flaxo/ghost

public

Source code of Ghost - On Ghost

ghostappsapisrcresourcesimportsimporter-secret.guard.ts

allow importing repos from github, including their end to end resources like issues, PRs, releases78521fe11 days ago31 lines · 1.1 KB

1	import {
2	type CanActivate,
3	type ExecutionContext,
4	Injectable,
5	UnauthorizedException,
6	} from '@nestjs/common';
7	import { ConfigService }
8	import { createHash, timingSafeEqual
9	import type { Request
10
11	import { githubImportConfig }
12
13	/** The importer's callbacks carry the secret the API sent its jobs with. */
14	@Injectable()
15	export class ImporterSecretGuard
16	constructor(private readonly
17
18	canActivate(context:
19	const secret =
20	const header =
21	.headers.authorization;
22	if (!secret \|\|
23	throw new UnauthorizedException()
24
25	// Hashing first gives both sides one length, which `timingSafeEqual` needs.
26	const given =
27	const expected =
28	if (!timingSafeEqual(given
29	return true;
30	}
31	}

from

'

@nestjs/config

'

;

}

from

'

node:crypto

'

;

}

from

'

express

'

;

from

'

../../lib/imports/importer.js

'

;

implements

CanActivate

{

config

:

ConfigService

)

{}

ExecutionContext

)

{

githubImportConfig

(

this

.

config

)

?.

importerSecret

;

context

.

switchToHttp

()

.

getRequest

<

Request

>

()

!

header

?.

startsWith

(

'

Bearer

'

))

;

createHash

(

'

sha256

'

)

.

update

(

header

.

slice

(

7

))

.

digest

()

;

createHash

(

'

sha256

'

)

.

update

(

secret

)

.

digest

()

;

,

expected

))

throw

new

UnauthorizedException

()

;