@devvit/public-api 0.11.5-next-2024-12-16-92b65c499.0 → 0.11.5-next-2024-12-16-1e32d9060.0

package/devvit/internals/csrf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../../src/devvit/internals/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAGjF,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAO7E,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,WAAW,GAAG,iBAAiB,EACxC,GAAG,EAAE,oBAAoB,iBA6D1B;AAiBD,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,WAAW,GAAG,iBAAiB,EACxC,GAAG,EAAE,oBAAoB,iBAc1B"}
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../../src/devvit/internals/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAGjF,OAAO,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAuB7E,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,WAAW,GAAG,iBAAiB,EACxC,GAAG,EAAE,oBAAoB,iBAmF1B;AAWD,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,WAAW,GAAG,iBAAiB,EACxC,GAAG,EAAE,oBAAoB,iBAc1B"}

package/devvit/internals/csrf.js

@@ -1,6 +1,32 @@
 import { Header } from '@devvit/shared-types/Header.js';
 import { getMenuItemById } from './menu-items.js';
+function getUserHeader(context) {
+    const userHeader = context.debug.metadata[Header.User].values[0];
+    if (!userHeader) {
+        throw new Error('User missing from context');
+    }
+    return userHeader;
+}
+function getSubredditHeader(context) {
+    const subredditHeader = context.debug.metadata[Header.Subreddit].values[0];
+    if (!subredditHeader) {
+        throw new Error('Subreddit missing from context');
+    }
+    return subredditHeader;
+}
 export async function addCSRFTokenToContext(context, req) {
+    /**
+     * These headers represent the canonical user and subreddit for the current context.  The user is validated by gateway against
+     * the edge context, so we trust it.
+     */
+    const userHeader = getUserHeader(context);
+    const subredditHeader = getSubredditHeader(context);
+    if (!userHeader || !subredditHeader) {
+        throw new Error('User or subreddit missing from context');
+    }
+    /**
+     * These are the target ids for the action.  They are provided by the user, but we need to validate them.
+     */
     const commentId = req.comment?.id && `t1_${req.comment.id}`;
     const postId = req.post?.id && `t3_${req.post.id}`;
     const subredditId = req.subreddit?.id && `t5_${req.subreddit.id}`;
@@ -8,32 +34,39 @@ export async function addCSRFTokenToContext(context, req) {
     if (!targetId) {
         throw new Error('targetId is missing from ContextActionRequest');
     }
-    const currentUser = context.debug.metadata[Header.User].values[0];
-    const subredditHeader = context.debug.metadata[Header.Subreddit].values[0];
-    if (!currentUser || !subredditHeader) {
-        throw new Error('User or subreddit missing from context');
-    }
+    /**
+     * Validate user-provided commentId
+     */
     if (commentId) {
         const comment = await context.reddit.getCommentById(commentId);
         if (!comment) {
             throw new Error(`Comment ${commentId} not found`);
         }
-        if (comment.subredditId !== subredditId) {
-            throw new Error('Comment does not belong to the subreddit');
+        if (comment.subredditId !== subredditHeader) {
+            throw new Error(`Comment does not belong to the subreddit`);
         }
     }
+    /**
+     * Validate user-provided postId
+     */
     if (postId) {
         const post = await context.reddit.getPostById(postId);
         if (!post) {
             throw new Error(`Post ${postId} not found`);
         }
-        if (post.subredditId !== subredditId) {
-            throw new Error('Post does not belong to the subreddit');
+        if (post.subredditId !== subredditHeader) {
+            throw new Error(`Post does not belong to the subreddit`);
         }
     }
+    /**
+     * Validate user-provided subredditId
+     */
     if (subredditId && subredditId !== subredditHeader) {
         throw new Error(`Subreddit ${subredditId} ${subredditHeader} not found`);
     }
+    /**
+     * Validate moderator status if needed
+     */
     const thisItem = getMenuItemById(req.actionId);
     if (!thisItem) {
         throw new Error('Action not found');
@@ -45,34 +78,31 @@ export async function addCSRFTokenToContext(context, req) {
     const val = {
         needsModCheck,
     };
-    await context.redis.set(`${currentUser}${subredditHeader}${targetId}${req.actionId}`, JSON.stringify(val));
-    await context.redis.expire(`${currentUser}${subredditHeader}${targetId}${req.actionId}`, 600);
+    /**
+     * Store a CSRF token in redis for this action.  There's no way to pass this along, so we need to store it in redis.
+     */
+    await context.redis.set(`${userHeader}${subredditHeader}${targetId}${req.actionId}`, JSON.stringify(val));
+    await context.redis.expire(`${userHeader}${subredditHeader}${targetId}${req.actionId}`, 600);
     console.debug('CSRF token added: ' + JSON.stringify(val));
 }
 async function isModerator(context) {
-    const currentUser = context.debug.metadata[Header.User].values[0];
-    if (!currentUser) {
-        throw new Error('User missing from context');
-    }
-    const subredditHeader = context.debug.metadata[Header.Subreddit].values[0];
-    if (!subredditHeader) {
-        throw new Error('Subreddit missing from context');
-    }
+    const userHeader = getUserHeader(context);
+    const subredditHeader = getSubredditHeader(context);
     const subreddit = await context.reddit.getSubredditInfoById(subredditHeader);
     const mods = await context.reddit.getModerators({ subredditName: subreddit.name }).all();
-    return !!mods.find((mod) => mod.id === currentUser);
+    return !!mods.find((mod) => mod.id === userHeader);
 }
 export async function validateCSRFToken(context, req) {
-    const currentUser = context.debug.metadata[Header.User].values[0];
-    const subredditHeader = context.debug.metadata[Header.Subreddit].values[0];
+    const userHeader = getUserHeader(context);
+    const subredditHeader = getSubredditHeader(context);
     const { actionId, thingId } = req.state?.__contextAction ?? {};
-    const csrfData = await context.redis.get(`${currentUser}${subredditHeader}${thingId}${actionId}`);
+    const csrfData = await context.redis.get(`${userHeader}${subredditHeader}${thingId}${actionId}`);
     if (!csrfData) {
         throw new Error('CSRF token not found');
     }
     const csrf = JSON.parse(csrfData);
     if (csrf.needsModCheck && !(await isModerator(context))) {
-        throw new Error('User is not a moderator: ' + currentUser + '; ' + subredditHeader);
+        throw new Error('User is not a moderator: ' + userHeader + '; ' + subredditHeader);
     }
     console.debug('CSRF token validated: ' + csrfData);
 }

package/meta.json

@@ -10411,7 +10411,7 @@
       "format": "esm"
     },
     "src/devvit/internals/csrf.ts": {
-      "bytes": 3712,
+      "bytes": 4559,
       "imports": [
         {
           "path": "../shared-types/dist/Header.js",
@@ -12797,7 +12797,7 @@
           "bytesInOutput": 663
         },
         "src/devvit/internals/csrf.ts": {
-          "bytesInOutput": 3359
+          "bytesInOutput": 3505
         },
         "src/devvit/internals/menu-items.ts": {
           "bytesInOutput": 2374
@@ -12944,7 +12944,7 @@
           "bytesInOutput": 370
         }
       },
-      "bytes": 12713357
+      "bytes": 12714715
     }
   }
 }

package/meta.min.json

@@ -3271,7 +3271,7 @@
       "format": "esm"
     },
     "src/devvit/internals/csrf.ts": {
-      "bytes": 3712,
+      "bytes": 4559,
       "imports": [
         {
           "path": "../shared-types/dist/Header.js",
@@ -4815,7 +4815,7 @@
       "imports": [],
       "exports": [],
       "inputs": {},
-      "bytes": 1240229
+      "bytes": 1241211
     },
     "dist/public-api.min.js": {
       "imports": [
@@ -5522,7 +5522,7 @@
           "bytesInOutput": 1322
         },
         "src/devvit/internals/csrf.ts": {
-          "bytesInOutput": 1864
+          "bytesInOutput": 1802
         },
         "src/devvit/internals/plugins.ts": {
           "bytesInOutput": 47
@@ -5621,7 +5621,7 @@
           "bytesInOutput": 4081
         },
         "src/apis/reddit/models/Post.ts": {
-          "bytesInOutput": 14649
+          "bytesInOutput": 14651
         },
         "src/apis/reddit/helpers/textFallbackToRichtext.ts": {
           "bytesInOutput": 114
@@ -5663,7 +5663,7 @@
           "bytesInOutput": 178
         }
       },
-      "bytes": 264865
+      "bytes": 264805
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devvit/public-api",
-  "version": "0.11.5-next-2024-12-16-92b65c499.0",
+  "version": "0.11.5-next-2024-12-16-1e32d9060.0",
   "license": "BSD-3-Clause",
   "repository": {
     "type": "git",
@@ -30,8 +30,8 @@
   },
   "types": "./index.d.ts",
   "dependencies": {
-    "@devvit/protos": "0.11.5-next-2024-12-16-92b65c499.0",
-    "@devvit/shared-types": "0.11.5-next-2024-12-16-92b65c499.0",
+    "@devvit/protos": "0.11.5-next-2024-12-16-1e32d9060.0",
+    "@devvit/shared-types": "0.11.5-next-2024-12-16-1e32d9060.0",
     "base64-js": "1.5.1",
     "clone-deep": "4.0.1",
     "core-js": "3.27.2",
@@ -39,8 +39,8 @@
   },
   "devDependencies": {
     "@ampproject/filesize": "4.3.0",
-    "@devvit/repo-tools": "0.11.5-next-2024-12-16-92b65c499.0",
-    "@devvit/tsconfig": "0.11.5-next-2024-12-16-92b65c499.0",
+    "@devvit/repo-tools": "0.11.5-next-2024-12-16-1e32d9060.0",
+    "@devvit/tsconfig": "0.11.5-next-2024-12-16-1e32d9060.0",
     "@microsoft/api-extractor": "7.41.0",
     "@reddit/faceplate-ui": "18.0.1",
     "@types/clone-deep": "4.0.1",
@@ -63,5 +63,5 @@
     }
   },
   "source": "./src/index.ts",
-  "gitHead": "63602e268b86ed7509c35c24f98027ada87858bf"
+  "gitHead": "c88bcd7a5e1b8e57514e956d8ecfa710fc0f67b1"
 }