@raketa-cloud/admin 1.9.0 → 1.9.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@raketa-cloud/admin",
-  "version": "1.9.0",
+  "version": "1.9.1",
   "main": "src/index.js",
   "files": [
     "src/",

package/src/cloud/Resources.js

@@ -1,3 +1,4 @@
+import { buildMagicPreviewAddress } from "../magicPreview";
 import { toDateInput, toDateTimeInput, toUTCISO8601String } from "../utils";
 import RaketaClient from "./RaketaClient";
 import {
@@ -162,6 +163,14 @@ export default class Resources extends RaketaClient {
 
     input.workflow = {
       type: workflow.type,
+      previewUrl: buildMagicPreviewAddress(
+        {
+          slug: input.resource.slug,
+          locale: input.locale,
+          resourceType: input.resource.resourceType,
+        },
+        this.getConfig(),
+      ),
     };
 
     if (workflow.due_date) {

package/src/helpers/AuthHelper.js

@@ -25,7 +25,12 @@ const AuthHelper = {
   isAuthenticated: ({ path, token }) => {
     const ALLOWED_PATHS = ["/login", "/auth/google/callback", "/remote/verify"];
 
-    if (ALLOWED_PATHS.includes(path)) return true;
+    if (
+      ALLOWED_PATHS.includes(path) ||
+      path?.startsWith("/remote/magic-preview/")
+    ) {
+      return true;
+    }
 
     if (token && AuthHelper.verifyJWT(token)) return true;
 

package/src/magicPreview.js

@@ -0,0 +1,103 @@
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHash,
+  randomBytes,
+} from "node:crypto";
+
+const ALGORITHM = "aes-256-gcm";
+const IV_LENGTH = 12;
+const TAG_LENGTH = 16;
+
+function getSecretKey(config = {}) {
+  const secret = config.secrets.crypto_secret;
+
+  if (!secret) {
+    throw new Error(
+      "crypto_secret needs to be setup in the config for the magic preview feature to work",
+    );
+  }
+
+  return createHash("sha256").update(secret).digest();
+}
+
+export function generateMagicPreviewToken(
+  { slug, resourceType, locale } = {},
+  config = {},
+) {
+  const payload = {
+    slug,
+    resourceType,
+    locale,
+  };
+
+  const key = getSecretKey(config);
+  const iv = randomBytes(IV_LENGTH);
+  const cipher = createCipheriv(ALGORITHM, key, iv);
+  const encrypted = Buffer.concat([
+    cipher.update(JSON.stringify(payload), "utf8"),
+    cipher.final(),
+  ]);
+  const tag = cipher.getAuthTag();
+
+  return Buffer.concat([iv, tag, encrypted]).toString("base64url");
+}
+
+export function decipherMagicPreviewToken(token, config) {
+  if (!token || typeof token !== "string") {
+    return null;
+  }
+
+  try {
+    const key = getSecretKey(config);
+    const combined = Buffer.from(token, "base64url");
+
+    if (combined.length < IV_LENGTH + TAG_LENGTH) {
+      return null;
+    }
+
+    const iv = combined.subarray(0, IV_LENGTH);
+    const tag = combined.subarray(IV_LENGTH, IV_LENGTH + TAG_LENGTH);
+    const encrypted = combined.subarray(IV_LENGTH + TAG_LENGTH);
+
+    const decipher = createDecipheriv(ALGORITHM, key, iv);
+    decipher.setAuthTag(tag);
+
+    const decrypted = Buffer.concat([
+      decipher.update(encrypted),
+      decipher.final(),
+    ]).toString("utf8");
+
+    const payload = JSON.parse(decrypted);
+
+    if (!payload || typeof payload !== "object" || !payload.slug) {
+      return null;
+    }
+
+    return payload;
+  } catch {
+    return null;
+  }
+}
+
+export function buildMagicPreviewAddress(
+  { slug, resourceType, locale },
+  globalConfig,
+) {
+  if (!slug || !resourceType || !locale) {
+    throw new Error(
+      "Can't generate a token without a slug, resourceType or locale!",
+    );
+  }
+
+  const token = generateMagicPreviewToken(
+    {
+      slug,
+      resourceType,
+      locale,
+    },
+    globalConfig,
+  );
+
+  return globalConfig.remoteConfig.magicPreviewUrl(token, resourceType, locale);
+}

package/src/setupAuthentication.js

@@ -3,6 +3,7 @@ import { deleteCookie, getCookie, setCookie } from "hono/cookie";
 import currentPath from "./currentPath.cjs";
 import AuthHelper from "./helpers/AuthHelper";
 import cipher from "./cipher";
+import { decipherMagicPreviewToken } from "./magicPreview";
 
 const DELIMITER = ",";
 
@@ -149,6 +150,17 @@ const setupAuthentication = (app, config) => {
 
     return c.json({ token });
   });
+
+  app.get("/remote/magic-preview/:token", (c) => {
+    const token = c.req.param("token") || "";
+    const payload = decipherMagicPreviewToken(token, config);
+
+    if (!payload?.slug) {
+      return c.json({ error: "Invalid or expired preview token" }, 404);
+    }
+
+    return c.json(payload);
+  });
 };
 
 export default setupAuthentication;

package/src/tests/handlers/resources/TranslationsHandler.test/create.test.js

@@ -5,8 +5,26 @@ import Factory from "../../../support/factory";
 
 function buildCtx(params, resource) {
   return {
+    globalConfig: {
+      i18n: { defaultLocale: "en" },
+      remoteConfig: {
+        magicPreviewUrl: (token, type, loc) =>
+          `https://example.com/${loc}/magic-preview/${type}s/${token}`,
+      },
+    },
     client: {
-      resources: new Resources(() => ({}), "token"),
+      resources: new Resources(
+        () => ({
+          secrets: {
+            crypto_secret: "super-secret-for-testing-1234",
+          },
+          remoteConfig: {
+            magicPreviewUrl: (token, type, loc) =>
+              `https://example.com/${loc}/magic-preview/${type}s/${token}`,
+          },
+        }),
+        "token",
+      ),
       resourceRevisions: new ResourceRevisions(() => ({}), "token"),
     },
     params: { parent_id: resource.id },
@@ -327,4 +345,64 @@ describe("Resource Translations Handler", () => {
       },
     });
   });
+
+  test("create generates previewUrl when workflow is provided", async () => {
+    const resource = Factory.build("resource", {
+      translations: {},
+      categories: [{ id: "cat1" }],
+    });
+
+    const params = {
+      languages: ["fr"],
+      workflow: {
+        type: "LOKALISE_TT_AI",
+      },
+    };
+
+    const ctx = buildCtx(params, resource);
+
+    jest.spyOn(ctx.client.resources, "find").mockImplementation(() => resource);
+    const mockQuery = jest
+      .spyOn(ctx.client.resources, "query")
+      .mockImplementation(() => ({
+        translate0: {
+          resource: {
+            id: "translated-resource-fr",
+            slug: "resource-slug",
+            visibility: "public",
+          },
+          errors: null,
+        },
+      }));
+
+    const result = await TranslationsHandler.create(ctx);
+
+    expect(mockQuery).toHaveBeenCalledWith(expect.any(String), {
+      input0: {
+        locale: "fr",
+        resource: {
+          categories: ["cat1"],
+          resourceType: "article",
+          settings:
+            '{"layout":"default","meta":{"title":"Open graph","description":"Open graph???","image":{}}}',
+          slug: "resource-slug",
+          tags: [],
+          title: "Resource Title",
+          visibility: "private",
+          widgets: "[]",
+        },
+        sourceResourceId: "2",
+        workflow: {
+          previewUrl: expect.stringMatching(
+            /^https:\/\/example\.com\/fr\/magic-preview\/articles\/[A-Za-z0-9_-]+$/,
+          ),
+          type: "LOKALISE_TT_AI",
+        },
+      },
+    });
+
+    expect(result).toEqual({
+      redirect: `/en/articles/${resource.id}/translations?translations=fr:translated-resource-fr`,
+    });
+  });
 });

package/src/tests/helpers/AuthHelper.test.js

@@ -69,6 +69,16 @@ describe("AuthHelper", () => {
         AuthHelper.isAuthenticated({ path: "/auth/google/callback" }),
       ).toBe(true);
       expect(AuthHelper.isAuthenticated({ path: "/remote/verify" })).toBe(true);
+      expect(
+        AuthHelper.isAuthenticated({
+          path: "/remote/magic-preview/any-token-here",
+        }),
+      ).toBe(true);
+      expect(
+        AuthHelper.isAuthenticated({
+          path: "/remote/magic-preview/:token",
+        }),
+      ).toBe(true);
     });
 
     test("returns true for valid token", () => {

package/src/tests/magicPreview.test.js

@@ -0,0 +1,127 @@
+import {
+  buildMagicPreviewAddress,
+  decipherMagicPreviewToken,
+  generateMagicPreviewToken,
+} from "../magicPreview";
+
+describe("magicPreview helper", () => {
+  const config = {
+    secrets: {
+      crypto_secret: "super-secret-key-for-testing-123456",
+    },
+    i18n: {
+      defaultLocale: "en",
+      locales: { en: {}, de: {}, fr: {} },
+    },
+    remoteConfig: {
+      magicPreviewUrl: (token, resourceType, locale) => {
+        return [
+          "https://example.com",
+          locale === "en" ? "" : locale,
+          "magic-preview",
+          resourceType === "page" ? "" : resourceType,
+          token,
+        ]
+          .filter(Boolean)
+          .join("/");
+      },
+    },
+  };
+
+  describe("buildMagicPreviewAddress", () => {
+    it("builds full preview URL using remoteConfig.magicPreviewUrl", () => {
+      const address = buildMagicPreviewAddress(
+        {
+          slug: "gocardless",
+          resourceType: "customer",
+          locale: "en",
+        },
+        config,
+      );
+
+      expect(address).toMatch(
+        /^https:\/\/example\.com\/magic-preview\/customer\/[A-Za-z0-9_-]+$/,
+      );
+    });
+
+    it("builds localized preview URL for non-default locale", () => {
+      const address = buildMagicPreviewAddress(
+        {
+          slug: "gocardless",
+          resourceType: "customer",
+          locale: "de",
+        },
+        config,
+      );
+
+      expect(address).toMatch(
+        /^https:\/\/example\.com\/de\/magic-preview\/customer\/[A-Za-z0-9_-]+$/,
+      );
+    });
+
+    it("throws an error for missing slug", () => {
+      expect(() => {
+        buildMagicPreviewAddress(
+          { resourceType: "page", locale: "de" },
+          config,
+        );
+      }).toThrow(
+        "Can't generate a token without a slug, resourceType or locale!",
+      );
+    });
+
+    it("throws an error for missing resourceType", () => {
+      expect(() => {
+        buildMagicPreviewAddress({ slug: "page", locale: "de" }, config);
+      }).toThrow(
+        "Can't generate a token without a slug, resourceType or locale!",
+      );
+    });
+
+    it("throws an error for missing locale", () => {
+      expect(() => {
+        buildMagicPreviewAddress(
+          { resourceType: "page", slug: "dada" },
+          config,
+        );
+      }).toThrow(
+        "Can't generate a token without a slug, resourceType or locale!",
+      );
+    });
+  });
+
+  describe("generateMagicPreviewToken & decipherMagicPreviewToken", () => {
+    it("generates an encrypted token and deciphers it back", () => {
+      const token = generateMagicPreviewToken(
+        {
+          slug: "my-first-ebook",
+          resourceType: "ebook",
+          locale: "en",
+        },
+        config,
+      );
+
+      expect(typeof token).toBe("string");
+      expect(token).not.toContain("my-first-ebook");
+
+      const payload = decipherMagicPreviewToken(token, config);
+      expect(payload).not.toBeNull();
+      expect(payload.slug).toBe("my-first-ebook");
+      expect(payload.resourceType).toBe("ebook");
+      expect(payload.locale).toBe("en");
+    });
+
+    it("returns null on invalid / tampered token", () => {
+      expect(decipherMagicPreviewToken("", config)).toBeNull();
+      expect(decipherMagicPreviewToken(null, config)).toBeNull();
+      expect(decipherMagicPreviewToken("invalid-token", config)).toBeNull();
+
+      const token = generateMagicPreviewToken(
+        { slug: "secure", resourceType: "page", locale: "en" },
+        config,
+      );
+      const tampered = `${token.slice(0, -4)}XXXX`;
+      expect(decipherMagicPreviewToken(tampered, config)).toBeNull();
+    });
+  });
+});

package/src/tests/setupAuthentication.test.js

@@ -50,6 +50,7 @@ function makeCtx(overrides = {}) {
       path: "/en/pages",
       url: "https://example.com/en/pages",
       query: jest.fn().mockReturnValue({}),
+      param: jest.fn().mockReturnValue(""),
       json: jest.fn().mockResolvedValue({}),
       ...overrides.req,
     },
@@ -72,6 +73,10 @@ const config = {
     remoteLogin: "https://remote/login",
     remoteLogout: "https://remote/logout",
   },
+  secrets: {
+    crypto_secret:
+      "cafeb74e0fc1079d384f68620dc0b0919c82bd36351a74fb48f3c96562c1bf672ff5fd4db42180bc9550d06f3621edba5305a443a232337e2945d7bb1271cafe",
+  },
 };
 
 describe("setupAuthentication", () => {
@@ -96,6 +101,10 @@ describe("setupAuthentication", () => {
       "/remote/verify",
       expect.any(Function),
     );
+    expect(app.get).toHaveBeenCalledWith(
+      "/remote/magic-preview/:token",
+      expect.any(Function),
+    );
   });
 
   describe("use middleware", () => {
@@ -407,4 +416,50 @@ describe("setupAuthentication", () => {
       expect(result.status).toBe(401);
     });
   });
+
+  describe("/remote/magic-preview/:token", () => {
+    test("returns the token payload for a valid token", async () => {
+      const app = makeApp();
+      setupAuthentication(app, config);
+
+      const { generateMagicPreviewToken } = require("../magicPreview");
+      const token = generateMagicPreviewToken(
+        { slug: "article-slug", resourceType: "article", locale: "es" },
+        config,
+      );
+
+      const ctx = makeCtx({
+        req: {
+          param: jest.fn().mockReturnValue(token),
+        },
+      });
+
+      await app.handlers["GET /remote/magic-preview/:token"](ctx);
+
+      expect(ctx.json).toHaveBeenCalledWith({
+        slug: "article-slug",
+        resourceType: "article",
+        locale: "es",
+      });
+    });
+
+    test("returns 404 for invalid token", async () => {
+      const app = makeApp();
+
+      setupAuthentication(app, config);
+
+      const ctx = makeCtx({
+        req: {
+          param: jest.fn().mockReturnValue("bad-token"),
+        },
+      });
+
+      await app.handlers["GET /remote/magic-preview/:token"](ctx);
+
+      expect(ctx.json).toHaveBeenCalledWith(
+        { error: "Invalid or expired preview token" },
+        404,
+      );
+    });
+  });
 });