Merge pull request #1650 from serlo/fix/get-serlo-editor-testing-head…

…er-from-context fix: get X-SERLO-EDITOR-TESTING header from req context
serlo · Jul 3, 2024 · 4e0fb52 · 4e0fb52
2 parents 22e7ac9 + 3a7b1e4
commit 4e0fb52
Showing 1 changed file with 11 additions and 2 deletions.
diff --git a/packages/server/src/internals/server/graphql-middleware.ts b/packages/server/src/internals/server/graphql-middleware.ts
@@ -27,6 +27,14 @@ const SessionDecoder = t.type({
   identity: IdentityDecoder,
 })
 
+const BodyWithSerloEditorTestingHeader = t.type({
+  context: t.type({
+    headers: t.type({
+      'X-SERLO-EDITOR-TESTING': t.string,
+    }),
+  }),
+})
+
 export async function applyGraphQLMiddleware({
   app,
   cache,
@@ -60,8 +68,9 @@ export async function applyGraphQLMiddleware({
     expressMiddleware(server, {
       async context({ req }): Promise<Context> {
         const isSerloEditorTesting =
-          req.headers['X-SERLO-EDITOR-TESTING'] ===
-          process.env.SERVER_SERLO_EDITOR_TESTING_SECRET
+          BodyWithSerloEditorTestingHeader.is(req.body) &&
+          req.body.context.headers['X-SERLO-EDITOR-TESTING'] ===
+            process.env.SERVER_SERLO_EDITOR_TESTING_SECRET
         const googleStorage = new Storage()
         const database = new Database(pool)
         const dataSources = {