@suffolklitlab/alkiln 4.11.0 → 4.11.2

package/CHANGELOG.md

@@ -40,6 +40,18 @@ Format:
 -->
 <!-- ## [Unreleased] -->
 
+## [4.11.2] - 2023-03-22
+### Security
+- Pass docassemble API keys through HTTP headers instead of as parameters.
+  - ACTION: all users should delete any uWSGI logs that show their API keys.
+  - Parameters to certain HTTP requests are printed directly in docassemble's
+    uWSGI log, leaking API keys to actors with log access on your docassemble
+    server.
+
+## [4.11.1] - 2023-03-21
+### Changed
+- Get error data from server errors
+
 ## [4.11.0] - 2023-03-13
 ### Changed
 - Shorten Axios errors to make them more readable (https://github.com/SuffolkLITLab/ALKiln/pull/632)

package/lib/docassemble/docassemble_api_REST.js

@@ -19,15 +19,15 @@ da.get_dev_id = async function ( timeout ) {
   /* Get docassemble developer id. */
   let options = {
     method: 'GET',
+    headers: {'X-API-Key': session_vars.get_dev_api_key()},
     url: `${ session_vars.get_da_server_url() }/api/user`,
-    params: { key: session_vars.get_dev_api_key(), },
     timeout: timeout,
   };
 
   try {
     return await axios.request( options );
   } catch (error) {
-    throw error.toJSON();
+    throw {...error.toJSON(), data: error.response?.data};
   }
 };  // Ends da.get_dev_id()
 
@@ -37,9 +37,9 @@ da.create_project = async function ( project_name, timeout ) {
   /* Create a new project on the user's da server. */
   let options = {
     method: 'POST',
+    headers: {'X-API-Key': session_vars.get_dev_api_key()},
     url: `${ session_vars.get_da_server_url() }/api/playground/project`,
     data: qs.stringify({
-      key: session_vars.get_dev_api_key(),
       project: project_name,
     }),
     timeout: timeout,
@@ -48,7 +48,7 @@ da.create_project = async function ( project_name, timeout ) {
   try {
     return await axios.request( options );
   } catch (error) {
-    throw error.toJSON();
+    throw {...error.toJSON(), data: error.response?.data};
   }
 };  // Ends da.create_project()
 
@@ -58,9 +58,9 @@ da.pull = async function ( timeout ) {
   /* Pull github code into an existing Project. */
   let options = {
     method: 'POST',
+    headers: {'X-API-Key': session_vars.get_dev_api_key()},
     url: `${ session_vars.get_da_server_url() }/api/playground_pull`,
     data: qs.stringify({
-      key: session_vars.get_dev_api_key(),
       project: session_vars.get_project_name(),
       github_url: session_vars.get_repo_url(),
       branch: session_vars.get_branch_name(),
@@ -71,7 +71,7 @@ da.pull = async function ( timeout ) {
   try {
     return await axios.request( options );
   } catch (error) {
-    throw error.toJSON();
+    throw {...error.toJSON(), data: error.response?.data};
   }
 };  // Ends da.pull()
 
@@ -81,9 +81,9 @@ da.has_task_finished = async function ( task_id, timeout ) {
   /* Check task status based on `task_id`. */
   let options = {
     method: 'GET',
+    headers: {'X-API-Key': session_vars.get_dev_api_key()},
     url: `${ session_vars.get_da_server_url() }/api/restart_status`,
     params: {
-      key: session_vars.get_dev_api_key(),
       task_id: task_id,
     },
     timeout: timeout,
@@ -92,7 +92,7 @@ da.has_task_finished = async function ( task_id, timeout ) {
   try {
     return await axios.request( options );
   } catch (error) {
-    throw error.toJSON();
+    throw {...error.toJSON(), data: error.response?.data};
   }
 };  // Ends da.has_task_finished()
 
@@ -102,9 +102,9 @@ da.delete_project = async function ( timeout ) {
   /* Delete a project on the user's da server. */
   let options = {
     method: 'DELETE',
+    headers: {'X-API-Key': session_vars.get_dev_api_key()},
     url: `${ session_vars.get_da_server_url() }/api/playground/project`,
     params: {
-      key: session_vars.get_dev_api_key(),
       project: session_vars.get_project_name(),
     },
     timeout: timeout,
@@ -113,7 +113,7 @@ da.delete_project = async function ( timeout ) {
   try {
     return await axios.request( options );
   } catch (error) {
-    throw error.toJSON();
+    throw {...error.toJSON(), data: error.response?.data};
   }
 };  // Ends da.delete_project()
 
@@ -132,9 +132,9 @@ da.__delete_projects_starting_with = async function ( base_name, starting_num=1,
 
       let options = {
         method: 'DELETE',
+        headers: {'X-API-Key': session_vars.get_dev_api_key()},
         url: `${ session_vars.get_da_server_url() }/api/playground/project`,
         params: {
-          key: session_vars.get_dev_api_key(),
           project: project_name,
         },
         timeout: 30 * 1000,
@@ -142,7 +142,7 @@ da.__delete_projects_starting_with = async function ( base_name, starting_num=1,
 
       await axios.request( options );
     } catch ( error ) {
-      console.log( error.toJSON() )
+      console.log( {...error.toJSON(), data: error.response?.data});
     }
     name_incrementor++;
   }

package/lib/docassemble/docassemble_api_interface.js

@@ -222,7 +222,7 @@ da_i.loop_to_create_project = async function( creation_options ) {
 
     } catch ( error ) {
       // TODO: Make a `normalize_ajax_responses_and_errors()`?
-      let response = error.response;
+      let response = error;
 
       if ( response && response.data ) {
         if ( response.data.includes( `Invalid project` ) ) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suffolklitlab/alkiln",
-  "version": "4.11.0",
+  "version": "4.11.2",
   "description": "Integrated automated end-to-end testing with docassemble, puppeteer, and cucumber.",
   "main": "lib/index.js",
   "scripts": {