v0.9.0

extension/src/ConnectionHandler.ts

@@ -1,6 +1,6 @@
 import { Disposable } from "@hediet/std/disposable";
 import { debugVisualizerUIContract } from "@hediet/debug-visualizer-vscode-shared";
-import { ConsoleRpcLogger } from "@hediet/typed-json-rpc";
+import { ConsoleRpcLogger, RequestHandlingError } from "@hediet/typed-json-rpc";
 import { EvaluationWatcher } from "./DataSource/DataSource";
 import { WebSocketStream } from "@hediet/typed-json-rpc-websocket";
 import { observable, autorun } from "mobx";
@@ -19,8 +19,17 @@ export class ConnectionHandler {
 		sources: Sources,
 		stream: WebSocketStream,
 		server: Server,
-		config: Config
+		config: Config,
+		serverSecret: string
 	) {
+		let authenticated = false;
+
+		function throwIfNotAuthenticated() {
+			if (!authenticated) {
+				throw new RequestHandlingError("Not authenticated");
+			}
+		}
+
 		const {
 			client,
 			channel,
@@ -28,12 +37,23 @@ export class ConnectionHandler {
 			stream,
 			new ConsoleRpcLogger(),
 			{
+				authenticate: async ({ secret }, { newErr }) => {
+					if (secret !== serverSecret) {
+						return newErr({ errorMessage: "Invalid Secret" });
+					} else {
+						authenticated = true;
+					}
+				},
 				refresh: async () => {
+					throwIfNotAuthenticated();
+
 					if (this.watcher) {
 						this.watcher.refresh();
 					}
 				},
 				setExpression: async ({ newExpression }) => {
+					throwIfNotAuthenticated();
+
 					let oldPreferredDataExtractor: EvaluationWatcher["preferredDataExtractor"];
 					if (this.watcher) {
 						oldPreferredDataExtractor = this.watcher
@@ -50,6 +70,8 @@ export class ConnectionHandler {
 					);
 				},
 				openInBrowser: async ({}) => {
+					throwIfNotAuthenticated();
+
 					let opened = false;
 					if (config.useChromeKioskMode()) {
 						opened = await launchChrome(server.indexUrl);
@@ -59,11 +81,15 @@ export class ConnectionHandler {
 					}
 				},
 				setPreferredDataExtractor: async ({ dataExtractorId }) => {
+					throwIfNotAuthenticated();
+
 					if (this.watcher) {
 						this.watcher.setPreferredDataExtractor(dataExtractorId);
 					}
 				},
 				getCompletions: async ({ text, column }) => {
+					throwIfNotAuthenticated();
+
 					const completions = await sources.jsSource.getCompletions(
 						text,
 						column

extension/src/Server.ts

@@ -8,9 +8,11 @@ import * as express from "express";
 import * as http from "http";
 import * as serveStatic from "serve-static";
 import { Config } from "./Config";
+import cryptoRandomString = require("crypto-random-string");
 
 export class Server {
 	private server: http.Server;
+	public readonly secret = cryptoRandomString({ length: 20 });
 
 	constructor(sources: Sources, config: Config) {
 		const app = express();
@@ -22,13 +24,13 @@ export class Server {
 		const wss = new WebSocket.Server({ server: this.server });
 		wss.on("connection", ws => {
 			const stream = new WebSocketStream(ws);
-			new ConnectionHandler(sources, stream, this, config);
+			new ConnectionHandler(sources, stream, this, config, this.secret);
 		});
 	}
 
 	public get indexUrl(): string {
 		const port = process.env.USE_DEV_UI ? 8080 : this.port;
-		return `http://localhost:${port}/index.html?serverPort=${this.port}`;
+		return `http://localhost:${port}/index.html?serverPort=${this.port}&serverSecret=${this.secret}`;
 	}
 
 	public get mainBundleUrl(): string {

extension/src/WebViews.ts

@@ -72,6 +72,7 @@ export function getHtml(server: Server) {
 			<body>
 				<script>
 					window.serverPort = ${server.port};
+					window.serverSecret = ${JSON.stringify(server.secret)};
 					const api = window.VsCodeApi = acquireVsCodeApi();
 					window.addEventListener('message', event => {
 						if (event.source === window.frames[0]) {