feat: require the CMS API key on /api/hotel and /api/product

api.http

@@ -1,12 +1,42 @@
+# Backchannel endpoints MyE&P reads hotel and product data from. Same environment files and key
+# as content-feed.http: pick "local" and put cmsApiKey in http-client.private.env.json.
+
 ### GET product data for myep
-GET https://ep-reisen.ddev.site/api/product
-    ?product=SSTMR
-    &hotel=SSTGR
-    &key=abcabc123
+GET {{host}}/api/product?product=3VIIN&hotel=VLTS
+X-Api-Key: {{cmsApiKey}}
+
+> {%
+    client.test("200 with key", function () {
+        client.assert(response.status === 200, "expected 200, got " + response.status);
+    });
+%}
 
 ### GET hotel data for myep
-GET https://ep-reisen.ddev.site/api/hotel
-    ?hotel=DPWGRP
-    &key=abcabc123
+GET {{host}}/api/hotel?hotel=DPWGRP
+X-Api-Key: {{cmsApiKey}}
+
+> {%
+    client.test("200 with key", function () {
+        client.assert(response.status === 200, "expected 200, got " + response.status);
+    });
+%}
+
+### Transition form: key as query parameter, as MyE&P sends it today (still accepted)
+GET {{host}}/api/hotel?hotel=DPWGRP&key={{cmsApiKey}}
+
+> {%
+    client.test("200 with query key", function () {
+        client.assert(response.status === 200, "expected 200, got " + response.status);
+    });
+%}
+
+### Any other value is refused now - this used to pass
+GET {{host}}/api/hotel?hotel=DPWGRP&key=AbcAbc123
+
+> {%
+    client.test("403 with the old dummy key", function () {
+        client.assert(response.status === 403, "expected 403, got " + response.status);
+    });
+%}
 
 ###