fix: add check for shared secret by tripodsan · Pull Request #108 · adobe/da-collab

tripodsan · 2025-11-27T16:29:55Z

see https://jira.corp.adobe.com/browse/SITES-33249

Added check for shared secret for admin api calls (syncadmin, deleteadmin).
~~invoke DocRoom.handleApiCall() directly from edge functions in order to avoid extra routing via url~~ (this doesn't work w/o RPC...)
ensured that SharedDoc is destroyed when failed to initialize, in order to avoid hanging timers of the awareness handler

note: when running in the IDE, I still have the tests hanging... I found some of the leaks, but I assume there are still more. I assume those might cause unhandled promise rejections down the road or prevent the workers from being discarded? maybe?

github-actions · 2025-11-27T16:34:08Z

LCOV of commit `d03088c` during Install, lint, and test #282

Summary coverage rate:
  lines......: 99.2% (2175 of 2193 lines)
  functions..: 96.1% (73 of 76 functions)
  branches...: no data found

Files changed coverage rate:
                  |Lines       |Functions  |Branches    
  Filename        |Rate     Num|Rate    Num|Rate     Num
  ======================================================
  src/edge.js     | 2.3%    398| 0.0%     9|    -      0
  src/shareddoc.js| 3.2%    664| 0.0%    21|    -      0

tripodsan · 2025-11-27T16:35:53Z

src/edge.js

+  // check if shared token is configured and validate
+  if (env.COLLAB_SHARED_SECRET) {
+    if (request.headers.get('authorization') !== `token ${env.COLLAB_SHARED_SECRET}`) {
+      return new Response('Unauthorized', { status: 401 });
+    }
+  }
+


see counterpart https://github.com/adobe/da-admin/blob/a0b6ad554220f1729c526a339862b85017be62f0/src/storage/utils/object.js#L31

tripodsan · 2025-11-27T16:38:21Z

src/edge.js

    // same signature as the global `fetch()` function, but the request is always sent to the
    // object, regardless of the hostname in the request's URL.
-    return roomObject.fetch(req);
+    return await roomObject.fetch(req);


without this, the catch below is never cought if the error is thrown async.

src/edge.js

tripodsan · 2025-11-27T16:42:25Z

src/shareddoc.js

+  destroy() {
+    super.destroy();
+    this.awareness.destroy();
+  }


ensure that the awareness is destroyed, too. this stops the internal timer and allows the process to stop

tripodsan · 2025-11-27T18:08:30Z

src/edge.js

+  const apiUrl = new URL(doc);
+  apiUrl.searchParams.set('api', api);
+  return roomObject.fetch(new Request(apiUrl));


not sure why this worked. but the fetch() api expects a Request (tested on stage as well)

According to this doc https://developers.cloudflare.com/workers/runtime-apis/fetch/ it expects either: URL, string or Request.

I think they messed this up... fetch(url, init) is used for making requests, but the fetch(request, env, ctx) handler has a different signature. they should have named this differently.

tripodsan · 2025-11-27T18:09:15Z

src/edge.js

    // `controller.storage` provides access to our durable storage. It provides a simple KV
    // get()/put() interface.
-    this.storage = controller.storage;
+    this.storage = controller?.storage;


if the controller is optional below, it should be here, too

tripodsan · 2025-11-27T18:48:00Z

src/shareddoc.js

+        // clear event handlers
+        doc.destroy();


ensure that eventhandlers and timers are removed when doc is removed from cache

bosschaert

LGTM

karlpauls

looks great - I had noticed the missing await for the error as well (but forgot about it). Nice!

# 1.0.0 (2025-12-08) ### Bug Fixes * add check for shared secret ([#108](#108)) ([a79731f](a79731f)) * add span to known HTML tags ([#101](#101)) ([fbf016d](fbf016d)) * do not empty document if error ([#90](#90)) ([a406add](a406add)) * encode HTML brackets ([#100](#100)) ([6c5b5fd](6c5b5fd)) * encode HTML brackets ([#74](#74)) ([015163e](015163e)) * keep content if no main found in html ([#85](#85)) ([9fd25ac](9fd25ac)) * null doc crashes aem2doc ([#84](#84)) ([6197114](6197114)) * ommit stacktraces in error map for non-dev ([#110](#110)) ([1f896ac](1f896ac)) * remove html comments ([#68](#68)) ([cf05aae](cf05aae)) ### Features * disable stack traces on production ([#109](#109)) ([79c40bd](79c40bd)) * Prevent implicit document creation via If-Match header ([#105](#105)) ([b33ae65](b33ae65))

# 1.0.0 (2025-12-08) ### Bug Fixes * add check for shared secret ([#108](#108)) ([a79731f](a79731f)) * add span to known HTML tags ([#101](#101)) ([fbf016d](fbf016d)) * do not empty document if error ([#90](#90)) ([a406add](a406add)) * encode HTML brackets ([#100](#100)) ([6c5b5fd](6c5b5fd)) * encode HTML brackets ([#74](#74)) ([015163e](015163e)) * keep content if no main found in html ([#85](#85)) ([9fd25ac](9fd25ac)) * null doc crashes aem2doc ([#84](#84)) ([6197114](6197114)) * ommit stacktraces in error map for non-dev ([#110](#110)) ([1f896ac](1f896ac)) * remove html comments ([#68](#68)) ([cf05aae](cf05aae)) * trigger release ([ca061d4](ca061d4)) ### Features * disable stack traces on production ([#109](#109)) ([79c40bd](79c40bd)) * Prevent implicit document creation via If-Match header ([#105](#105)) ([b33ae65](b33ae65))

fix: add check for shared secret

a6c0c7b

tripodsan requested review from auniverseaway, bosschaert, karlpauls and kptdobe and removed request for karlpauls and kptdobe November 27, 2025 16:30

chore: fix linting

075b53f

tripodsan commented Nov 27, 2025

View reviewed changes

src/edge.js Show resolved Hide resolved

chore: not needed anymore

e437794

tripodsan commented Nov 27, 2025

View reviewed changes

tripodsan marked this pull request as draft November 27, 2025 17:50

fix: revert API change

42a81e1

tripodsan commented Nov 27, 2025

View reviewed changes

tripodsan marked this pull request as ready for review November 27, 2025 18:23

fix: ensure event handlers remove when doc is removed from cache

660dc7a

tripodsan commented Nov 27, 2025

View reviewed changes

tripodsan added 2 commits November 27, 2025 19:52

chore: fix tesT

a6578f6

chore: add husky

3cb6163

kptdobe approved these changes Nov 28, 2025

View reviewed changes

bosschaert approved these changes Nov 28, 2025

View reviewed changes

tripodsan added 2 commits November 28, 2025 10:44

Merge branch 'main' into shared-secret

d7ae93f

chore: fix jsdoc

e1cdecb

karlpauls approved these changes Nov 28, 2025

View reviewed changes

tripodsan added 2 commits December 2, 2025 14:04

Merge branch 'main' into shared-secret

6e319d9

chore: fix tests

d03088c

tripodsan merged commit a79731f into main Dec 2, 2025
3 checks passed

tripodsan deleted the shared-secret branch December 2, 2025 13:11

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: add check for shared secret#108

fix: add check for shared secret#108
tripodsan merged 11 commits intomainfrom
shared-secret

tripodsan commented Nov 27, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Nov 27, 2025 •

edited

Loading

Uh oh!

tripodsan Nov 27, 2025

Uh oh!

tripodsan Nov 27, 2025

Uh oh!

Uh oh!

tripodsan Nov 27, 2025

Uh oh!

tripodsan Nov 27, 2025 •

edited

Loading

Uh oh!

bosschaert Nov 28, 2025

Uh oh!

tripodsan Nov 28, 2025

Uh oh!

tripodsan Nov 27, 2025

Uh oh!

tripodsan Nov 27, 2025

Uh oh!

bosschaert left a comment

Uh oh!

karlpauls left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

tripodsan commented Nov 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Nov 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

LCOV of commit d03088c during Install, lint, and test #282

Uh oh!

tripodsan Nov 27, 2025

Choose a reason for hiding this comment

Uh oh!

tripodsan Nov 27, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

tripodsan Nov 27, 2025

Choose a reason for hiding this comment

Uh oh!

tripodsan Nov 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bosschaert Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

tripodsan Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

tripodsan Nov 27, 2025

Choose a reason for hiding this comment

Uh oh!

tripodsan Nov 27, 2025

Choose a reason for hiding this comment

Uh oh!

bosschaert left a comment

Choose a reason for hiding this comment

Uh oh!

karlpauls left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

tripodsan commented Nov 27, 2025 •

edited

Loading

github-actions bot commented Nov 27, 2025 •

edited

Loading

LCOV of commit `d03088c` during Install, lint, and test #282

tripodsan Nov 27, 2025 •

edited

Loading