feat(admin): serve response media from standalone API

apps/admin/src/lib/adminApi.test.ts

@@ -6,7 +6,7 @@ vi.mock('@/config', () => ({
     authClient: { auth: { getSession } },
 }));
 
-import { AdminApiError, adminRequest, queryAdminRows } from './adminApi';
+import { AdminApiError, adminRequest, getAdminResponseMedia, queryAdminRows } from './adminApi';
 
 describe('admin API transport', () => {
     beforeEach(() => {
@@ -38,4 +38,19 @@ describe('admin API transport', () => {
         }));
         await expect(adminRequest('/v1/admin/me')).rejects.toThrow('Administrator access denied');
     });
+
+    it('loads protected response media from the standalone API with hosted Auth', async () => {
+        const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response('response-media', {
+            status: 200, headers: { 'content-type': 'image/jpeg' },
+        }));
+        const responseId = '11111111-1111-4111-8111-111111111111';
+
+        const blob = await getAdminResponseMedia(responseId);
+
+        expect(await blob.text()).toBe('response-media');
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(url).toBe(`http://127.0.0.1:3003/v1/admin/responses/${responseId}/media`);
+        expect(new Headers(init?.headers).get('Authorization')).toBe('Bearer hosted-auth-token');
+        expect(init?.body).toBeUndefined();
+    });
 });