@replayio-app-building/netlify-recorder 0.15.5 → 0.15.6

package/README.md

@@ -31,8 +31,9 @@ The Netlify Recorder app (`https://netlify-recorder-bm4wmw.netlify.app`) provide
 | `REPLAY_REPOSITORY_URL` | Your app's git repository URL (e.g. `https://github.com/org/repo.git`) | Set in your deploy script or Netlify site settings |
 | `COMMIT_SHA` | The git commit hash of the deployed code | Set in your deploy script via `git rev-parse HEAD` |
 | `BRANCH_NAME` | The git branch of the deployed code | Set in your deploy script via `git rev-parse --abbrev-ref HEAD` |
+| `NETLIFY_RECORDER_SECRET` | Secret string for access control — restricts who can view and act on your captured requests | Set in Netlify site environment variables or via `set-branch-secret` |
 
-**These are required.** `finishRequest` will throw an error if any are missing. Your deploy script should resolve them from git and set them on the Netlify site before deploying. Example:
+The first three are **required** — `finishRequest` will throw an error if any are missing. `NETLIFY_RECORDER_SECRET` is strongly recommended to prevent other apps from accessing your captured request data. Your deploy script should resolve the git values and set them on the Netlify site before deploying. Example:
 
 ```typescript
 // In your deploy script:
@@ -46,7 +47,7 @@ const repositoryUrl = execSync("git remote get-url origin", { encoding: "utf-8"
 
 ### 2. Wrap your Netlify function
 
-Use `createRecordingRequestHandler` with `remoteCallbacks()` to wrap your handler with automatic request capture.
+Use `createRecordingRequestHandler` with `remoteCallbacks()` to wrap your handler with automatic request capture. Set `secret` to restrict access to captured requests — only API calls providing the same secret can view or act on them.
 
 **v1 handler** (Netlify Functions v1 — `event` with `httpMethod`, `path`, etc.):
 
@@ -71,6 +72,7 @@ const handler = createRecordingRequestHandler(
   {
     callbacks: remoteCallbacks(RECORDER_URL),
     handlerPath: "netlify/functions/my-handler",
+    secret: process.env.NETLIFY_RECORDER_SECRET,
   }
 );
 
@@ -102,6 +104,7 @@ export default createRecordingRequestHandler(
   {
     callbacks: remoteCallbacks(RECORDER_URL),
     handlerPath: "netlify/functions/my-handler",
+    secret: process.env.NETLIFY_RECORDER_SECRET,
   }
 );
 ```
@@ -262,6 +265,7 @@ const handler = createRecordingRequestHandler(
     };
   },
   {
+    secret: process.env.NETLIFY_RECORDER_SECRET,
     callbacks: {
       uploadBlob: async (data) => {
         // Upload the JSON string to your blob storage (S3, R2, etc.)
@@ -272,10 +276,10 @@ const handler = createRecordingRequestHandler(
         const { url } = await res.json();
         return url;
       },
-      storeRequestData: async ({ blobUrl, commitSha, branchName, repositoryUrl, handlerPath }) => {
+      storeRequestData: async ({ blobUrl, commitSha, branchName, repositoryUrl, handlerPath, secret }) => {
         const [row] = await sql`
-          INSERT INTO requests (blob_url, commit_sha, branch_name, repository_url, handler_path, status)
-          VALUES (${blobUrl}, ${commitSha}, ${branchName}, ${repositoryUrl}, ${handlerPath}, 'captured')
+          INSERT INTO requests (blob_url, commit_sha, branch_name, repository_url, handler_path, secret, status)
+          VALUES (${blobUrl}, ${commitSha}, ${branchName}, ${repositoryUrl}, ${handlerPath}, ${secret}, 'captured')
           RETURNING id
         `;
         return row.id;
@@ -297,12 +301,15 @@ CREATE TABLE IF NOT EXISTS requests (
   branch_name TEXT,
   repository_url TEXT,
   handler_path TEXT,
+  secret TEXT,
   recording_id TEXT,
   status TEXT NOT NULL DEFAULT 'captured'
     CHECK (status IN ('captured', 'processing', 'recorded', 'failed')),
   created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
   updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
 );
+
+CREATE INDEX IF NOT EXISTS idx_requests_secret ON requests (secret) WHERE secret IS NOT NULL;
 ```
 
 ### 4. Create a background function to produce recordings
@@ -434,6 +441,7 @@ export default createRecordingRequestHandler(
   {
     callbacks: remoteCallbacks(RECORDER_URL),
     handlerPath: "netlify/functions/create-order",
+    secret: process.env.NETLIFY_RECORDER_SECRET,
   }
 );
 ```
@@ -595,6 +603,7 @@ These must be set on your Netlify site. Your deploy script should resolve them f
 | `COMMIT_SHA` | Git commit hash of the deployed code | `git rev-parse HEAD` |
 | `BRANCH_NAME` | Git branch of the deployed code | `git rev-parse --abbrev-ref HEAD` |
 | `REPLAY_REPOSITORY_URL` | Git repository URL (no embedded credentials) | `git remote get-url origin` (strip tokens) |
+| `NETLIFY_RECORDER_SECRET` | Secret for access control (strongly recommended) | `openssl rand -base64 32` — store in Netlify site env vars |
 
 ### Required for self-hosted recording (Option B)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@replayio-app-building/netlify-recorder",
-  "version": "0.15.5",
+  "version": "0.15.6",
   "description": "Capture and replay Netlify function executions as Replay recordings",
   "type": "module",
   "exports": {