feat: authorize commit previews and add /pr/:number preview routes - #31
Open
atinux wants to merge 1 commit into
Open
feat: authorize commit previews and add /pr/:number preview routes#31atinux wants to merge 1 commit into
atinux wants to merge 1 commit into
Conversation
GitHub shares git objects across the fork network, so /blob/:sha would render any fork PR's markdown on the docs domain with only a format check. Commits now render only when they are in production history or vouched for by a PR: same-repo PRs always, fork PRs only when a maintainer adds the preview:enabled label. Decisions live in the short-TTL ref cache, so removing the label revokes access within a TTL. - /pr/:number and /pr/:number/<page> preview a PR's head commit under the same rule, following new pushes like /tree does for branches - /tree rejects the hidden pull/ and refs/ namespaces so the label check can't be sidestepped via GitHub's pull/<n>/head refs - blob previews resolve short SHAs to the full commit before pinning - preview-comment workflow posts sticky PR comments with the links and tells fork contributors how a maintainer enables their preview
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
commit: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
/blob/:shaonly validated the SHA format before serving content through the upstream GitHub API. GitHub shares git objects across the fork network: once a fork opens a PR, its head commit is fetchable through the upstream repo. Anyone could open a fork PR with arbitrary markdown and have it rendered on the docs domain — a content-spoofing/phishing vector, even with scripts and embeds stripped by thesecurityplugin.What changed
Server-side authorization (the core fix)
authorizePreviewSha(sha)inserver/utils/github.ts: a commit renders under/blob/:shaonly when it is (1) vouched for by a same-repo PR, (2) vouched for by a fork PR carrying thepreview:enabledlabel, or (3) in the production branch's history (keeps version-history links working). Everything else answers 404.parseBranchNamenow rejects thepull/andrefs/namespaces, so the label check can't be sidestepped via GitHub's hiddenpull/<n>/headrefs on/tree/./pr/:numbershortcutlanding-pr/docs-prroutes and/api/content/pr/[number]/[...path]endpoint: previews the PR's head commit under the same authorization rule, following new pushes like/treefollows a branch. Noindex + sitemap-excluded like the other preview modes; "Edit this page" is disabled (a fork branch can't be linked to an editor).Workflow
.github/workflows/preview-comment.yml: sticky PR comment with the/pr/<number>links and a pinned/blob/<head sha>link. For unlabeled fork PRs it explains that a maintainer can addpreview:enabled; thelabeled/unlabeledtriggers refresh the comment. Usespull_request_targetbut never checks out or executes PR code.Docs
preview-versionsagent skill.Notes for review
compare/{base}...{sha}API call, cached like the rest./blob/**isisr: true: a 404 for a not-yet-labeled fork commit may be cached at the edge until purge; the/pr/route uses the short ISR TTL, so the workflow's primary links recover on their own once the label lands.Verification
Ran locally:
pnpm lint(no new warnings),pnpm test(140 tests pass, including new authorization boundary tests intest/preview-auth.test.ts),pnpm typecheck,pnpm build.