Skip to content

fix: request verification example code in comments not being usable #15

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Nov 5, 2020
Merged

fix: request verification example code in comments not being usable #15

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
88ce9f7
fix: request verification example code in comments not being usable
Nov 4, 2020
d445737
fix: request verification feedback
Nov 4, 2020
34b1fd2
fix: linting
Nov 4, 2020
fe416f8
docs: rebuild docs
Nov 4, 2020
189becb
fix: revert to more defensive code style
Nov 5, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions docs/globals.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,7 +137,7 @@ <h3><span class="tsd-flag ts-flagConst">Const</span> sign<wbr>Request</h3>
<li class="tsd-description">
<aside class="tsd-sources">
<ul>
<li>Defined in <a href="https://github.com/contentful/node-apps-toolkit/blob/master/src/requests/sign-request.ts#L104">requests/sign-request.ts:104</a></li>
<li>Defined in <a href="https://github.com/contentful/node-apps-toolkit/blob/master/src/requests/sign-request.ts#L102">requests/sign-request.ts:102</a></li>
</ul>
</aside>
<div class="tsd-comment tsd-typography">
Expand All @@ -146,15 +146,15 @@ <h3><span class="tsd-flag ts-flagConst">Const</span> sign<wbr>Request</h3>
It can be used to verify canonical requests to assess authenticity of the
sender and integrity of the payload.</p>
</div>
<pre><code><span class="hljs-keyword">const</span> {signRequest, ContentfulHeader} = <span class="hljs-built_in">require</span>(<span class="hljs-string">&#x27;contentful-node-apps-toolkit&#x27;</span>)
<pre><code><span class="hljs-keyword">const</span> {signRequest, ContentfulHeader} = <span class="hljs-built_in">require</span>(<span class="hljs-string">&#x27;@contentful/node-apps-toolkit&#x27;</span>)
<span class="hljs-keyword">const</span> {pick} = <span class="hljs-built_in">require</span>(<span class="hljs-string">&#x27;lodash&#x27;</span>)
<span class="hljs-keyword">const</span> {server} = <span class="hljs-built_in">require</span>(<span class="hljs-string">&#x27;./imaginary-server&#x27;</span>)

<span class="hljs-keyword">const</span> SECRET = process.env.SECRET

server.post(<span class="hljs-string">&#x27;/api/my-resources&#x27;</span>, <span class="hljs-function">(<span class="hljs-params">req, res</span>) =&gt;</span> {
<span class="hljs-keyword">const</span> incomingSignature = req.headers[<span class="hljs-string">&#x27;x-contentful-signature&#x27;</span>]
<span class="hljs-keyword">const</span> incomingTimestamp = req.headers[<span class="hljs-string">&#x27;x-contentful-timestamp&#x27;</span>]
<span class="hljs-keyword">const</span> incomingTimestamp = <span class="hljs-built_in">Number</span>.parseInt(req.headers[<span class="hljs-string">&#x27;x-contentful-timestamp&#x27;</span>])
<span class="hljs-keyword">const</span> incomingSignedHeaders = req.headers[<span class="hljs-string">&#x27;x-contentful-signed-headers&#x27;</span>]
<span class="hljs-keyword">const</span> now = <span class="hljs-built_in">Date</span>.now()

Expand Down Expand Up @@ -221,9 +221,9 @@ <h3><span class="tsd-flag ts-flagConst">Const</span> verify<wbr>Request</h3>
<p>Given a secret verifies a CanonicalRequest. Throws when signature is older than <code>rawTimeToLive</code> seconds.
Pass <code>rawTimeToLive = 0</code> to disable TTL checks.</p>
</div>
<pre><code><span class="hljs-keyword">const</span> {isVerifiedRequest} = <span class="hljs-built_in">require</span>(<span class="hljs-string">&#x27;contentful-node-apps-toolkit&#x27;</span>)
<span class="hljs-keyword">const</span> {server} = <span class="hljs-built_in">require</span>(<span class="hljs-string">&#x27;./imaginary-server&#x27;</span>)
<span class="hljs-keyword">const</span> {makeCanonicalRequestFromImaginaryServerRequest} = <span class="hljs-built_in">require</span>(<span class="hljs-string">&#x27;./imaginary-utils&#x27;</span>)
<pre><code><span class="hljs-keyword">const</span> { verifyRequest } = <span class="hljs-built_in">require</span>(<span class="hljs-string">&#x27;@contentful/node-apps-toolkit&#x27;</span>)
<span class="hljs-keyword">const</span> { server } = <span class="hljs-built_in">require</span>(<span class="hljs-string">&#x27;./imaginary-server&#x27;</span>)
<span class="hljs-keyword">const</span> { makeCanonicalRequestFromImaginaryServerRequest } = <span class="hljs-built_in">require</span>(<span class="hljs-string">&#x27;./imaginary-utils&#x27;</span>)

<span class="hljs-keyword">const</span> SECRET = process.env.SECRET
<span class="hljs-keyword">const</span> REQUEST_TTL = <span class="hljs-built_in">Number</span>.parseInt(process.env.REQUEST_TTL, <span class="hljs-number">10</span>)
Expand Down
9 changes: 7 additions & 2 deletions src/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,8 @@
export { getManagementToken } from './keys'
export { signRequest, verifyRequest, ContentfulHeader } from './requests'
export { Secret, CanonicalRequest, Timestamp, SignedRequestHeaders } from './requests/typings'
export {
signRequest,
verifyRequest,
ContentfulHeader,
CanonicalRequest,
SignedRequestHeaders,
} from './requests'
2 changes: 1 addition & 1 deletion src/requests/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
export { signRequest } from './sign-request'
export { verifyRequest } from './verify-request'
export { ContentfulHeader } from './typings'
export type { CanonicalRequest, Secret, Timestamp } from './typings'
export type { CanonicalRequest, SignedRequestHeaders } from './typings'
12 changes: 5 additions & 7 deletions src/requests/sign-request.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,16 +40,14 @@ const getSortedAndSignedHeaders = (headers: Record<string, string>, timestamp: n
rawSignedHeaders.push(ContentfulHeader.Timestamp)
}

const signedHeaders = rawSignedHeaders.sort(sortHeaderKeys)

const signedHeadersString = signedHeaders.join(',')
const signedHeaders = rawSignedHeaders.sort(sortHeaderKeys).join(',')

headers[ContentfulHeader.Timestamp] = timestamp.toString()
headers[ContentfulHeader.SignedHeaders] = signedHeadersString
headers[ContentfulHeader.SignedHeaders] = signedHeaders

const sortedHeaders = Object.entries(headers).sort(([keyA], [keyB]) => sortHeaderKeys(keyA, keyB))

return { sortedHeaders, signedHeaders: signedHeadersString }
return { sortedHeaders, signedHeaders }
}

/**
Expand All @@ -58,15 +56,15 @@ const getSortedAndSignedHeaders = (headers: Record<string, string>, timestamp: n
* sender and integrity of the payload.
*
* ~~~
* const {signRequest, ContentfulHeader} = require('contentful-node-apps-toolkit')
* const {signRequest, ContentfulHeader} = require('@contentful/node-apps-toolkit')
* const {pick} = require('lodash')
* const {server} = require('./imaginary-server')
*
* const SECRET = process.env.SECRET
*
* server.post('/api/my-resources', (req, res) => {
* const incomingSignature = req.headers['x-contentful-signature']
* const incomingTimestamp = req.headers['x-contentful-timestamp']
* const incomingTimestamp = Number.parseInt(req.headers['x-contentful-timestamp'])
* const incomingSignedHeaders = req.headers['x-contentful-signed-headers']
* const now = Date.now()
*
Expand Down
10 changes: 1 addition & 9 deletions src/requests/utils.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,15 +14,7 @@ const normalizeHeaderValue = (value: string) => value.trim()
export const normalizeHeaders = (headers: Record<string, string>) =>
map(headers, ([key, value]) => [normalizeHeaderKey(key), normalizeHeaderValue(value)])

export const pickHeaders = (headers?: Record<string, string>, keys?: string[]) => {
if (!headers) {
return {}
}

if (!keys) {
return headers
}

export const pickHeaders = (headers: Record<string, string>, keys: string[]) => {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Headers are generally speaking not mandatory in our model. This should stay optional for consistency

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These if statements are unused, even if the user passes no headers, because we already validate it beforehand and pass an empty object here

return filter(headers, ([key]) => keys.includes(key))
}

Expand Down
6 changes: 3 additions & 3 deletions src/requests/verify-request.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,9 +30,9 @@ const isRequestTimestampTooOld = (ttl: number, timestamp: Timestamp) => {
* Pass `rawTimeToLive = 0` to disable TTL checks.
*
* ~~~
* const {isVerifiedRequest} = require('contentful-node-apps-toolkit')
* const {server} = require('./imaginary-server')
* const {makeCanonicalRequestFromImaginaryServerRequest} = require('./imaginary-utils')
* const { verifyRequest } = require('@contentful/node-apps-toolkit')
* const { server } = require('./imaginary-server')
* const { makeCanonicalRequestFromImaginaryServerRequest } = require('./imaginary-utils')
*
* const SECRET = process.env.SECRET
* const REQUEST_TTL = Number.parseInt(process.env.REQUEST_TTL, 10)
Expand Down