@adobe/helix-html-pipeline 3.8.12 → 3.9.0

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+# [3.9.0](https://github.com/adobe/helix-html-pipeline/compare/v3.8.12...v3.9.0) (2023-03-23)
+
+
+### Features
+
+* restrict repositories ([#281](https://github.com/adobe/helix-html-pipeline/issues/281)) ([ba7e670](https://github.com/adobe/helix-html-pipeline/commit/ba7e670a0c2fe5e331c37000d0c023cfb79961ce)), closes [#277](https://github.com/adobe/helix-html-pipeline/issues/277)
+
 ## [3.8.12](https://github.com/adobe/helix-html-pipeline/compare/v3.8.11...v3.8.12) (2023-03-10)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/helix-html-pipeline",
-  "version": "3.8.12",
+  "version": "3.9.0",
   "description": "Helix HTML Pipeline",
   "main": "src/index.js",
   "types": "src/index.d.ts",
@@ -83,20 +83,20 @@
     "@semantic-release/git": "10.0.1",
     "@semantic-release/npm": "9.0.2",
     "c8": "7.13.0",
-    "eslint": "8.35.0",
+    "eslint": "8.36.0",
     "eslint-import-resolver-exports": "1.0.0-beta.5",
     "eslint-plugin-header": "3.1.1",
     "eslint-plugin-import": "2.27.5",
     "esmock": "2.1.0",
     "husky": "8.0.3",
     "js-yaml": "4.1.0",
-    "jsdom": "21.1.0",
+    "jsdom": "21.1.1",
     "junit-report-builder": "3.0.1",
-    "lint-staged": "13.1.2",
+    "lint-staged": "13.2.0",
     "mocha": "10.2.0",
     "mocha-multi-reporters": "1.5.1",
     "remark-gfm": "3.0.1",
-    "semantic-release": "20.1.1"
+    "semantic-release": "20.1.3"
   },
   "lint-staged": {
     "*.js": "eslint",

package/src/PipelineState.d.ts

@@ -23,6 +23,10 @@ type Fetch = (url: string|Request, options?: RequestOptions) => Promise<Response
 
 declare interface AccessConfig {
   allow:(string|string[]);
+
+  require: {
+    repository:(string|string[]);
+  };
 }
 
 declare interface HelixConfigAll {

package/src/html-pipe.js

@@ -10,7 +10,7 @@
  * governing permissions and limitations under the License.
  */
 import { cleanupHeaderValue } from '@adobe/helix-shared-utils';
-import { authenticate } from './steps/authenticate.js';
+import { authenticate, requireProject } from './steps/authenticate.js';
 import addHeadingIds from './steps/add-heading-ids.js';
 import createPageBlocks from './steps/create-page-blocks.js';
 import createPictures from './steps/create-pictures.js';
@@ -91,7 +91,10 @@ export async function htmlPipe(state, req) {
       fetchContent(state, req, res),
     ]);
 
-    await authenticate(state, req, res);
+    await requireProject(state, req, res);
+    if (!res.error) {
+      await authenticate(state, req, res);
+    }
 
     if (res.error) {
       // if content loading produced an error, we're done.

package/src/steps/authenticate.js

@@ -82,3 +82,42 @@ export async function authenticate(state, req, res) {
     res.headers.set('x-hlx-auth-key', authInfo.profile.pem);
   }
 }
+
+/**
+ * Checks if the given owner repo is alloed
+ * @param {string} owner
+ * @param {string} repo
+ * @param {string[]} allows
+ * @returns {boolean}
+ */
+export function isOwnerRepoAllowed(owner, repo, allows = []) {
+  if (allows.length === 0) {
+    return true;
+  }
+  return allows
+    .map((ownerRepo) => ownerRepo.split('/'))
+    .findIndex(([o, r]) => owner === o && (repo === r || r === '*')) >= 0;
+}
+
+/**
+ * Checks if the
+ * @type PipelineStep
+ * @param {PipelineState} state
+ * @param {PipelineRequest} req
+ * @param {PipelineResponse} res
+ * @returns {Promise<void>}
+ */
+export async function requireProject(state, req, res) {
+  // if not restricted, do nothing
+  const ownerRepo = state.config?.access?.require?.repository;
+  if (!ownerRepo) {
+    return;
+  }
+  const ownerRepos = Array.isArray(ownerRepo) ? ownerRepo : [ownerRepo];
+  const { log, owner, repo } = state;
+  if (!isOwnerRepoAllowed(owner, repo, ownerRepos)) {
+    log.warn(`${owner}/${repo} not allowed for ${ownerRepos}`);
+    res.status = 403;
+    res.error = 'forbidden.';
+  }
+}