update add api endpoints for chat and media

lib/adapters/media-adapter.ts

@@ -4,20 +4,15 @@ import type {
   MediaPage,
 } from "@reacteditor/plugin-media";
 
-const CLOUD_BASE = "https://cloud.frontend.co";
-const FRONTEND_API_KEY = process.env.NEXT_PUBLIC_FRONTEND_API_KEY ?? "";
-
+// Requests go to our own /api/media proxy routes, which inject the API key
+// server-side. No credentials are sent from the client.
 export const mediaAdapter: MediaAdapter = {
   fetchList: async ({ query, cursor, signal }) => {
-    const url = new URL("/api/media", CLOUD_BASE);
+    const url = new URL("/api/media", window.location.origin);
     if (query) url.searchParams.set("query", query);
     if (cursor) url.searchParams.set("cursor", cursor);
 
-    const res = await fetch(url, {
-      method: "GET",
-      headers: { "X-Api-Key": FRONTEND_API_KEY },
-      signal,
-    });
+    const res = await fetch(url, { method: "GET", signal });
     if (!res.ok) throw new Error(`List failed: ${res.status}`);
     return (await res.json()) as MediaPage;
   },
@@ -26,8 +21,7 @@ export const mediaAdapter: MediaAdapter = {
   upload: (file, opts) =>
     new Promise<MediaItem>((resolve, reject) => {
       const xhr = new XMLHttpRequest();
-      xhr.open("POST", `${CLOUD_BASE}/api/media`);
-      xhr.setRequestHeader("X-Api-Key", FRONTEND_API_KEY);
+      xhr.open("POST", "/api/media");
 
       xhr.upload.onprogress = (e) => {
         if (e.lengthComputable) opts?.onProgress?.(e.loaded / e.total);
@@ -57,10 +51,9 @@ export const mediaAdapter: MediaAdapter = {
     }),
 
   delete: async (id) => {
-    const res = await fetch(
-      `${CLOUD_BASE}/api/media/${encodeURIComponent(id)}`,
-      { method: "DELETE", headers: { "X-Api-Key": FRONTEND_API_KEY } },
-    );
+    const res = await fetch(`/api/media/${encodeURIComponent(id)}`, {
+      method: "DELETE",
+    });
     if (!res.ok) throw new Error(`Delete failed: ${res.status}`);
   },
 };

lib/cloud.ts

@@ -0,0 +1,7 @@
+// Server-only config for the Frontend Cloud proxy routes.
+// The API key lives here (read from a non-public env var) so it is never
+// shipped to the browser bundle.
+
+export const CLOUD_BASE = "https://cloud.frontend.co";
+
+export const FRONTEND_API_KEY = process.env.FRONTEND_API_KEY ?? "";