ENG-0000 feat(portal): use privy id tokens (#790)

- Changes to use the `privy-id-token` conditionally in productionized
environments
- Co-authored-by: jojikun <[email protected]>

apps/portal/app/.server/auth.ts

@@ -116,15 +116,9 @@ export async function setupAPI(request: Request) {
 
   OpenAPI.BASE = apiUrl
 
-  if (typeof window !== 'undefined') {
-    const accessToken = localStorage.getItem('privy:token')
-    const headers = getAuthHeaders(accessToken || '')
-    OpenAPI.HEADERS = headers as Record<string, string>
-  } else if (request) {
-    const accessToken = getPrivyAccessToken(request)
-    const headers = getAuthHeaders(accessToken || '')
-    OpenAPI.HEADERS = headers as Record<string, string>
-  }
+  const accessToken = getPrivyAccessToken(request)
+  const headers = getAuthHeaders(accessToken !== null ? accessToken : '')
+  OpenAPI.HEADERS = headers as Record<string, string>
 }
 
 export function updateClientAPIHeaders(accessToken: string | null) {

apps/portal/app/.server/privy.ts

@@ -35,9 +35,19 @@ export const getPrivyUserById = async (id: string): Promise<User> => {
 // get access token from cookie or header
 export const getPrivyAccessToken = (req: Request): string | null => {
   const cookies = parse(req.headers.get('Cookie') ?? '')
+
+  const authIdToken =
+    req.headers.get('Authorization')?.replace('Bearer ', '') ||
+    cookies['privy-id-token']
+  if (authIdToken) {
+    logger('authIdToken', authIdToken)
+    return authIdToken
+  }
+
   const authToken =
     req.headers.get('Authorization')?.replace('Bearer ', '') ||
     cookies['privy-token']
+
   return authToken
 }
 

apps/portal/app/routes/login.tsx

@@ -41,6 +41,8 @@ export async function action({ request }: ActionFunctionArgs) {
   logger('[Action] Redirecting to', redirectUrl)
   const cookies = parse(request.headers.get('cookie') ?? '')
   const privyToken = cookies['privy-token'] // not necessary but just to show its being properly set by privy post auth
+  const privyIdToken = cookies['privy-id-token']
+  logger('privyIdToken', privyIdToken)
   logger('[Action] Redirecting w/ privyToken', privyToken)
   throw redirect(redirectUrl)
 }