add env var to set opml route secret

config/config.exs

@@ -24,6 +24,7 @@ config :pinchflat,
   # If either is unset, basic auth will not be used.
   basic_auth_username: "",
   basic_auth_password: "",
+  route_secret: "",
   expose_feed_endpoints: false,
   file_watcher_poll_interval: 1000,
   timezone: "UTC",

config/runtime.exs

@@ -23,7 +23,8 @@ end
 
 config :pinchflat,
   basic_auth_username: System.get_env("BASIC_AUTH_USERNAME"),
-  basic_auth_password: System.get_env("BASIC_AUTH_PASSWORD")
+  basic_auth_password: System.get_env("BASIC_AUTH_PASSWORD"),
+  route_secret: System.get_env("ROUTE_SECRET")
 
 arch_string = to_string(:erlang.system_info(:system_architecture))
 

docker-compose.yml

@@ -10,3 +10,5 @@ services:
     command: bash -c "chmod +x docker/docker-run.dev.sh && docker/docker-run.dev.sh"
     stdin_open: true
     tty: true
+    environment:
+      - ROUTE_SECRET=J8vaF1t

lib/pinchflat_web/controllers/sources/source_html.ex

@@ -44,7 +44,7 @@ defmodule PinchflatWeb.Sources.SourceHTML do
   end
 
   def opml_feed_url(conn) do
-    url(conn, ~p"/sources/opml") <> ".xml"
+    url(conn, ~p"/secret/#{Application.get_env(:pinchflat, :route_secret)}/opml/feed") <> ".xml"
   end
 
   def output_path_template_override_placeholders(media_profiles) do

lib/pinchflat_web/controllers/sources/source_html/index.html.heex

@@ -1,7 +1,7 @@
 <div class="mb-6 flex gap-3 flex-row items-center justify-between">
   <h2 class="text-title-md2 font-bold text-black dark:text-white">Sources</h2>
   <nav>
-    <.button color="bg-transparent" x-data="{ copied: false }" x-on:click={~s"
+    <.button :if={Application.get_env(:pinchflat, :route_secret)} color="bg-transparent" x-data="{ copied: false }" x-on:click={~s"
           copyWithCallbacks(
             '#{opml_feed_url(@conn)}',
             () => copied = true,

lib/pinchflat_web/router.ex

@@ -23,14 +23,14 @@ defmodule PinchflatWeb.Router do
     plug :maybe_basic_auth
   end
 
-  pipeline :protected_feeds do
-    plug :basic_auth
+  pipeline :secret do
+    plug :validate_secret
   end
 
-  scope "/", PinchflatWeb do
-    pipe_through :protected_feeds
+  scope "/secret/:secret", PinchflatWeb do
+    pipe_through :secret
     # has to match before /sources/:id
-    get "/sources/opml", Podcasts.PodcastController, :opml_feed
+    get "/opml/feed", Podcasts.PodcastController, :opml_feed
   end
 
   # Routes in here _may not be_ protected by basic auth. This is necessary for
@@ -108,6 +108,19 @@ defmodule PinchflatWeb.Router do
     credential && credential != ""
   end
 
+  defp validate_secret(conn, _opts) do
+    expected_secret = Application.get_env(:pinchflat, :route_secret)
+    provided_secret = conn.params["secret"]
+
+    if expected_secret && provided_secret == expected_secret do
+      conn
+    else
+      conn
+      |> Plug.Conn.send_resp(:unauthorized, "Unauthorized")
+      |> Plug.Conn.halt()
+    end
+  end
+
   defp allow_iframe_embed(conn, _opts) do
     delete_resp_header(conn, "x-frame-options")
   end