From 349795d0120c99b91d3e3938e3d5484633e81051 Mon Sep 17 00:00:00 2001
From: robs <git@robs.social>
Date: Mon, 30 Dec 2024 20:07:13 +0100
Subject: [PATCH] add env var to set opml route secret

---
 config/config.exs                             |  1 +
 config/runtime.exs                            |  3 ++-
 docker-compose.yml                            |  2 ++
 .../controllers/sources/source_html.ex        |  2 +-
 .../sources/source_html/index.html.heex       |  2 +-
 lib/pinchflat_web/router.ex                   | 23 +++++++++++++++----
 6 files changed, 25 insertions(+), 8 deletions(-)

diff --git a/config/config.exs b/config/config.exs
index 7df3a77..f046fd5 100644
--- a/config/config.exs
+++ b/config/config.exs
@@ -24,6 +24,7 @@ config :pinchflat,
   # If either is unset, basic auth will not be used.
   basic_auth_username: "",
   basic_auth_password: "",
+  route_secret: "",
   expose_feed_endpoints: false,
   file_watcher_poll_interval: 1000,
   timezone: "UTC",
diff --git a/config/runtime.exs b/config/runtime.exs
index afce572..96f30fd 100644
--- a/config/runtime.exs
+++ b/config/runtime.exs
@@ -23,7 +23,8 @@ end
 
 config :pinchflat,
   basic_auth_username: System.get_env("BASIC_AUTH_USERNAME"),
-  basic_auth_password: System.get_env("BASIC_AUTH_PASSWORD")
+  basic_auth_password: System.get_env("BASIC_AUTH_PASSWORD"),
+  route_secret: System.get_env("ROUTE_SECRET")
 
 arch_string = to_string(:erlang.system_info(:system_architecture))
 
diff --git a/docker-compose.yml b/docker-compose.yml
index e193a16..e53f959 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -10,3 +10,5 @@ services:
     command: bash -c "chmod +x docker/docker-run.dev.sh && docker/docker-run.dev.sh"
     stdin_open: true
     tty: true
+    environment:
+      - ROUTE_SECRET=J8vaF1t
diff --git a/lib/pinchflat_web/controllers/sources/source_html.ex b/lib/pinchflat_web/controllers/sources/source_html.ex
index 4692a04..2b16176 100644
--- a/lib/pinchflat_web/controllers/sources/source_html.ex
+++ b/lib/pinchflat_web/controllers/sources/source_html.ex
@@ -44,7 +44,7 @@ defmodule PinchflatWeb.Sources.SourceHTML do
   end
 
   def opml_feed_url(conn) do
-    url(conn, ~p"/sources/opml") <> ".xml"
+    url(conn, ~p"/secret/#{Application.get_env(:pinchflat, :route_secret)}/opml/feed") <> ".xml"
   end
 
   def output_path_template_override_placeholders(media_profiles) do
diff --git a/lib/pinchflat_web/controllers/sources/source_html/index.html.heex b/lib/pinchflat_web/controllers/sources/source_html/index.html.heex
index 6ace2bc..4cabee4 100644
--- a/lib/pinchflat_web/controllers/sources/source_html/index.html.heex
+++ b/lib/pinchflat_web/controllers/sources/source_html/index.html.heex
@@ -1,7 +1,7 @@
 <div class="mb-6 flex gap-3 flex-row items-center justify-between">
   <h2 class="text-title-md2 font-bold text-black dark:text-white">Sources</h2>
   <nav>
-    <.button color="bg-transparent" x-data="{ copied: false }" x-on:click={~s"
+    <.button :if={Application.get_env(:pinchflat, :route_secret)} color="bg-transparent" x-data="{ copied: false }" x-on:click={~s"
           copyWithCallbacks(
             '#{opml_feed_url(@conn)}',
             () => copied = true,
diff --git a/lib/pinchflat_web/router.ex b/lib/pinchflat_web/router.ex
index db8fe6d..7af66e3 100644
--- a/lib/pinchflat_web/router.ex
+++ b/lib/pinchflat_web/router.ex
@@ -23,14 +23,14 @@ defmodule PinchflatWeb.Router do
     plug :maybe_basic_auth
   end
 
-  pipeline :protected_feeds do
-    plug :basic_auth
+  pipeline :secret do
+    plug :validate_secret
   end
 
-  scope "/", PinchflatWeb do
-    pipe_through :protected_feeds
+  scope "/secret/:secret", PinchflatWeb do
+    pipe_through :secret
     # has to match before /sources/:id
-    get "/sources/opml", Podcasts.PodcastController, :opml_feed
+    get "/opml/feed", Podcasts.PodcastController, :opml_feed
   end
 
   # Routes in here _may not be_ protected by basic auth. This is necessary for
@@ -108,6 +108,19 @@ defmodule PinchflatWeb.Router do
     credential && credential != ""
   end
 
+  defp validate_secret(conn, _opts) do
+    expected_secret = Application.get_env(:pinchflat, :route_secret)
+    provided_secret = conn.params["secret"]
+
+    if expected_secret && provided_secret == expected_secret do
+      conn
+    else
+      conn
+      |> Plug.Conn.send_resp(:unauthorized, "Unauthorized")
+      |> Plug.Conn.halt()
+    end
+  end
+
   defp allow_iframe_embed(conn, _opts) do
     delete_resp_header(conn, "x-frame-options")
   end