@suffolklitlab/alkiln 4.11.1 → 4.11.3

package/CHANGELOG.md

@@ -40,6 +40,20 @@ Format:
 -->
 <!-- ## [Unreleased] -->
 
+## [4.11.3] - 2023-04-06
+### Changed
+- Project name prefix now includes ALKiln in it for clarity
+
+### Fixed
+- Projects created in da each have a unique name. https://github.com/SuffolkLITLab/ALKiln/issues/663
+
+## [4.11.2] - 2023-03-22
+### Security
+- Pass docassemble API keys through HTTP headers instead of as parameters.
+  - ACTION: all users should delete any uWSGI logs that show their API keys.
+  - Parameters to certain HTTP requests are printed directly in docassemble's
+    uWSGI log, leaking API keys to actors with log access on your docassemble
+    server.
 
 ## [4.11.1] - 2023-03-21
 ### Changed

package/lib/docassemble/docassemble_api_REST.js

@@ -19,8 +19,8 @@ da.get_dev_id = async function ( timeout ) {
   /* Get docassemble developer id. */
   let options = {
     method: 'GET',
+    headers: {'X-API-Key': session_vars.get_dev_api_key()},
     url: `${ session_vars.get_da_server_url() }/api/user`,
-    params: { key: session_vars.get_dev_api_key(), },
     timeout: timeout,
   };
 
@@ -37,9 +37,9 @@ da.create_project = async function ( project_name, timeout ) {
   /* Create a new project on the user's da server. */
   let options = {
     method: 'POST',
+    headers: {'X-API-Key': session_vars.get_dev_api_key()},
     url: `${ session_vars.get_da_server_url() }/api/playground/project`,
     data: qs.stringify({
-      key: session_vars.get_dev_api_key(),
       project: project_name,
     }),
     timeout: timeout,
@@ -58,9 +58,9 @@ da.pull = async function ( timeout ) {
   /* Pull github code into an existing Project. */
   let options = {
     method: 'POST',
+    headers: {'X-API-Key': session_vars.get_dev_api_key()},
     url: `${ session_vars.get_da_server_url() }/api/playground_pull`,
     data: qs.stringify({
-      key: session_vars.get_dev_api_key(),
       project: session_vars.get_project_name(),
       github_url: session_vars.get_repo_url(),
       branch: session_vars.get_branch_name(),
@@ -81,9 +81,9 @@ da.has_task_finished = async function ( task_id, timeout ) {
   /* Check task status based on `task_id`. */
   let options = {
     method: 'GET',
+    headers: {'X-API-Key': session_vars.get_dev_api_key()},
     url: `${ session_vars.get_da_server_url() }/api/restart_status`,
     params: {
-      key: session_vars.get_dev_api_key(),
       task_id: task_id,
     },
     timeout: timeout,
@@ -102,9 +102,9 @@ da.delete_project = async function ( timeout ) {
   /* Delete a project on the user's da server. */
   let options = {
     method: 'DELETE',
+    headers: {'X-API-Key': session_vars.get_dev_api_key()},
     url: `${ session_vars.get_da_server_url() }/api/playground/project`,
     params: {
-      key: session_vars.get_dev_api_key(),
       project: session_vars.get_project_name(),
     },
     timeout: timeout,
@@ -132,9 +132,9 @@ da.__delete_projects_starting_with = async function ( base_name, starting_num=1,
 
       let options = {
         method: 'DELETE',
+        headers: {'X-API-Key': session_vars.get_dev_api_key()},
         url: `${ session_vars.get_da_server_url() }/api/playground/project`,
         params: {
-          key: session_vars.get_dev_api_key(),
           project: project_name,
         },
         timeout: 30 * 1000,

package/lib/docassemble/docassemble_api_interface.js

@@ -204,16 +204,17 @@ da_i.loop_to_create_project = async function( creation_options ) {
   let wait_seconds = creation_options.wait_seconds || 5;
 
   let project_name = null;
-  let name_incrementor = 0;
+  // Unlikely, but 2 devs could run locally and create the same Project name
+  let num_tries = 0;
 
   // Try to create a project. If the project name is already taken, increment and loop again.
-  while ( name_incrementor <= max_tries ) {
-    name_incrementor++;
+  while ( num_tries <= max_tries ) {
+    num_tries++;
     try {
 
       // Try next name that could be unique. Must remove all non-valid characters
       // TODO: This sanitization is already done in session_vars, so remove it from here
-      project_name = session_vars.get_project_base_name().replace(/[^A-Za-z0-9]/g, '') + name_incrementor;
+      project_name = session_vars.get_project_base_name().replace(/[^A-Za-z0-9]/g, '') + `${Date.now()}`;
       log.info({ pre: `Trying to create a docassemble Project with the name ${ project_name }` });
       let response = await _da_REST.create_project( project_name, timeout );
       log.info({ pre: `The docassemble server is ready. Created a Project named ${ project_name }` });
@@ -222,11 +223,11 @@ da_i.loop_to_create_project = async function( creation_options ) {
 
     } catch ( error ) {
       // TODO: Make a `normalize_ajax_responses_and_errors()`?
-      let response = error.response;
+      let response = error;
 
       if ( response && response.data ) {
         if ( response.data.includes( `Invalid project` ) ) {
-          if ( name_incrementor < max_tries ) {
+          if ( num_tries < max_tries ) {
             // A non-unique project name. Try the next project name.
             continue;
 
@@ -254,11 +255,11 @@ da_i.loop_to_create_project = async function( creation_options ) {
 
         // If it's a timeout error, server is busy. Try again after waiting.
         // Why are we using `max_tries` for timeout error as well?
-        if ( is_timeout_error( error ) && name_incrementor < max_tries ) {
+        if ( is_timeout_error( error ) && num_tries < max_tries ) {
           log.info({ pre: `The docassemble server was busy when we tried to `
-            + `create the Project. Attempt ${ name_incrementor } of `
+            + `create the Project. Attempt ${ num_tries } of `
             + `${ max_tries }. Will try again in ${ wait_seconds } seconds.` });
-          name_incrementor--;  // Try this name again next time
+          num_tries--;  // Don't count this try
           await time.waitForTimeout( wait_seconds * 1000 );
           continue;
 

package/lib/docassemble/setup.js

@@ -25,6 +25,7 @@ const setup = async () => {
   // avoids showing confusing node errors to users that they shouldn't have to fix
   try {
     project_name = await da_i.loop_to_create_project();
+    log.info({type: `setup`, pre: `Created a Project named ${ project_name }`});
   } catch (error) {
     log.error({type: `setup`, pre: `an unexpected error occurred while trying to create a docassemble project in the user's account`, data: JSON.stringify(error, null, 4)})
     // we don't re-throw the exception, so make sure to exit with 1 to let Github Actions know the script failed

package/lib/utils/session_vars.js

@@ -75,7 +75,7 @@ session_vars.get_package_name = function () {
 };
 
 session_vars.get_project_base_name = function () {
-  let name = `testing${ session_vars.get_package_name() }${ session_vars.get_branch_name() }`;
+  let name = `ALKilnTest${ session_vars.get_package_name() }${ session_vars.get_branch_name() }`;
   let sanitized_name = name.replace( /[^A-Za-z0-9]/g, '' );
   return sanitized_name;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suffolklitlab/alkiln",
-  "version": "4.11.1",
+  "version": "4.11.3",
   "description": "Integrated automated end-to-end testing with docassemble, puppeteer, and cucumber.",
   "main": "lib/index.js",
   "scripts": {