I have two apps setup in node. Both share same database.
So, there is an app for users.
Users can see their addresses, wallet, book services etc.
There is another app for admins and ops team, where they can get users details.
Like, last booked service, if they used coupons, if they used wallet or credit or debit card.
So, if a user is having any issue they can request support team to book a service on their behalf.
How would I give access to support or admin team to perform the action.
The problem is, every route is auth protected in users app. So, only an authenticated user can access only his details.
One possible way, I thought of generating an API key for admin app.
So they would be sending something like below in each request.
X-Api-Key: kD45bYaXlStYV_jVdU8mlg // Buffer.from(data).toString('base64')
X-User-Id: 2343 // id of the user for which service is to be booked
Also, I have to modify my auth middleware to see if contains api key header and validated header, and bypass the user's login and JWT generation step.
But I am not sure about the security issues. I am sure, someone must have faced this issue. Please share some thoughts, thanks.
If any additional info is needed just comment, please.