@quadient/skillshare 1.6.0 → 1.6.1

package/README.md

@@ -276,3 +276,13 @@ This is full-page reload, not React HMR. A CSP that disallows same-origin script
 or connections must be adjusted for local development or the page reloaded manually.
 The `/__skillshare_dev/` path is reserved for local development controls. This command
 does not implement the SkillShare catalog, actual SSO or cloud deployment.
+
+### Worker user directory (1.6.1)
+
+Authenticated requests in `pages dev` include `X-Skillshare-Users-Url` and
+`X-Skillshare-Users-Token`. A Worker can fetch the URL with the token in the
+`X-Skillshare-Users-Token` request header to read the four local users. Each entry
+contains `id`, `displayName`, `email`, `isAdmin` and `isOwner`. The hosted backend
+uses the same contract for active SkillShare users. These capabilities stay in
+the Worker and are not injected on `api/bypass-sso/*` requests. See the
+[Worker example](../docs/pages-backends.md#skillshare-user-directory-from-a-worker).

package/dist/pages-dev-proxy.js

@@ -1,4 +1,5 @@
 import { createServer, request as httpRequest, } from 'node:http';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
 const sessionCookie = 'skillshare.dev-user';
 const internal = '/__skillshare_dev';
 const hostCookie = (name) => name.startsWith('skillshare.auth') ||
@@ -25,7 +26,7 @@ function cleanHeaders(headers) {
         delete result[name];
     return result;
 }
-export function requestHeaders(request, user, baseUrl, slug) {
+export function requestHeaders(request, user, baseUrl, slug, usersToken) {
     const headers = cleanHeaders(request.headers);
     for (const name of Object.keys(headers))
         if (name.startsWith('x-skillshare-') ||
@@ -37,6 +38,10 @@ export function requestHeaders(request, user, baseUrl, slug) {
     headers['accept-encoding'] = 'identity';
     if (user) {
         delete headers.authorization;
+        if (usersToken) {
+            headers['x-skillshare-users-url'] = new URL(`/api/pages/${encodeURIComponent(slug)}/users-directory`, baseUrl).href;
+            headers['x-skillshare-users-token'] = usersToken;
+        }
         headers['x-skillshare-user'] = Buffer.from(JSON.stringify(user)).toString('base64');
         const cookies = (request.headers.cookie ?? '')
             .split(';')
@@ -74,6 +79,7 @@ export function responseCookies(cookies, prefix) {
 }
 export function createDevProxy(options) {
     const prefix = `/p/${options.slug}`;
+    const usersToken = randomBytes(32).toString('hex');
     const streams = new Set();
     const upgrades = new Set();
     const userFor = (request) => {
@@ -98,6 +104,22 @@ export function createDevProxy(options) {
             return;
         }
         const url = new URL(request.url, `http://${request.headers.host}`);
+        if (url.pathname === `/api/pages/${encodeURIComponent(options.slug)}/users-directory`) {
+            response.setHeader('Cache-Control', 'no-store');
+            const token = request.headers['x-skillshare-users-token'];
+            if (typeof token !== 'string' || !/^[a-f0-9]{64}$/.test(token) ||
+                !timingSafeEqual(Buffer.from(token), Buffer.from(usersToken))) {
+                response.writeHead(401).end();
+                return;
+            }
+            if (request.method !== 'GET') {
+                response.writeHead(405).end();
+                return;
+            }
+            response.writeHead(200, { 'Content-Type': 'application/json' });
+            response.end(JSON.stringify(options.users.map(({ id, displayName, email, isAdmin, isOwner }) => ({ id, displayName, email, isAdmin, isOwner }))));
+            return;
+        }
         if (url.pathname === '/' || url.pathname === prefix) {
             response.writeHead(307, { Location: prefix + '/' + url.search }).end();
             return;
@@ -188,7 +210,7 @@ label.append(select); bar.append(label); document.body.append(bar);
         const user = bypass ? undefined : userFor(request);
         const upstream = httpRequest(new URL(path + url.search, target), {
             method: request.method,
-            headers: requestHeaders(request, user, url.origin + prefix + '/', options.slug),
+            headers: requestHeaders(request, user, url.origin + prefix + '/', options.slug, usersToken),
         }, (incoming) => {
             const headers = cleanHeaders(incoming.headers);
             headers['cache-control'] = 'private, no-cache';
@@ -251,7 +273,7 @@ label.append(select); bar.append(label); document.body.append(bar);
             return;
         }
         const bypass = path === '/api/bypass-sso' || path.startsWith('/api/bypass-sso/');
-        const headers = requestHeaders(request, bypass ? undefined : userFor(request), url.origin + prefix + '/', options.slug);
+        const headers = requestHeaders(request, bypass ? undefined : userFor(request), url.origin + prefix + '/', options.slug, usersToken);
         headers.connection = 'Upgrade';
         headers.upgrade = request.headers.upgrade;
         const upstream = httpRequest(new URL(path + url.search, target), {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quadient/skillshare",
-  "version": "1.6.0",
+  "version": "1.6.1",
   "description": "Skillshare CLI for installing and publishing Quadient skills",
   "type": "module",
   "bin": {