30:T11d5,ui = { if (subdomains.length === 0) return md` ## No subdomains certified You will need to [certify ownership of an _Observable_ subdomain](https://observablehq.com/@tomlarkworthy/subdomain-certification) before you can set any secrets. Follow the instructions [here first](https://observablehq.com/@tomlarkworthy/subdomain-certification). ` async function updateValueKeyDown(secret, e) { if (e.keyCode == 13) { const key = secret.name; const subdomain = key.split("_")[0]; const value = e.target.value; mutable uiState = ({...uiState, update: secret}) const put = await fetch(secretsApi.href + `/subdomains/${subdomain}/secrets/${key}`, { method: 'PUT', headers: { idtoken: await user.getIdToken() }, body: JSON.stringify(encode(new TextEncoder("utf-8").encode(value))) }); if (put.status == 204) { mutable uiState = ({...uiState, update: undefined}) } } } async function deleteSecret(secret, e) { const key = secret.name; const subdomain = key.split("_")[0]; mutable uiState = ({...uiState, update: secret}) const deleteResponse = await fetch(secretsApi.href + `/subdomains/${subdomain}/secrets/${key}`, { method: 'DELETE', headers: { idtoken: await user.getIdToken() } }); if (deleteResponse.status == 204) { mutable uiState = ({...uiState, update: undefined}) mutable secrets = ({ ...secrets, [subdomain]: [ ...secrets[subdomain].filter(s => s.name !== key), ] }) } } function newSecretFocus(subdomain, e) { e.target.value = subdomain + "_" } function newSecretKeyDown(subdomain, e) { if (e.keyCode == 13) { if (e.target.value.startsWith(subdomain + "_")) { mutable uiState = ({...uiState, newSecret: e.target.value}) } else { mutable uiState = uiState } } } async function newSecretValueKeyDown(e) { if (e.keyCode == 13) { mutable uiState = ({...uiState, newValue: "PENDING"}); const secret = uiState.newSecret; const subdomain = uiState.newSecret.split("_")[0]; const value = e.target.value; const put = await fetch(secretsApi.href + `/subdomains/${subdomain}/secrets/${secret}`, { method: 'PUT', headers: { idtoken: await user.getIdToken() }, body: JSON.stringify(encode(new TextEncoder("utf-8").encode(value))) }); if (put.status == 204) { mutable uiState = ({...uiState, newValue: undefined, newSecret: undefined}); mutable secrets = ({ ...secrets, [subdomain]: [ ...secrets[subdomain], {name: secret} ] }) } } } return html`

${subdomains.map(subdomain => html`

Secrets for namespace ${subdomain}

${secrets[subdomain].map((secret, index) => html.fragment` `)}

secret	new value
${secrets[subdomain][index].name}	${uiState.update === secret ? "modifying..." : uiState.update ? null : html`` }
${subdomain != 'tomlarkworthy' && secrets[subdomain].length > 2 ? html`Limit of 2 secrets per subdomain reached( get more)` : uiState.newSecret ? uiState.newSecret : html`` }	${uiState.newSecret && uiState.newValue ? html`creating...` : uiState.newSecret ? html`` : null }

`)}` }31:T1152,apiServer = { const app = Router(); // Common to all routes app.use(async (req, res, next) => { // Security try { req.auth = await verifyIdToken(firebase, req.headers["idtoken"]); next(); } catch (err) { res.status(403).send("Auth: " + err.message); } }); app.get("/", (req, res) => { res.status(200).end(); }); // Additional security checks for subdomain ownership and preparing a secret client. app.all("/subdomains/:subdomain/secrets**", async (req, res, next) => { const service_account = req.context.secrets["endpointservices_secretadmin_service_account_key"]; const access_token = await getAccessTokenFromServiceAccount( service_account ); await signinWithAccessToken(firebase, access_token); if (req.auth.uid.startsWith("observablehq|")) { if (req.auth["observablehq.com"][req.params.subdomain] !== "admin") { res.status(403).send("Not owner of subdomain"); } } else { const ownersQuery = await firebase .firestore() .collection("/services/ownership/owners") .where("subdomain", "==", req.params.subdomain) .where("uid", "==", req.auth.uid) .limit(1) .get(); if (ownersQuery.empty) { res.status(403).send("Not owner of subdomain"); } } req.secretManagerClient = new SecretManagerServiceClient({ projectId: firebaseConfig.projectId, access_token: access_token }); next(); }); app.get("/subdomains/:subdomain/secrets", async (req, res) => { try { // This won't scale but we have no simple way of searching // https://stackoverflow.com/questions/65044519/is-there-a-way-of-querying-google-secrets-manager const secrets = ( await req.secretManagerClient.listSecrets({ parent: "projects/1986724398", pageSize: 25000 }) )[0]; // Only return results prefixed by the subdomain the user has permission to const results = secrets .map((s) => ({ name: s.name.split("/")[3] })) .filter((secret) => secret.name.startsWith(`${req.params.subdomain}_`)); res.json(results); } catch (err) { res.status(500).send(err.message); } }); app.put("/subdomains/:subdomain/secrets/:secret", async (req, res) => { try { // This won't scale but we have no simple way of searching // https://stackoverflow.com/questions/65044519/is-there-a-way-of-querying-google-secrets-manager const secretId = req.params.secret; if (!secretId.startsWith(req.params.subdomain + "_")) { res.status(400).send("secret name must be prefixed by subdomain"); } const value = JSON.parse(req.body); try { // It might already been created in which case we really just want to create a new version const secret = ( await req.secretManagerClient.createSecret({ parent: "projects/1986724398", secretId, secret: { labels: { subdomain: req.params.subdomain }, replication: { automatic: {} } } }) )[0]; } catch (err) { // It's ok to fail this one } const version = await req.secretManagerClient.addSecretVersion({ parent: `projects/1986724398/secrets/${secretId}`, payload: { data: value } }); // TODO, we should delete the previous version too res.status(204).end(); } catch (err) { res.status(500).send(err.message); } }); app.delete("/subdomains/:subdomain/secrets/:secret", async (req, res) => { try { // This won't scale but we have no simple way of searching // https://stackoverflow.com/questions/65044519/is-there-a-way-of-querying-google-secrets-manager const secretId = req.params.secret; if (!secretId.startsWith(req.params.subdomain + "_")) { res.status(400).send("secret name must be prefixed by subdomain"); } await req.secretManagerClient.deleteSecret({ name: `projects/1986724398/secrets/${secretId}` }); res.status(204).end(); } catch (err) { res.status(500).send(err.message); } }); app.use((req, res) => { res .status(404) .send( "No route found in the https://observablehq.com/@endpointservices/secrets API" ); }); return app; }32:Ta5a,class SecretManagerServiceClient { constructor (options) { this.projectId = options.projectId; this.access_token = options.access_token; } // https://googleapis.dev/nodejs/secretmanager/latest/v1.SecretManagerServiceClient.html#listSecrets async listSecrets(options) { const response = await fetch( `https://secretmanager.googleapis.com/v1/${options.parent}/secrets?pageSize=${options.pageSize || 0}`, { headers: { Authorization: `Bearer ${this.access_token}` } } ); if (response.status != 200) throw new Error(response.status + " " + await response.text()) const json = await response.json(); return [json.secrets] } // https://googleapis.dev/nodejs/secretmanager/latest/v1.SecretManagerServiceClient.html#createSecret async createSecret(options) { const secretId = options.secretId; const secret = options.secret; const parent = options.parent; const response = await fetch( `https://secretmanager.googleapis.com/v1/${parent}/secrets?secretId=${secretId}`, { method: 'POST', headers: { Authorization: `Bearer ${this.access_token}` }, body: JSON.stringify(secret) } ); if (response.status != 200) throw new Error(response.status + " " + await response.text()) const json = await response.json(); return [json] } // https://cloud.google.com/secret-manager/docs/reference/rest/v1/projects.secrets/delete async deleteSecret(options) { const name = options.name; const response = await fetch( `https://secretmanager.googleapis.com/v1/${name}`, { method: 'DELETE', headers: { Authorization: `Bearer ${this.access_token}` } } ); if (!(response.status == 200 || response.status == 204 || response.status == 404)) throw new Error(response.status + " " + await response.text()) return [{}] } // https://googleapis.dev/nodejs/secretmanager/latest/v1.SecretManagerServiceClient.html#addSecretVersion async addSecretVersion(options) { const payload = options.payload; const parent = options.parent; const response = await fetch( `https://secretmanager.googleapis.com/v1/${parent}:addVersion`, { method: 'POST', headers: { Authorization: `Bearer ${this.access_token}` }, body: JSON.stringify({ payload: payload }) } ); if (response.status != 200) throw new Error("addVersion: " + response.status + " " + await response.text()) const json = await response.json(); return [json] } }33:[{"id":"b5f1d93229eb3db4693c9a7a349fe2840b046bc69100ef9a7d47545f264fc798270fae3ca7ff3769ad0d4b17f3012205c35c198f9584d8711f3ca703c7026916","href":"https://static.observableusercontent.com/files/b5f1d93229eb3db4693c9a7a349fe2840b046bc69100ef9a7d47545f264fc798270fae3ca7ff3769ad0d4b17f3012205c35c198f9584d8711f3ca703c7026916","name":"buddha-525883_1280.jpg","type":"image/jpeg","lastModified":1606512814242.219,"size":140743}] 2e:{"title":"Endpoint Secret Manager","cells":[{"id":790,"value":"md`# Endpoint Secret Manager\n\n

\n\nHosts the API and browser for secret storage for [webcode.run](https://webcode.run)\n`","pinned":false,"hidden":false,"mode":"ojs"},{"id":1166,"value":"$30","pinned":false,"hidden":false,"mode":"ojs"},{"id":1361,"value":"md`### Login with Comment`","pinned":false,"hidden":false,"mode":"ojs"},{"id":1468,"value":"viewof userModern","pinned":false,"hidden":false,"mode":"ojs"},{"id":1457,"value":"md`#### ⚠️ Legacy Login with Firebase UI (don't use if you have not before)`","pinned":false,"hidden":false,"mode":"ojs"},{"id":55,"value":"viewof userLegacy","pinned":false,"hidden":false,"mode":"ojs"},{"id":1482,"value":"user = {\n let resolve;\n const user = new Promise(_resolve => (resolve = _resolve));\n\n if (viewof userLegacy.value && !viewof userLegacy.value.then) {\n resolve(viewof userLegacy.value);\n } else {\n viewof userLegacy.addEventListener('input', evt => {\n resolve(viewof userLegacy.value);\n });\n }\n\n if (viewof userModern.value && !viewof userModern.value.then) {\n resolve(viewof userModern.value);\n } else {\n viewof userModern.addEventListener('input', evt => {\n resolve(viewof userModern.value);\n });\n }\n return user;\n}","pinned":false,"hidden":false,"mode":"ojs"},{"id":1514,"value":"user","pinned":true,"hidden":false,"mode":"ojs"},{"id":1397,"value":"md`### Change log\n- 2021-29-08: Login with comment works for team secrets too\n- 2021-20-08: Now you can login with comment, no subdomain verification required.\n- 2021-01-05: Make tests run after UI to improve performance.\n`","pinned":false,"hidden":false,"mode":"ojs"},{"id":1320,"value":"md`### Tests`","pinned":false,"hidden":false,"mode":"ojs"},{"id":865,"value":"viewof suite = {\n ui; // after ui\n return createSuite({\n timeout_ms: 20000\n });\n}","pinned":false,"hidden":false,"mode":"ojs"},{"id":869,"value":"suite.test(\"GET / authenticated status is 200\", async () => {\n const response = await fetch(secretsApi.href + \"/\", {\n headers: {\n idtoken: await user.getIdToken()\n }\n });\n expect(response.status).toBe(200);\n})","pinned":false,"hidden":false,"mode":"ojs"},{"id":962,"value":"suite.test(\"GET / unauthenticated status is 403\", async () => {\n const response = await fetch(secretsApi.href + \"/\")\n expect(response.status).toBe(403);\n}); ","pinned":false,"hidden":false,"mode":"ojs"},{"id":1000,"value":"suite.test(\"GET /subdomains/tomlarkworthy/secrets lists at least 2 secrets for Tom\", async () => {\n if (user.uid !== 'd0bbb0hC9jhC2XcYYvPEhO78qnx2') return; // Other users can't test this\n \n const response = await fetch(secretsApi.href + \"/subdomains/tomlarkworthy/secrets\", {\n headers: {\n idtoken: await user.getIdToken()\n }\n })\n expect(response.status).toBe(200);\n const payload = await response.json();\n expect(payload.length).toBeGreaterThan(2); // There should be a few secrets\n});","pinned":false,"hidden":false,"mode":"ojs"},{"id":1023,"value":"suite.test(\"GET /subdomains/random/secrets authenticated 403 for Tom\", async () => {\n if (user.uid !== 'd0bbb0hC9jhC2XcYYvPEhO78qnx2') return; // Other users can't test this\n \n const response = await fetch(secretsApi.href + \"/subdomains/random/secrets\", {\n headers: {\n idtoken: await user.getIdToken()\n }\n })\n expect(response.status).toBe(403); \n});","pinned":false,"hidden":false,"mode":"ojs"},{"id":1088,"value":"suite.test(\"PUT /subdomains/tomlarkworthy/secrets/tomlarkworthy_test to create a secret is OK for Tom\", async () => {\n if (user.uid !== 'd0bbb0hC9jhC2XcYYvPEhO78qnx2') return; // Other users can't test this\n \n const response = await fetch(secretsApi.href + \"/subdomains/tomlarkworthy/secrets/tomlarkworthy_test\", {\n method: 'PUT',\n headers: {\n idtoken: await user.getIdToken()\n },\n body: JSON.stringify(encode(new TextEncoder(\"utf-8\").encode('check')))\n })\n expect(response.status).toBe(204);\n});","pinned":false,"hidden":false,"mode":"ojs"},{"id":1300,"value":"suite.test(\"DELETE /subdomains/tomlarkworthy/secrets/tomlarkworthy_test to delete a secret is OK for Tom\", async () => {\n if (user.uid !== 'd0bbb0hC9jhC2XcYYvPEhO78qnx2') return; // Other users can't test this\n const response = await fetch(secretsApi.href + \"/subdomains/tomlarkworthy/secrets/tomlarkworthy_test\", {\n method: 'DELETE',\n headers: {\n idtoken: await user.getIdToken()\n }\n })\n console.log(await response.text())\n expect(response.status).toBe(204);\n});","pinned":false,"hidden":false,"mode":"ojs"},{"id":1323,"value":"md`### UI Implementation`","pinned":false,"hidden":false,"mode":"ojs"},{"id":1227,"value":"mutable uiState = ({})","pinned":false,"hidden":false,"mode":"ojs"},{"id":1143,"value":"viewof subdomain_certificates = {\n if (user.uid.startsWith('observablehq|')) {\n const ui = md`Logged in with ${user.uid}`;\n ui.value = Object.keys(\n (await user.getIdTokenResult()).claims['observablehq.com']\n ).map(_ => ({ subdomain: _ }));\n return ui;\n } else {\n return new DocsView(\n firebase\n .firestore()\n .collection(\"/services/ownership/owners\")\n .where(\"uid\", \"==\", user.uid)\n );\n }\n}","pinned":false,"hidden":false,"mode":"ojs"},{"id":1194,"value":"subdomain_certificates","pinned":false,"hidden":false,"mode":"ojs"},{"id":1150,"value":"subdomains = subdomain_certificates.reduce(\n (acc, cert) => {\n if (!acc.includes(cert.subdomain)) acc.push(cert.subdomain)\n return acc\n },\n []\n)","pinned":false,"hidden":false,"mode":"ojs"},{"id":1204,"value":"mutable secrets = subdomains.reduce(\n async (acc_p, subdomain) => {\n const acc = await acc_p;\n const response = await fetch(secretsApi.href + `/subdomains/${subdomain}/secrets`, {\n headers: {\n idtoken: await user.getIdToken()\n }\n })\n if (response.status >= 400) throw new Error(await response.text())\n acc[subdomain] = (await response.json()).sort()\n return acc;\n }, {})","pinned":false,"hidden":false,"mode":"ojs"},{"id":1335,"value":"md`### API Implementation`","pinned":false,"hidden":false,"mode":"ojs"},{"id":823,"value":"import {deploy, Router, handleWithExpress} from '@tomlarkworthy/api-hosting-with-express'","pinned":false,"hidden":false,"mode":"ojs"},{"id":885,"value":"import {verifyIdToken, getAccessTokenFromServiceAccount, signinWithAccessToken} from '@tomlarkworthy/firebase-admin'","pinned":false,"hidden":false,"mode":"ojs"},{"id":1557,"value":"verifyIdToken(firebase, await user.getIdToken())","pinned":true,"hidden":false,"mode":"ojs"},{"id":825,"value":"$31","pinned":true,"hidden":false,"mode":"ojs"},{"id":987,"value":"$32","pinned":false,"hidden":false,"mode":"ojs"},{"id":829,"value":"secretsApi = {\n return deploy(\"default\", handleWithExpress(apiServer), {\n reusable: true,\n cell: \"secretsApi\",\n secrets: [\"endpointservices_secretadmin_service_account_key\"]\n });\n}","pinned":false,"hidden":false,"mode":"ojs"},{"id":84,"value":"relation = ({\n \"uid\": user.uid, \n \"host\": location.host\n})","pinned":false,"hidden":false,"mode":"ojs"},{"id":51,"value":"import {viewof user as userLegacy, firebase, DocsView} with {firebaseConfig as firebaseConfig} from '@tomlarkworthy/firebaseui'","pinned":false,"hidden":false,"mode":"ojs"},{"id":1461,"value":"import { viewof user as userModern } from '@endpointservices/endpoint-login-with-comment'","pinned":false,"hidden":false,"mode":"ojs"},{"id":1596,"value":"userModern","pinned":true,"hidden":false,"mode":"ojs"},{"id":58,"value":"firebaseConfig = ({\n apiKey: \"AIzaSyD882c8YEgeYpNkX01fhpUDfioWl_ETQyQ\",\n authDomain: \"endpointservice.firebaseapp.com\",\n databaseURL: \"https://endpointservice.firebaseio.com\",\n projectId: \"endpointservice\",\n storageBucket: \"endpointservice.appspot.com\",\n messagingSenderId: \"1986724398\",\n appId: \"1:1986724398:web:9b8bc33895b45dd2e095bf\",\n uiConfig: { // https://github.com/firebase/firebaseui-web#configuration\n signInOptions: [\"google.com\", \"facebook.com\", \"phone\"],\n },\n});","pinned":false,"hidden":false,"mode":"ojs"},{"id":250,"value":"jsrsasign = require('https://bundle.run/jsrsasign@10.1.4')","pinned":false,"hidden":false,"mode":"ojs"},{"id":475,"value":"import {html} from \"@observablehq/htl\"","pinned":false,"hidden":false,"mode":"ojs"},{"id":860,"value":"import {createSuite, expect} from '@tomlarkworthy/testing'","pinned":false,"hidden":false,"mode":"ojs"},{"id":1109,"value":"import {encode, decode} from '@mbostock/base64'","pinned":false,"hidden":false,"mode":"ojs"},{"id":1566,"value":"import { footer } from \"@endpointservices/footer\" // webcode dependancy","pinned":false,"hidden":false,"mode":"ojs"},{"id":1599,"value":"footer","pinned":false,"hidden":false,"mode":"ojs"}],"files":"$W33","stdlib":"1","titling":"auto"}