are fine to restart the deployed unit if we need to change the secret ;)

fixed in 7000961

thanks, and yes, no problem in having to restart - this will rarely change in most cases.