Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

task: Add customHeaders as possible parameter. #4139

Merged
merged 3 commits into from
Jul 5, 2023

Conversation

chriswk
Copy link
Contributor

@chriswk chriswk commented Jul 4, 2023

###What
Adds an optional sensitive parameter for customHeaders to all current addons. When formatted as a valid json object, the object will be included as headers in the request the addon makes upstream to it's target URL

Adds support for custom headers for all current addons.
@chriswk chriswk self-assigned this Jul 4, 2023
@vercel
Copy link

vercel bot commented Jul 4, 2023

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
unleash-docs ✅ Ready (Inspect) Visit Preview 💬 Add feedback Jul 5, 2023 7:04am
unleash-monorepo-frontend ✅ Ready (Inspect) Visit Preview 💬 Add feedback Jul 5, 2023 7:04am

url: 'http://test.webhook.com/plain',
bodyTemplate: '{{event.type}} on toggle {{event.data.name}}',
contentType: 'text/plain',
authorization: 'API KEY 123abc',

Check failure

Code scanning / CodeQL

Hard-coded credentials Critical

The hard-coded value "API KEY 123abc" is used as
authorization header
.
The hard-coded value "API KEY 123abc" is used as
authorization header
.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it can safely be dismissed

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Indeed, since it's a test, but it's good to see CodeQL catching these, just in case we stupidly add them to production code. :)

Copy link
Contributor

@gastonfournier gastonfournier left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this will work, just maybe a few improvements

@@ -1,9 +1,18 @@
// Jest Snapshot v1, https://goo.gl/fbAQLP

exports[`Should call slack webhook 1`] = `"{"username":"Unleash","icon_emoji":":unleash:","text":"some@user.com created feature toggle <http://some-url.com/projects/default/features/some-toggle|some-toggle> in project *default*","channel":"#undefined","attachments":[{"actions":[{"name":"featureToggle","text":"Open in Unleash","type":"button","value":"featureToggle","style":"primary","url":"http://some-url.com/projects/default/features/some-toggle"}]}]}"`;
exports[`Should call slack webhook 1`] = `"{"username":"Unleash","icon_emoji":":unleash:","text":"some@user.com created feature toggle <http://some-url.com/projects/default/features/some-toggle|some-toggle> in project *default*","channel":"#general","attachments":[{"actions":[{"name":"featureToggle","text":"Open in Unleash","type":"button","value":"featureToggle","style":"primary","url":"http://some-url.com/projects/default/features/some-toggle"}]}]}"`;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have you fixed slack integration by chance?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, have not changed it, just given it support for custom headers

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It changed from undefined to general so the support for custom headers might have helped. Not sure but 👍

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, that's just because I'm now type checking the parameters, so our test no longer allowed us to activate the slack addon with no defined defaultChannel (it's marked as required in our definition). Earlier, the test that wrote this snapshot did not have the defaultChannel parameter set, which caused javascript to happily send undefined :)

interface IDatadogParameters {
url: string;
apiKey: string;
customHeaders?: string;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why not something like:

    customHeaders?: { [key: string]: string } | Record<string, string> ;

That would save you from doing JSON.parse later

Inspired by https://github.com/search?q=%22type+HeadersInit+%3D%22+language%3ATypeScript&type=code&l=TypeScript

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm, if it works that would be good, we just don't have a way to define the input parameter in the addon definition as anything but a string. So somewhere we'd need to do the parsing.

extraHeaders = JSON.parse(customHeaders);
} catch (e) {
this.logger.warn(
'Could not parse the json in the customHeaders parameters',
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
'Could not parse the json in the customHeaders parameters',
`Could not parse the json in the customHeaders parameters ${customHeaders}`,

but I think this exception should bubble up as it'd be a configuration issue

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But you wouldn't want to throw an exception when creating a feature because one of the addons failed to parse data.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Though, this is on a different thread.

username?: string;
defaultChannel: string;
emojiIcon?: string;
customHeaders?: string;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe this would benefit from the same suggestion:

customHeaders?: { [key: string]: string } | Record<string, string> ;

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same comment here, since we're doing a post of parameters, it isn't currently possible to have it as anything but strings, otherwise our template for event data would also be something else but string. I tested locally to ensure that this was correct.

@@ -8,6 +8,10 @@ import {
} from './feature-event-formatter-md';
import { IEvent } from '../types/events';

interface ITeamsParameters {
url: string;
customHeaders?: string;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same :D

@@ -9,6 +9,7 @@ interface IParameters {
bodyTemplate?: string;
contentType?: string;
authorization?: string;
customHeaders?: string;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And one more... although this could be a bit trickier because we need to handle a web request.

Comment on lines 111 to 114
export interface ICustomHeaders {
[name: string]: string;
}

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, I think you had the idea of doing something as I suggested, but I believe this is not used right now

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You're right. I forgot to remove this one.

Copy link
Contributor

@gastonfournier gastonfournier left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LG!

@chriswk chriswk merged commit 186fda1 into main Jul 5, 2023
12 of 17 checks passed
@chriswk chriswk deleted the task/customHeadersAddons branch July 5, 2023 07:42
gastonfournier pushed a commit that referenced this pull request Jul 12, 2023
Adds an optional sensitive parameter for customHeaders to all current
addons. It is sensitive because the user might be including api key headers.
gastonfournier added a commit that referenced this pull request Jul 12, 2023
## About the changes
Early release of #4139 and
#4196 as 5.2 patch

---------

Co-authored-by: Christopher Kolstad <chriswk@getunleash.ai>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Archived in project
Development

Successfully merging this pull request may close these issues.

None yet

2 participants