designslife/WebForm-mw
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

Give /api/preview-link its own Bearer secret; constant-time token checks

Browse Source 
preview-link mints working form links for any contact, but was gated by
HEALTH_TOKEN (the diagnostics secret) passed in the query string, where
it lands in access logs. README already documented PREVIEW_ADMIN_TOKEN
as a Bearer header; make the code match.

- PREVIEW_ADMIN_TOKEN, when set, is required as Authorization: Bearer
  and is never accepted from the URL.
- Until it is set, HEALTH_TOKEN still works (Bearer or legacy ?token=)
  so the support runbook in EMAIL_DELIVERY.md keeps working.
- preview-link and /api/health compare tokens in constant time.
- redact() also scrubs PREVIEW_ADMIN_TOKEN and STAFF_REPORT_KEY.
This commit is contained in:
Joel Brock
2026-10-30 11:20:30 -07:00
parent df471e0e88
commit 526422abed
5 changed files with 43 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
EMAIL_DELIVERY.md
+8 -4
View File
@@ -147,13 +147,17 @@ You can use any combination. Common pattern: Option C for stage transitions
Generates a working URL for any contact, returning the URL and the
contact/org context for verification.
**Auth:** requires the `HEALTH_TOKEN` env var (same secret as
`/api/health`). In development without `HEALTH_TOKEN` set, no auth required.
**Auth:** send `PREVIEW_ADMIN_TOKEN` as a Bearer header. This endpoint
mints working links for any contact, so it has its own secret, kept out of
URLs. Until `PREVIEW_ADMIN_TOKEN` is set in Amplify, `HEALTH_TOKEN` is
accepted instead (Bearer header or legacy `?token=`). In development with
neither set, no auth is required.
**Request:**
```bash
curl "https://survey.fci.coop/api/preview-link?cid=513&token=$HEALTH_TOKEN"
curl -H "Authorization: Bearer $PREVIEW_ADMIN_TOKEN" \
"https://survey.fci.coop/api/preview-link?cid=513"
```
**Response:**
@@ -196,7 +200,7 @@ curl "https://survey.fci.coop/api/preview-link?cid=513&token=$HEALTH_TOKEN"
### "Contact reports the link doesn't work"
1. Hit `/api/preview-link?cid=<their-cid>&token=<HEALTH_TOKEN>`.
1. Hit `/api/preview-link?cid=<their-cid>` with `Authorization: Bearer <PREVIEW_ADMIN_TOKEN>`.
2. Verify the response shows the right org name + stage.
3. Send the URL from the response directly to the contact (or have them try it).
4. If `/api/preview-link` 404s, the contact lacks a Primary Contact relationship — fix in CiviCRM first.