diff --git a/docs/apl.md b/docs/apl.md index c525675..22dace1 100644 --- a/docs/apl.md +++ b/docs/apl.md @@ -148,9 +148,7 @@ Please note: this APL supports single tenant only (new registrations overwrite p ### VercelAPL -Single tenant APL dedicated for apps deployed on Vercel. Apps deployed from Marketplace and CLI automatically set up Vercel project for this APL (`SALEOR_REGISTER_APP_URL` and `SALEOR_DEPLOYMENT_TOKEN` variables). - -The auth data are stored using environment variables: +Single tenant APL dedicated for apps deployed on Vercel. To use this APL you'll need to deploy application from the Marketplace or use the [Saleor CLI](https://docs.saleor.io/docs/3.x/cli). This way the required `SALEOR_REGISTER_APP_URL` and `SALEOR_DEPLOYMENT_TOKEN` variables will be set up automatically during the first deployment. During the registration process Saleor's service will set up auth data in the environment variables and trigger the deployment: ```mermaid sequenceDiagram @@ -166,6 +164,8 @@ sequenceDiagram V->>A: Redeploy the application ``` +If auth data are already saved in the environment, registration will proceed only if the domain of new request is the same as the previous one. This check is made to allow reinstalling the application possible and prevent unintended 3rd party to overwrite existing data. If you want to change the domain of registered Saleor domain, remove `SALEOR_DOMAIN` and `SALEOR_AUTH_TOKEN` environment variables from your Vercel project and redeploy it to refresh it's context. + ### UpstashAPL [Upstash](https://upstash.com) is a Redis SaaS targeting serverless applications. It's free tier is more than enough to start developing multi-tenant Saleor Apps, and credit card info is not required to create an account. diff --git a/src/APL/vercel-apl.test.ts b/src/APL/vercel-apl.test.ts index d7ad70f..b73f31a 100644 --- a/src/APL/vercel-apl.test.ts +++ b/src/APL/vercel-apl.test.ts @@ -78,6 +78,51 @@ describe("APL", () => { ); }); + it("Successful save of the auth data during reinstallation for the same domain", async () => { + process.env[VercelAPLVariables.TOKEN_VARIABLE_NAME] = "old_token"; + process.env[VercelAPLVariables.DOMAIN_VARIABLE_NAME] = "example.com"; + + // @ts-ignore Ignore type of mocked response + mockFetch.mockResolvedValue({ status: 200 }); + const apl = new VercelAPL({ + registerAppURL: "https://registerService.example.com", + deploymentToken: "token", + }); + await apl.set({ domain: "example.com", token: "token" }); + expect(mockFetch).toBeCalledWith( + "https://registerService.example.com", + + { + body: JSON.stringify({ + token: "token", + envs: [ + { key: "SALEOR_AUTH_TOKEN", value: "token" }, + { key: "SALEOR_DOMAIN", value: "example.com" }, + ], + }), + headers: { + "Content-Type": "application/json", + }, + method: "POST", + } + ); + }); + + it("Reject save of the auth data during reinstallation for a different domain", async () => { + process.env[VercelAPLVariables.TOKEN_VARIABLE_NAME] = "old_token"; + process.env[VercelAPLVariables.DOMAIN_VARIABLE_NAME] = "not.example.com"; + + // @ts-ignore Ignore type of mocked response + mockFetch.mockResolvedValue({ status: 200 }); + const apl = new VercelAPL({ + registerAppURL: "https://registerService.example.com", + deploymentToken: "token", + }); + await expect(apl.set({ domain: "example.com", token: "token" })).rejects.toThrow( + "Vercel APL was not able to save auth data, application already registered" + ); + }); + it("Raise error when register service returns non 200 response", async () => { // @ts-ignore Ignore type of mocked response mockFetch.mockResolvedValue({ status: 500 }); diff --git a/src/APL/vercel-apl.ts b/src/APL/vercel-apl.ts index 78981dc..6c18c99 100644 --- a/src/APL/vercel-apl.ts +++ b/src/APL/vercel-apl.ts @@ -51,7 +51,11 @@ export type VercelAPLConfig = { * - only stores single auth data entry (setting up a new one will overwrite previous values) * - changing the environment variables require server restart * - * With this APL we recommend using the [Saleor CLI](https://docs.saleor.io/docs/3.x/cli), + * To avoid override of existing auth data, setting a new auth token is only allowed for the same domain. + * If you want to change registration to another domain, you have to remove `SALEOR_AUTH_TOKEN` and + * `SALEOR_DOMAIN` environment variables in [Vercel dashboard](https://vercel.com/docs/concepts/projects/environment-variables). + * + * With this APL we recommend deployment using the [Saleor CLI](https://docs.saleor.io/docs/3.x/cli), * which automatically set up the required environment variables during deployment: * - SALEOR_REGISTER_APP_URL: the URL for microservice which set up variables using Vercel API * - SALEOR_DEPLOYMENT_TOKEN: token for your particular Vercel deployment @@ -119,6 +123,11 @@ export class VercelAPL implements APL { } async set(authData: AuthData) { + const existingAuthData = getEnvAuth(); + if (existingAuthData && existingAuthData.domain !== authData.domain) { + // Registering again should be available only for the already installed domain + throw new Error("Vercel APL was not able to save auth data, application already registered"); + } await this.saveDataToVercel(authData); }