@adobe/helix-config 2.16.0 → 2.17.0

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+# [2.17.0](https://github.com/adobe/helix-config/compare/v2.16.1...v2.17.0) (2024-05-08)
+
+
+### Features
+
+* remove old access config ([#77](https://github.com/adobe/helix-config/issues/77)) ([20d9a25](https://github.com/adobe/helix-config/commit/20d9a252eb5b399f2f6dc324830748cbacbae5c3))
+
+## [2.16.1](https://github.com/adobe/helix-config/compare/v2.16.0...v2.16.1) (2024-05-08)
+
+
+### Bug Fixes
+
+* properly hash global delivery token ([#78](https://github.com/adobe/helix-config/issues/78)) ([6f352ba](https://github.com/adobe/helix-config/commit/6f352ba9ed481f4d79bfb46750db3de81fb75966))
+
 # [2.16.0](https://github.com/adobe/helix-config/compare/v2.15.1...v2.16.0) (2024-05-07)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/helix-config",
-  "version": "2.16.0",
+  "version": "2.17.0",
   "description": "Helix Config",
   "main": "src/index.js",
   "types": "src/index.d.ts",
@@ -36,6 +36,13 @@
     "reporter": "mocha-multi-reporters",
     "reporter-options": "configFile=.mocha-multi.json"
   },
+  "imports": {
+    "#crypto": {
+      "node": "./src/crypto.node.js",
+      "browser": "./src/crypto.worker.js",
+      "worker": "./src/crypto.worker.js"
+    }
+  },
   "devDependencies": {
     "@adobe/eslint-config-helix": "2.0.6",
     "@semantic-release/changelog": "6.0.3",

package/src/config-view.js

@@ -11,6 +11,8 @@
  */
 import { ModifiersConfig } from '@adobe/helix-shared-config/modifiers';
 import { computeSurrogateKey } from '@adobe/helix-shared-utils';
+// eslint-disable-next-line import/no-unresolved
+import cryptoImpl from '#crypto';
 import { PipelineResponse } from './PipelineResponse.js';
 import {
   SCOPE_ADMIN,
@@ -63,10 +65,27 @@ export function canonicalArrayString(root, partition, prop) {
   return `,${value.join(',')},`;
 }
 
+/**
+ * Returns the hash of the global delivery token if defined.
+ * @param ctx
+ * @param rso
+ * @returns {string|null}
+ */
+function getGlobalTokenHash(ctx, rso) {
+  if (!ctx.env.HLX_GLOBAL_DELIVERY_TOKEN) {
+    return null;
+  }
+  return cryptoImpl
+    .createHmac('sha512', rso.org)
+    .update(ctx.env.HLX_GLOBAL_DELIVERY_TOKEN, 'utf-8')
+    .digest()
+    .toString('base64url');
+}
+
 /**
  * Returns the normalized access configuration for the give partition.
  */
-export function getAccessConfig(ctx, config, partition) {
+export function getAccessConfig(ctx, config, partition, rso) {
   const { access, tokens = {} } = config;
   const apiKeyId = toArray(access[partition]?.apiKeyId ?? access.apiKeyId);
   const allow = toArray(access[partition]?.allow ?? access.allow);
@@ -88,7 +107,7 @@ export function getAccessConfig(ctx, config, partition) {
   // if an apiKeyId is defined but no tokenHash, create a fake one so that auth is still enforced.
   if (cfg.apiKeyId.length) {
     // add global token hash if defined and needed
-    const globalTokenHash = ctx.env.HLX_GLOBAL_TOKEN_HASH;
+    const globalTokenHash = getGlobalTokenHash(ctx, rso);
     if (cfg.tokenHash.length && globalTokenHash) {
       // augment the list of hashes with the global one if exists
       cfg.tokenHash.push(globalTokenHash);
@@ -98,10 +117,6 @@ export function getAccessConfig(ctx, config, partition) {
     }
   }
 
-  // todo: remove after auth rewrite
-  if (allow) {
-    cfg.allow = allow;
-  }
   return cfg;
 }
 
@@ -264,8 +279,8 @@ export async function getConfigResponse(ctx, opts) {
     // normalize access config
     const { admin = {} } = config.access;
     config.access = {
-      preview: getAccessConfig(ctx, config, 'preview'),
-      live: getAccessConfig(ctx, config, 'live'),
+      preview: getAccessConfig(ctx, config, 'preview', rso),
+      live: getAccessConfig(ctx, config, 'live', rso),
       // access.require.repository ?
     };
     if (opts.scope === SCOPE_ADMIN || opts.scope === SCOPE_RAW) {
@@ -291,12 +306,8 @@ export async function getConfigResponse(ctx, opts) {
         'x-hlx-contentbus-id': config.content.contentBusId,
         'x-hlx-owner': config.code.owner,
         'x-hlx-repo': config.code.repo,
-        'x-hlx-auth-allow-preview': canonicalArrayString(config.access, 'preview', 'allow'),
-        'x-hlx-auth-apikey-preview': canonicalArrayString(config.access, 'preview', 'apiKeyId'),
         'x-hlx-auth-clientdn-preview': canonicalArrayString(config.access, 'preview', 'clientCertDN'),
         'x-hlx-auth-hash-preview': canonicalArrayString(config.access, 'preview', 'tokenHash'),
-        'x-hlx-auth-allow-live': canonicalArrayString(config.access, 'live', 'allow'),
-        'x-hlx-auth-apikey-live': canonicalArrayString(config.access, 'live', 'apiKeyId'),
         'x-hlx-auth-clientdn-live': canonicalArrayString(config.access, 'live', 'clientCertDN'),
         'x-hlx-auth-hash-live': canonicalArrayString(config.access, 'live', 'tokenHash'),
       },

package/src/crypto.node.js

@@ -0,0 +1,16 @@
+/*
+ * Copyright 2018 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+
+// node runtime
+import cryptoImpl from 'node:crypto';
+
+export default cryptoImpl;

package/src/crypto.worker.js

@@ -0,0 +1,15 @@
+/*
+ * Copyright 2018 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+
+// browser/worker runtime
+// eslint-disable-next-line no-undef
+export default crypto;