@adobe/helix-html-pipeline 6.0.0 → 6.1.0

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+# [6.1.0](https://github.com/adobe/helix-html-pipeline/compare/v6.0.1...v6.1.0) (2024-01-13)
+
+
+### Features
+
+* export state decoding ([#489](https://github.com/adobe/helix-html-pipeline/issues/489)) ([dd60f81](https://github.com/adobe/helix-html-pipeline/commit/dd60f81e52e52652616edd67779f6e9098e50a1b))
+
+## [6.0.1](https://github.com/adobe/helix-html-pipeline/compare/v6.0.0...v6.0.1) (2024-01-11)
+
+
+### Bug Fixes
+
+* enforce rso ([#488](https://github.com/adobe/helix-html-pipeline/issues/488)) ([4b38e25](https://github.com/adobe/helix-html-pipeline/commit/4b38e2524514a3d64a041d456bf14fe8b2e416cb))
+
 # [6.0.0](https://github.com/adobe/helix-html-pipeline/compare/v5.4.4...v6.0.0) (2024-01-10)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/helix-html-pipeline",
-  "version": "6.0.0",
+  "version": "6.1.0",
   "description": "Helix HTML Pipeline",
   "main": "src/index.js",
   "types": "src/index.d.ts",

package/src/PipelineState.d.ts

@@ -43,6 +43,8 @@ declare interface PipelineOptions {
   path: string;
   timer: PipelineTimer;
   env: object;
+  site: string;
+  org: string;
 }
 
 declare class PipelineState {
@@ -70,6 +72,16 @@ declare class PipelineState {
    */
   partition: string;
 
+  /**
+   * project site
+   */
+  site: string;
+
+  /**
+   * project org
+   */
+  org: string;
+
   /**
    * Repository owner
    */

package/src/PipelineState.js

@@ -31,6 +31,8 @@ export class PipelineState {
       config: opts.config,
       content: new PipelineContent(),
       contentBusId: opts.config.contentBusId,
+      site: opts.site,
+      org: opts.org,
       owner: opts.config.owner,
       repo: opts.config.repo,
       ref: opts.ref,
@@ -44,6 +46,11 @@ export class PipelineState {
       timer: opts.timer,
       type: 'html',
     });
+    for (const prop of ['org', 'site', 'contentBusId', 'repo', 'owner', 'ref', 'partition']) {
+      if (!this[prop]) {
+        throw new Error(`${prop} required`);
+      }
+    }
   }
 
   // eslint-disable-next-line class-methods-use-this

package/src/html-pipe.js

@@ -36,7 +36,7 @@ import tohtml from './steps/stringify-response.js';
 import { PipelineStatusError } from './PipelineStatusError.js';
 import { PipelineResponse } from './PipelineResponse.js';
 import { validatePathInfo } from './utils/path.js';
-import { initAuthRoute } from './utils/auth.js';
+import { getAuthInfo } from './utils/auth.js';
 import fetchMappedMetadata from './steps/fetch-mapped-metadata.js';
 
 /**
@@ -104,11 +104,18 @@ export async function htmlPipe(state, req) {
     },
   });
 
-  // check if .auth request
-  if (state.partition === '.auth' || state.info.path === '/.auth') {
-    if (!await initAuthRoute(state, req, res)) {
-      return res;
+  // check if `.auth` route to validate and exchange token
+  if (state.partition === '.auth') {
+    const authInfo = await getAuthInfo(state, req);
+    await authInfo.exchangeToken(state, req, res);
+    /* c8 ignore next */
+    const level = res.status >= 500 ? 'error' : 'info';
+    log[level](`pipeline status: ${res.status} ${res.error}`);
+    res.headers.set('x-error', cleanupHeaderValue(res.error));
+    if (res.status < 500) {
+      await setCustomResponseHeaders(state, req, res);
     }
+    return res;
   }
 
   try {

package/src/index.js

@@ -17,3 +17,4 @@ export * from './PipelineRequest.js';
 export * from './PipelineResponse.js';
 export * from './PipelineState.js';
 export * from './PipelineStatusError.js';
+export { validateAuthState } from './utils/auth.js';

package/src/steps/authenticate.js

@@ -36,13 +36,6 @@ export function isAllowed(email = '', allows = []) {
  * @returns {Promise<void>}
  */
 export async function authenticate(state, req, res) {
-  // check if `.auth` route to validate and exchange token
-  if (state.info.path === '/.auth') {
-    const authInfo = await getAuthInfo(state, req);
-    await authInfo.exchangeToken(state, req, res);
-    return;
-  }
-
   // get partition relative auth info
   const access = state.config.access?.[state.partition] || {
     allow: [],

package/src/steps/fetch-content.js

@@ -24,10 +24,6 @@ export default async function fetchContent(state, req, res) {
   const {
     log, contentBusId, info, partition, owner, repo, ref,
   } = state;
-  if (info.resourcePath === '/.auth') {
-    return;
-  }
-
   const isCode = state.content.sourceBus === 'code';
   const key = isCode
     ? `${owner}/${repo}/${ref}${info.resourcePath}`

package/src/utils/auth.js

@@ -239,8 +239,9 @@ export class AuthInfo {
     const url = new URL(idp.discovery.authorization_endpoint);
 
     const tokenState = await signJWT(state, new SignJWT({
-      owner: state.owner,
-      repo: state.repo,
+      ref: state.ref,
+      org: state.org,
+      site: state.site,
       // this is our own login redirect, i.e. the current document
       requestPath: state.info.path,
       requestHost: host,
@@ -369,9 +370,8 @@ export class AuthInfo {
   }
 }
 
-export async function initAuthRoute(state, req, res) {
-  const { log } = state;
-
+export async function validateAuthState(ctx, req) {
+  const { log } = ctx;
   // use request headers if present
   if (req.headers.get('x-hlx-auth-state')) {
     log.info('[auth] override params.state from header.');
@@ -384,28 +384,24 @@ export async function initAuthRoute(state, req, res) {
 
   if (!req.params.state) {
     log.warn('[auth] unable to exchange token: no state.');
-    makeAuthError(state, req, res, 'missing state parameter.');
-    return false;
+    throw new Error('missing state parameter.');
   }
 
   try {
     req.params.rawState = req.params.state;
-    req.params.state = await verifyJwt(state, req.params.state);
+    req.params.state = await verifyJwt(ctx, req.params.state);
     delete req.params.state.aud;
     delete req.params.state.iss;
   } catch (e) {
     log.warn(`[auth] error decoding state parameter: invalid state: ${e.message}`);
-    makeAuthError(state, req, res, 'missing state parameter.');
-    return false;
+    throw new Error('invalid state parameter.');
   }
 
-  // fixup pipeline state
-  state.owner = req.params.state.owner;
-  state.repo = req.params.state.repo;
-  state.ref = 'main';
-  state.partition = 'preview';
-  state.info.path = '/.auth';
-  return true;
+  return {
+    ref: req.params.state.ref,
+    site: req.params.state.site,
+    org: req.params.state.org,
+  };
 }
 
 /**