feat(security): enforce admin allowlist guard on admin APIs and attach bearer for admin client

src/api/http.js

@@ -31,6 +31,10 @@ userHttp.interceptors.response.use(
 export const adminHttp = axios.create({ baseURL: BASE_URL })
 
 adminHttp.interceptors.request.use(config => {
+  const token = localStorage.getItem('access_token')
+  if (token) {
+    config.headers['Authorization'] = `Bearer ${token}`
+  }
   const clientKey = sessionStorage.getItem('admin_client_key') || ENV_ADMIN_CLIENT_KEY
   const apiKey = sessionStorage.getItem('admin_api_key') || ENV_ADMIN_API_KEY
   if (clientKey && !sessionStorage.getItem('admin_client_key')) {
@@ -43,3 +47,14 @@ adminHttp.interceptors.request.use(config => {
   if (apiKey) config.headers['X-API-Key'] = apiKey
   return config
 })
+
+adminHttp.interceptors.response.use(
+  res => res,
+  err => {
+    if (err.response?.status === 401) {
+      localStorage.removeItem('access_token')
+      router.push('/login')
+    }
+    return Promise.reject(err)
+  }
+)