@netlify/spark-ui 1.31.0-alpha.2 → 1.31.0-alpha.3

package/packages/components/preact/DropZone/drop-core/buildClient.ts

@@ -33,20 +33,27 @@ export interface BuildClient {
 
 export interface AuthenticatedBuildClientConfig {
   /**
-   * API base for every call. Requests go straight to `api.netlify.com`, whose
-   * `/api/*` CORS policy allows any origin, rather than through a consumer's
-   * access-control rewrite — that proxy allowlists paths per origin, and site
-   * creation and deploy reads are not on the list for netlify.com (they 400
-   * with `x-debug: request origin not allowed to call endpoint`). The zip
-   * upload could not use that proxy regardless: it runs in a Lambda with a
-   * ~6MB request body limit.
+   * Base for JSON API calls, routed through the consumer's access-control
+   * rewrite so the session cookie authenticates them. On netlify.com that
+   * rewrite is `/access-control/*` → the app's access-control function, which
+   * makes `/access-control/bb-api/api/v1` the API root (the default here).
+   */
+  proxyBase?: string;
+  /**
+   * Direct API base for the zip upload. The proxy above runs in a Lambda with a
+   * ~6MB request body limit, so the multipart POST has to go straight to
+   * `api.netlify.com` (whose `/api/*` CORS policy allows any origin).
    */
   apiBase?: string;
   /**
-   * Mint a short-lived bearer token authorizing the calls. On netlify.com this
-   * is `GET /access-control/generate-access-control-token`, whose
+   * Mint a bearer token for that direct upload. On netlify.com this is
+   * `GET /access-control/generate-access-control-token`, whose
    * `accessControlToken` the API decrypts back into the user's access token.
    * Resolving `null` means "no session" and surfaces as `NotAuthenticatedError`.
+   *
+   * Note the token issued to a non-app origin lives only 30 seconds. It is
+   * minted immediately before the upload, but a zip that takes longer than that
+   * to transfer will still be rejected mid-flight — see `createBuildFromZip`.
    */
   getUploadToken: () => Promise<string | null>;
   /** Create the site in this account. Omit to use the user's default account. */
@@ -59,6 +66,7 @@ export interface AuthenticatedBuildClientConfig {
   timeoutMs?: number;
 }
 
+const PROXY_BASE = '/access-control/bb-api/api/v1';
 const API_BASE = 'https://api.netlify.com/api/v1';
 const POLL_INTERVAL_MS = 1000;
 const TIMEOUT_MS = 10 * 60 * 1000;
@@ -84,6 +92,7 @@ interface DeployState {
  * short-lived bearer token because the proxy can't carry a body that large.
  */
 export class AuthenticatedBuildClient implements BuildClient {
+  private proxyBase: string;
   private apiBase: string;
   private getUploadToken: () => Promise<string | null>;
   private accountSlug?: string;
@@ -92,6 +101,7 @@ export class AuthenticatedBuildClient implements BuildClient {
   private timeoutMs: number;
 
   constructor({
+    proxyBase = PROXY_BASE,
     apiBase = API_BASE,
     getUploadToken,
     accountSlug,
@@ -99,6 +109,7 @@ export class AuthenticatedBuildClient implements BuildClient {
     pollIntervalMs = POLL_INTERVAL_MS,
     timeoutMs = TIMEOUT_MS,
   }: AuthenticatedBuildClientConfig) {
+    this.proxyBase = proxyBase;
     this.apiBase = apiBase;
     this.getUploadToken = getUploadToken;
     this.accountSlug = accountSlug;
@@ -108,17 +119,16 @@ export class AuthenticatedBuildClient implements BuildClient {
   }
 
   /**
-   * Create the site the build deploys into. Authorized by the bearer token;
-   * without an account slug the API picks the user's default account.
+   * Create the site the build deploys into. Goes through the proxy with
+   * `credentials: 'include'` so the app session authorizes it; without an
+   * account slug the API picks the user's default account.
    */
   async createSite(): Promise<BuildSite> {
-    const token = await this.getUploadToken();
-    if (!token) throw new NotAuthenticatedError();
-
     const path = this.accountSlug ? `/${this.accountSlug}/sites` : '/sites';
-    const res = await fetch(`${this.apiBase}${path}`, {
+    const res = await fetch(`${this.proxyBase}${path}`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
+      credentials: 'include',
+      headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ created_via: 'drop' }),
     });
     // A logged-out visitor gets a 401 here rather than at the token step, since
@@ -133,6 +143,11 @@ export class AuthenticatedBuildClient implements BuildClient {
    * (see the note on `apiBase`), authorized by a freshly minted bearer token.
    * `Content-Type` is left unset on purpose so the browser adds the multipart
    * boundary itself.
+   *
+   * Known ceiling: this is one request on a 30s token, and re-minting can't
+   * help once it is in flight. A zip that takes longer than that to upload will
+   * fail — the app origin gets 300s for exactly this reason, and lifting the
+   * limit for other origins is a platform-side change.
    */
   async createBuildFromZip(siteId: string, zip: File): Promise<BuildResponse> {
     const token = await this.getUploadToken();
@@ -159,19 +174,18 @@ export class AuthenticatedBuildClient implements BuildClient {
    * deploy id yet has nothing pollable, so it resolves immediately and the
    * caller falls back to the site page.
    *
-   * Optional in the drop flow, and off by default: a build takes minutes, which
-   * can outlive the bearer token minted for it. Each poll re-mints so a long
-   * build keeps reading; a token that can't be minted any more ends the wait as
-   * a timeout rather than a false failure.
+   * Optional in the drop flow, and off by default: a build takes minutes, so
+   * the useful hand-off is usually the project page rather than a spinner.
+   * Polling rides the session cookie, so it cannot outlive its credentials the
+   * way a 30s bearer would.
    */
   async waitUntilBuildReady(build: BuildResponse): Promise<void> {
     if (!build.deploy_id) return;
 
     const deadline = this.timeoutMs / this.pollIntervalMs;
     for (let i = 0; i < deadline; i++) {
-      const token = await this.getUploadToken();
-      const res = await fetch(`${this.apiBase}/deploys/${build.deploy_id}`, {
-        headers: token ? { Authorization: `Bearer ${token}` } : {},
+      const res = await fetch(`${this.proxyBase}/deploys/${build.deploy_id}`, {
+        credentials: 'include',
       });
       if (res.ok) {
         const deploy: DeployState = await res.json();

package/packages/components/preact/DropZone/useDropDeploy.ts

@@ -89,6 +89,7 @@ interface UseDropDeployOptions {
   buildClient?: BuildClient;
   authenticatedDropClient?: DropClient;
   getUploadToken?: () => Promise<string | null>;
+  proxyBase?: string;
   accountSlug?: string;
   buildDeployUrl: (build: DeployedBuild) => string;
   waitForBuild?: boolean;
@@ -141,6 +142,7 @@ export function useDropDeploy({
   buildClient,
   authenticatedDropClient,
   getUploadToken,
+  proxyBase,
   accountSlug,
   buildDeployUrl,
   waitForBuild,
@@ -160,7 +162,9 @@ export function useDropDeploy({
   // fresh client (and a fresh token cache) to an in-flight deploy.
   const authedBuildClient = useRef(
     buildClient ??
-      (getUploadToken ? new AuthenticatedBuildClient({ getUploadToken, accountSlug }) : null)
+      (getUploadToken
+        ? new AuthenticatedBuildClient({ proxyBase, getUploadToken, accountSlug })
+        : null)
   ).current;
 
   // Same opt-in for static drops: with authenticated wiring present, deploy
@@ -168,7 +172,9 @@ export function useDropDeploy({
   // every static drop stays anonymous.
   const authedDropClient = useRef(
     authenticatedDropClient ??
-      (getUploadToken ? new AuthenticatedDropClient({ getUploadToken, accountSlug }) : null)
+      (getUploadToken
+        ? new AuthenticatedDropClient({ proxyBase, getUploadToken, accountSlug })
+        : null)
   ).current;
 
   const busy = status.kind !== 'idle' && status.kind !== 'error';