Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@dudadev/api
Advanced tools
Provides convenient access to Duda's public APIs from applications written in server-side Javascript.
The @dudadev/api
library provides convenient access to Duda's public APIs from applications written in server-side
Javascript.
Node v12 or higher.
Install the package with:
npm install @dudadev/api --save
# or
yarn add @dudadev/api
The package needs to be configured with your API credentials:
const { Duda } = require('@dudadev/api');
const duda = Duda.New({
user: process.env.DUDA_API_USER,
pass: process.env.DUDA_API_PASS,
env: Duda.envs.direct,
});
duda.sites.get({ site_name: "a-site-name" }, function (err, site) {
if (err) {
console.log(err.status, err.error);
// handle error
}
console.log(site);
})
Or using ES modules and async/await
:
// async / await
(async function () {
try {
const site = await duda.sites.get({ site_name: "a-site-name" });
console.log(site);
} catch (error) {
console.log(error.status, error.error);
// handle error
}
})();
Import Duda as the default import (not * as Duda) and call Duda.New(opts).
import { Duda, Types } from '@dudadev/api';
const duda = Duda.New({
user: process.env.DUDA_API_USER,
pass: process.env.DUDA_API_PASS,
env: Duda.envs.direct,
});
const switchTemplate = async (site: string, template: number) => {
try {
const opts: Types.GetSiteByNamePayload = { site_name: "a-site-name" };
const site: Types.GetSiteByNameResponse = await duda.sites.get(opts);
console.log(site.site_name);
} catch (error) {
console.log(error.status, error.error);
// handle error
}
}
// get a list of available templates
duda.templates.list()
.then((templates) => {
// create a new site from the first template in the returned array
return duda.sites.create({
template_id: templates[0].template_id
})
.then((site) => {
// grant site access to an existing account
return duda.accounts.permissions.grantSiteAccess({
account_name: "account-name",
site_name: site.site_name,
permissions: ["EDIT"]
})
.then(() => {
// generate an SSO link to push the account into the editor
return duda.accounts.authentication.getSSOLink({
account_name: "account-name",
site_name: site.site_name,
target: "EDITOR"
})
})
})
})
.catch((err) => {
console.log(error.status, error.error);
// handle error
});
The package can be initialized with several options:
const duda = Duda.New({
user: 'api-user',
pass: 'api-pass',
env: Duda.envs.sandbox, // also, .direct, .eu
});
Duda.envs.eu
: api.eu.duda.coDuda.envs.direct
: api.duda.coDuda.envs.sandbox
: api-sandbox.duda.coAutomatic network retries can be enabled with the maxNetworkRetries config option. This will retry requests n times with exponential backoff if they fail due to an intermittent network problem.
const duda = Duda.New({
...,
maxNetworkRetries: 2
});
You can override the http.RequestOptions of any method on a per-request basis by passing a second object with custom options:
const { Duda } = require('@dudadev/api');
const duda = Duda.New({
user: process.env.DUDA_API_USER,
pass: process.env.DUDA_API_PASS,
env: Duda.envs.direct,
});
duda.sites.get({ site_name: 'a-site-name' }, {
host: 'api-special.duda.co',
auth: 'another-username:another-password',
headers: {
'X-CUSTOM-HEADER': 'a-value',
},
}, (err, site) => {
if (err) console.log(err);
console.log(site);
});
The library will attempt to parse all successful responses as JSON, and will return the raw value if it can't.
The library will either throw (for promises) or return (for callbacks) the following payload after receiving a status code >= 400:
interface ErrorResponse<T> {
status: number;
error: T;
}
// callback
duda.sites.get({ site_name: 'no-site' }, (err, site) => {
if (err) {
console.log(err.status, err.error);
}
console.log(site.site_name);
})
// promise
duda.sites.get({ site_name: 'no-site' })
.then((site) => console.log(site.site_name))
.catch((err) => console.log(err.status, err.error));
You can debug requests made by the library by setting the DUDA_API_LOG_LEVEL
environment variable to one of the
following levels:
The library will display logs that are >= DUDA_API_LOG_LEVEL
. So, for example, setting the log level to warning (2)
would log all warnings (2) and errors (1).
The logger will attempt to redact any sensitive information before it logs using the following regular expressions:
/(user(name)?|pass(word)?|auth(orization)?)":"[^"]+/gi
/(Bearer|Basic) [^"]+/gi
debug
$ DUDA_API_LOG_LEVEL=debug node index.js
[debug] 8ce2a72d-d6b6-4fe8-bf39-45ebe99f7233 no http agent defined: received=undefined
[info] 8ce2a72d-d6b6-4fe8-bf39-45ebe99f7233 new request: method=get endpoint=api-sandbox.duda.co/api/sites/multiscreen/374f37ea1eff44e7966b2c685ded251a/pages
[debug] 8ce2a72d-d6b6-4fe8-bf39-45ebe99f7233 full request details: req={"headers":{},"method":"get","path":"/api/sites/multiscreen/374f37ea1eff44e7966b2c685ded251a/pages","auth": [redacted],"host":"api-sandbox.duda.co"}
[debug] 8ce2a72d-d6b6-4fe8-bf39-45ebe99f7233 data received: raw={"results":[{"uuid":"683340afe033436caab26cf8a548b1dd","title":"Home","path":"home","seo":{"no_index":false}}]}
[debug] 8ce2a72d-d6b6-4fe8-bf39-45ebe99f7233 request ended: status=200 time=0.51s
{
results: [
{
uuid: '683340afe033436caab26cf8a548b1dd',
title: 'Home',
path: 'home',
seo: [Object]
}
]
}
If you're an app developer, you can access the App Store API under duda.appstore
after calling Duda.New(opts)
.
API Endpoints protected by an X-DUDA-ACCESS-TOKEN
expect method calls to include a token
property set to the
authorization_code
without Bearer
included.
duda.appstore.sites.get({
site_name: 'a-site-name',
token: 'authorization-code',
}, (err, site) => {
if (err) console.log(err);
console.log(site);
})
api_endpoint
valuesYou can use the request override feature to set the host of a method call to the correct
api_endpoint
for a particular site.
function getSite(site: string) {
const {
site_name,
auth,
api_endpoint
} = getInstallFromDB(site);
return duda.appstore.sites.get({
site_name: site_name,
token: auth.authorization_code,
}, {
host: api_endpoint,
})
}
getSite('a-site-name')
.then((site) => console.log(site))
.catch((err) => console.log(err.status, err.error))
Included under Duda.appstore
is utils
which contains useful methods for validating webhooks & signatures.
function validateWebook(req: YourRequestObject): boolean {
return duda.appstore.utils.validateWebook(process.env.SECRET_KEY, req.headers, req.body);
}
function validateSSO(req: YourRequestObject): boolean {
return duda.appstore.utils.validateSSOLink(process.env.SECRET_KEY, req.query);
}
FAQs
Provides convenient access to Duda's public APIs from applications written in server-side Javascript.
We found that @dudadev/api demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 11 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.