Repository: medusajs/medusa
File: integration-tests/http/__tests__/draft-order/admin/draft-order.spec.ts (TypeScript)

Code before:
        const response = await api.get(
          `/admin/draft-orders/${testDraftOrder.id}`,
          adminHeaders
        )

        expect(response.status).toBe(200)
        expect(response.data.draft_order.email).toBe("test@test.com")
        expect(response.data.draft_order.region_id).toBe(region.id)
      })
    })

    describe("POST /draft-orders/:id", () => {
      it("should update a draft order", async () => {
        const response = await api.post(
          `/admin/draft-orders/${testDraftOrder.id}`,
          {
            email: "test_new@test.com",
          },
          adminHeaders
        )

        expect(response.status).toBe(200)
        expect(response.data.draft_order.email).toBe("test_new@test.com")
      })

      it("should set created_by to id of user linked to secret key", async () => {
        apiKey = (await api.post('/admin/api-keys', {
            title: 'secret-key',
            type: ApiKeyType.SECRET
        }, adminHeaders)).data.api_key

        const draftOrderResponse = await api.post(
            `/admin/draft-orders/${testDraftOrder.id}`,
            {
              email: "test_new@test.com",
            },
            {
                auth: {
                  username: apiKey.token,
                },
              }
        )

        expect(draftOrderResponse.status).toBe(200)
        expect(draftOrderResponse.data.draft_order.email).toBe("test_new@test.com")

        const orderChange = (await api.get(`/admin/orders/${testDraftOrder.id}/changes`, adminHeaders)).data.order_changes[0]

        expect(orderChange).toEqual(
            expect.objectContaining({
                created_by: userId

Review comment (security):
```suggestion
      it("should use the secret key linked user to set created_by", async () => {
```

Code after:
            region_id: region.id,
          },
          adminHeaders
        )

        expect(response.status).toBe(200)
        expect(response.data.draft_order.email).toBe("test2@test.com")
        expect(response.data.draft_order.region_id).toBe(region.id)
      })
    })

    describe("GET /draft-orders/:id", () => {
      it("should get a draft order", async () => {
        const response = await api.get(
          `/admin/draft-orders/${testDraftOrder.id}`,
          adminHeaders
        )

        expect(response.status).toBe(200)
        expect(response.data.draft_order.email).toBe("test@test.com")
        expect(response.data.draft_order.region_id).toBe(region.id)
      })
    })

    describe("POST /draft-orders/:id", () => {
      it("should update a draft order", async () => {
        const response = await api.post(
          `/admin/draft-orders/${testDraftOrder.id}`,
          {
            email: "test_new@test.com",
          },
          adminHeaders
        )

        expect(response.status).toBe(200)
        expect(response.data.draft_order.email).toBe("test_new@test.com")
      })

      it("should use the secret key linked user to set created_by", async () => {
        apiKey = (
          await api.post(
            "/admin/api-keys",
            {
              title: "secret-key",
              type: ApiKeyType.SECRET,
            },
            adminHeaders
          )
        ).data.api_key

        const draftOrderResponse = await api.post(