fix(api-gateway): Debug API, allow subscribe to pre-aggregations queu…

…e events only by playground JWT (#3144)
cube-js · Jul 22, 2021 · 700080f · 700080f
1 parent 1ea8229
commit 700080f
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 1 deletion.
diff --git a/packages/cubejs-api-gateway/src/SubscriptionServer.ts b/packages/cubejs-api-gateway/src/SubscriptionServer.ts
@@ -90,6 +90,7 @@ export class SubscriptionServer {
         ...params,
         connectionId,
         context,
+        signedWithPlaygroundAuthSecret: authContext.signedWithPlaygroundAuthSecret,
         isSubscription,
         res: this.resultFn(connectionId, message.messageId),
         subscriptionState: async () => {

diff --git a/packages/cubejs-api-gateway/src/gateway.ts b/packages/cubejs-api-gateway/src/gateway.ts
@@ -868,7 +868,14 @@ export class ApiGateway {
     }
   }
 
-  public subscribeQueueEvents({ context, connectionId, res }) {
+  public subscribeQueueEvents({ context, signedWithPlaygroundAuthSecret, connectionId, res }) {
+    if (this.enforceSecurityChecks && !signedWithPlaygroundAuthSecret) {
+      throw new CubejsHandlerError(
+        403,
+        'Forbidden',
+        'Only for signed with playground auth secret'
+      );
+    }
     return this.getAdapterApi(context).subscribeQueueEvents(connectionId, res);
   }