feat(endpoint-syndicate): support multiple methods of supplying a token

getindiekit · Jan 7, 2023 · 364ac14 · 364ac14
1 parent 7128915
commit 364ac14
Show file tree

Hide file tree

Showing 14 changed files with 235 additions and 42 deletions.
diff --git a/package-lock.json b/package-lock.json
diff --git a/packages/endpoint-posts/includes/endpoint-posts-syndicate.njk b/packages/endpoint-posts/includes/endpoint-posts-syndicate.njk
@@ -1,6 +1,6 @@
 <form action="{{ application._syndicationEndpointPath }}" method="post">
   {{ input({
-    name: "token",
+    name: "access_token",
     type: "hidden",
     value: token
   }) | indent(2) }}

diff --git a/packages/endpoint-syndicate/index.js b/packages/endpoint-syndicate/index.js
@@ -13,7 +13,7 @@ export default class SyndicateEndpoint {
     this.mountPath = this.options.mountPath;
   }
 
-  get routes() {
+  get routesPublic() {
     router.post("/", syndicateController.post);
 
     return router;

diff --git a/packages/endpoint-syndicate/lib/controllers/syndicate.js b/packages/endpoint-syndicate/lib/controllers/syndicate.js
@@ -1,12 +1,14 @@
 import { IndiekitError } from "@indiekit/error";
 import { fetch } from "undici";
+import { findBearerToken } from "../token.js";
 import { getPostData } from "../utils.js";
 
 export const syndicateController = {
   async post(request, response, next) {
     try {
       const { application, publication } = request.app.locals;
-      const token = request.query.token || request.body.token;
+      const bearerToken = findBearerToken(request);
+
       const sourceUrl =
         request.query.source_url || request.body.syndication?.source_url;
       const redirectUri =
@@ -76,7 +78,7 @@ export const syndicateController = {
         method: "POST",
         headers: {
           accept: "application/json",
-          authorization: `Bearer ${token}`,
+          authorization: `Bearer ${bearerToken}`,
           "content-type": "application/json",
         },
         body: JSON.stringify({

diff --git a/packages/endpoint-syndicate/lib/token.js b/packages/endpoint-syndicate/lib/token.js
@@ -0,0 +1,57 @@
+import process from "node:process";
+import { IndiekitError } from "@indiekit/error";
+import jwt from "jsonwebtoken";
+
+export const findBearerToken = (request) => {
+  if (request.headers?.["x-webhook-signature"]) {
+    const signature = request.headers["x-webhook-signature"];
+    const verifiedToken = verifyToken(signature);
+    const bearerToken = signToken(verifiedToken, request.body.url);
+    return bearerToken;
+  }
+
+  if (request.body?.access_token) {
+    const bearerToken = request.body.access_token;
+    delete request.body.access_token;
+    return bearerToken;
+  }
+
+  if (request.query?.token) {
+    const bearerToken = request.query.token;
+    return bearerToken;
+  }
+
+  throw IndiekitError.invalidRequest("No bearer token provided by request");
+};
+
+/**
+ * Generate short-lived bearer token with update scope
+ *
+ * @param {object} verifiedToken - JSON Web Token
+ * @param {string} url - Publication URL
+ * @returns {string} Signed JSON Web Token
+ */
+export const signToken = (verifiedToken, url) =>
+  jwt.sign(
+    {
+      me: url,
+      scope: "update",
+    },
+    process.env.SECRET,
+    {
+      expiresIn: "10m",
+    }
+  );
+
+/**
+ * Verify that token provided by signature was issued by Netlify
+ *
+ * @param {string} signature - JSON Web Signature
+ * @returns {object} JSON Web Token
+ * @see {@link https://docs.netlify.com/site-deploys/notifications/#payload-signature}
+ */
+export const verifyToken = (signature) =>
+  jwt.verify(signature, process.env.WEBHOOK_SECRET, {
+    algorithms: ["HS256"],
+    issuer: ["netlify"],
+  });
diff --git a/packages/endpoint-syndicate/package.json b/packages/endpoint-syndicate/package.json
@@ -35,6 +35,7 @@
   "dependencies": {
     "@indiekit/error": "^1.0.0-beta.1",
     "express": "^4.17.1",
+    "jsonwebtoken": "^9.0.0",
     "undici": "^5.2.0"
   },
   "publishConfig": {

diff --git a/packages/endpoint-syndicate/tests/integration/200-no-post-record-for-url.js b/packages/endpoint-syndicate/tests/integration/200-no-post-record-for-url.js
@@ -10,7 +10,7 @@ test("Returns no post record for URL", async (t) => {
   const request = supertest.agent(server);
   const result = await request
     .post("/syndicate")
-    .auth(testToken(), { type: "bearer" })
+    .query({ token: testToken() })
     .set("accept", "application/json")
     .query({ source_url: "https://website.example/notes/foobar/" });
 

diff --git a/packages/endpoint-syndicate/tests/integration/200-no-post-records.js b/packages/endpoint-syndicate/tests/integration/200-no-post-records.js
@@ -10,7 +10,7 @@ test("Returns no post records", async (t) => {
   const request = supertest.agent(server);
   const result = await request
     .post("/syndicate")
-    .auth(testToken(), { type: "bearer" })
+    .query({ token: testToken() })
     .set("accept", "application/json");
 
   t.is(result.status, 200);