@adobe/helix-html-pipeline 5.1.3 → 5.3.0

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+# [5.3.0](https://github.com/adobe/helix-html-pipeline/compare/v5.2.0...v5.3.0) (2023-12-05)
+
+
+### Features
+
+* add xfh debug ([#468](https://github.com/adobe/helix-html-pipeline/issues/468)) ([940a57b](https://github.com/adobe/helix-html-pipeline/commit/940a57bee7a0b7c394c08da59c3a66b7a1d5868d))
+
+# [5.2.0](https://github.com/adobe/helix-html-pipeline/compare/v5.1.3...v5.2.0) (2023-11-15)
+
+
+### Features
+
+* implement partition specific auth ([#456](https://github.com/adobe/helix-html-pipeline/issues/456)) ([89fa4f1](https://github.com/adobe/helix-html-pipeline/commit/89fa4f1a7a8ddaecad3659f6eaa37416a4452744)), closes [#274](https://github.com/adobe/helix-html-pipeline/issues/274)
+
 ## [5.1.3](https://github.com/adobe/helix-html-pipeline/compare/v5.1.2...v5.1.3) (2023-11-11)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/helix-html-pipeline",
-  "version": "5.1.3",
+  "version": "5.3.0",
   "description": "Helix HTML Pipeline",
   "main": "src/index.js",
   "types": "src/index.d.ts",
@@ -53,10 +53,10 @@
     "hast-util-to-html": "9.0.0",
     "hast-util-to-string": "3.0.0",
     "hastscript": "8.0.0",
-    "jose": "5.1.0",
+    "jose": "5.1.3",
     "mdast-util-to-hast": "13.0.2",
     "mdast-util-to-string": "4.0.0",
-    "mime": "3.0.0",
+    "mime": "4.0.0",
     "rehype-format": "5.0.0",
     "rehype-parse": "9.0.0",
     "remark-parse": "11.0.0",
@@ -70,26 +70,26 @@
     "unist-util-visit-parents": "6.0.1"
   },
   "devDependencies": {
-    "@adobe/eslint-config-helix": "2.0.4",
+    "@adobe/eslint-config-helix": "2.0.5",
     "@markedjs/html-differ": "4.0.2",
     "@semantic-release/changelog": "6.0.3",
     "@semantic-release/git": "10.0.1",
     "@semantic-release/npm": "11.0.1",
     "c8": "8.0.1",
-    "eslint": "8.53.0",
+    "eslint": "8.55.0",
     "eslint-import-resolver-exports": "1.0.0-beta.5",
     "eslint-plugin-header": "3.1.1",
     "eslint-plugin-import": "2.29.0",
     "esmock": "2.6.0",
     "husky": "8.0.3",
     "js-yaml": "4.1.0",
-    "jsdom": "22.1.0",
+    "jsdom": "23.0.1",
     "junit-report-builder": "3.1.0",
     "lint-staged": "15.1.0",
     "mocha": "10.2.0",
     "mocha-multi-reporters": "1.5.1",
     "mocha-suppress-logs": "0.4.1",
-    "semantic-release": "22.0.7"
+    "semantic-release": "22.0.8"
   },
   "lint-staged": {
     "*.js": "eslint",

package/src/steps/authenticate.js

@@ -10,6 +10,7 @@
  * governing permissions and limitations under the License.
  */
 import { getAuthInfo, makeAuthError } from '../utils/auth.js';
+import { toArray } from './utils.js';
 
 /**
  * Checks if the given email is allowed.
@@ -27,6 +28,26 @@ export function isAllowed(email = '', allows = []) {
   return allows.findIndex((a) => a === email || a === wild) >= 0;
 }
 
+/**
+ * Returns the normalized access configuration for the current partition.
+ * @param state
+ * @return {{}}
+ */
+export function getAccessConfig(state) {
+  const { access } = state.config;
+  if (!access) {
+    return {
+      allow: [],
+      apiKeyId: [],
+    };
+  }
+  const { partition } = state;
+  return {
+    allow: toArray(access[partition]?.allow ?? access.allow),
+    apiKeyId: toArray(access[partition]?.apiKeyId ?? access.apiKeyId),
+  };
+}
+
 /**
  * Handles authentication
  * @type PipelineStep
@@ -43,8 +64,11 @@ export async function authenticate(state, req, res) {
     return;
   }
 
+  // get partition relative auth info
+  const access = getAccessConfig(state);
+
   // if not protected, do nothing
-  if (!state.config?.access?.allow) {
+  if (!access.allow.length) {
     return;
   }
 
@@ -77,20 +101,15 @@ export async function authenticate(state, req, res) {
 
   // validate jti
   if (jti) {
-    const ids = Array.isArray(state.config.access.apiKeyId)
-      ? state.config.access.apiKeyId
-      : [state.config.access.apiKeyId];
-    if (ids.indexOf(jti) < 0) {
-      state.log.warn(`[auth] invalid jti ${jti}: does not match configured id ${state.config.access.apiKeyId}`);
+    if (access.apiKeyId.indexOf(jti) < 0) {
+      state.log.warn(`[auth] invalid jti ${jti}: does not match configured id ${access.apiKeyId}`);
       makeAuthError(state, req, res, 'invalid-jti');
     }
   }
 
   // check profile is allowed
-  const { allow } = state.config.access;
-  const allows = Array.isArray(allow) ? allow : [allow];
-  if (!isAllowed(email, allows)) {
-    state.log.warn(`[auth] profile not allowed for ${allows}`);
+  if (!isAllowed(email, access.allow)) {
+    state.log.warn(`[auth] profile not allowed for ${access.allow}`);
     makeAuthError(state, req, res, 'forbidden', 403);
   }
 }

package/src/steps/utils.js

@@ -216,3 +216,10 @@ export function rewriteUrl(state, url) {
 
   return url;
 }
+
+export function toArray(v) {
+  if (!v) {
+    return [];
+  }
+  return Array.isArray(v) ? v : [v];
+}

package/src/utils/auth.js

@@ -109,7 +109,8 @@ export async function decodeIdToken(state, idToken, lenient = false) {
 function getRequestHostAndProto(state, req) {
   // determine the location of 'this' document based on the xfh header. so that logins to
   // .page stay on .page. etc. but fallback to the config.host if non set
-  let host = req.headers.get('x-forwarded-host');
+  const xfh = req.headers.get('x-forwarded-host');
+  let host = xfh;
   if (host) {
     host = host.split(',')[0].trim();
   }
@@ -118,7 +119,7 @@ function getRequestHostAndProto(state, req) {
   }
   // fastly overrides the x-forwarded-proto, so we use x-forwarded-scheme
   const proto = req.headers.get('x-forwarded-scheme') || req.headers.get('x-forwarded-proto') || 'https';
-  state.log.info(`request host is: ${host} (${proto})`);
+  state.log.info(`request host is: ${host} (${proto}) (xfh=${xfh})`);
   return {
     host,
     proto,

package/src/utils/json-filter.js

@@ -10,6 +10,7 @@
  * governing permissions and limitations under the License.
  */
 import { PipelineStatusError } from '../PipelineStatusError.js';
+import { toArray } from '../steps/utils.js';
 
 const TYPE_KEY = ':type';
 
@@ -78,7 +79,7 @@ export default function jsonFilter(state, res, query) {
   }
 
   state.timer?.update('json-filter');
-  const requestedSheets = Array.isArray(sheet) ? sheet : [sheet];
+  const requestedSheets = toArray(sheet);
   if (requestedSheets.length === 0 && 'default' in json) {
     requestedSheets.push('default');
   }