Fix permissions to ensure tracker can only send events

.sandstorm/sandstorm-pkgdef.capnp

@@ -19,9 +19,9 @@ const pkgdef :Spk.PackageDefinition = (
 
     appTitle = (defaultText = "Hummingbird"),
 
-    appVersion = 400,  # Increment this for every release.
+    appVersion = 410,  # Increment this for every release.
 
-    appMarketingVersion = (defaultText = "0.4.0"),
+    appMarketingVersion = (defaultText = "0.4.1"),
     # Human-readable representation of appVersion. Should match the way you
     # identify versions of your app in documentation and marketing.
 
@@ -191,23 +191,34 @@ const pkgdef :Spk.PackageDefinition = (
          # Name of the permission, used as an identifier for the permission in cases where string
          # names are preferred.  Used in sandstorm-http-bridge's X-Sandstorm-Permissions HTTP header.
 
-         title = (defaultText = "Website Tracker"),
+         title = (defaultText = "Website Tracking Script"),
          # Display name of the permission, e.g. to display in a checklist of permissions
          # that may be assigned when sharing.
 
          description = (defaultText = "Publicly accessible tracking endpoint"),
          # Prose describing what this role means, suitable for a tool tip or similar help text.
        ),
-     ],
+       (
+         name = "view-data",
+
+         title = (defaultText = "View Data"),
+         description = (defaultText = "Ability to view hummingbird dashboard and aggregate data"),
+       )
+     ], 
      roles = [
        # Roles are logical collections of permissions.  For instance, your app may have
        # a "viewer" role and an "editor" role
        (
          title = (defaultText = "tracker"),
-         permissions  = [true],
+         permissions  = [true, false],
          verbPhrase = (defaultText = "can submit events"),
          description = (defaultText = "tracking script can submit new tracking events."),
        ),
+       (
+         title = (defaultText = "manager"),
+         permissions = [false, true],
+         verbPhrase = (defaultText = "can view the Hummingbird dashboard and associated data"),
+       ),
      ],
    ),
    apiPath = "/tracking_pixel/",

lib/dashboard.js

@@ -5,8 +5,29 @@ var demo         = require('./demo');
 
 var fileServer = new(staticServer.Server)("./public");
 
+var hasViewDataPermission = function(headers) {
+  var permissions = headers['x-sandstorm-permissions'];
+  if (!permissions) {
+    return false;
+  }
+  var permissionList = permissions.split(',').map(function(p) {
+    return p.trim();
+  });
+  return permissionList.indexOf('view-data') !== -1;
+};
+
 var defaultHandler = function(request, response) {
   console.log(" - " + request.url);
+
+  if (!hasViewDataPermission(request.headers)) {
+    console.log("Unauthorized request", { roles: request.headers['x-sandstorm-permissions'] });
+
+    response.writeHead(403, {'Content-Type': 'text/plain'});
+    response.end('Forbidden: invalid permissions');
+
+    return;
+  }
+
   if(request.url === "/demo") {
     demo.toggle();
   }
@@ -23,6 +44,15 @@ if(config.origins) {
 
 var io = new Server(server, ioOptions);
 
+io.use(function(socket, next) {
+  var headers = socket.request.headers;
+  if (hasViewDataPermission(headers)) {
+    next();
+  } else {
+    next(new Error('Forbidden: invalid permissions'));
+  }
+});
+
 setInterval(function() {
   var userCount = io.sockets.sockets.size;
   console.log(userCount + " users connected.");

public/index.html

@@ -98,7 +98,7 @@ <h2>Tracker Setup</h2>
         var template = "<script>" + $("#tracking_template").html() + "</scr" + "ipt>\n";
         template = template.replace('$API_PROTO', document.location.protocol);
         window.addEventListener("message", messageListener);
-        window.parent.postMessage({renderTemplate: {rpcId: "0", template: template}}, "*");
+        window.parent.postMessage({renderTemplate: {rpcId: "0", roleAssignment: { roleId: 0 }, forSharing: true, template: template}}, "*");
       });
     </script>