From 1697d5bd3b8e651dad49fb4520c0fadd821b2d28 Mon Sep 17 00:00:00 2001
From: Antony Gelberg <antony.gelberg@gmail.com>
Date: Mon, 30 Oct 2023 00:58:41 +0000
Subject: [PATCH 1/3] Formatting (semicolon / whitespace)

---
 server.js | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/server.js b/server.js
index aad4c38..82e6464 100644
--- a/server.js
+++ b/server.js
@@ -42,10 +42,10 @@ class EleventyDevServer {
   }
 
   constructor(name, dir, options = {}) {
-    debug("Creating new Dev Server instance.")
+    debug("Creating new Dev Server instance.");
     this.name = name;
     this.normalizeOptions(options);
-    
+
     this.fileCache = {};
     // Directory to serve
     if(!dir) {
@@ -85,10 +85,10 @@ class EleventyDevServer {
       // TODO if using Eleventy and `watch` option includes output folder (_site) this will trigger two update events!
       this._watcher = chokidar.watch(this.options.watch, {
         // TODO allow chokidar configuration extensions (or re-use the ones in Eleventy)
-  
+
         ignored: ["**/node_modules/**", ".git"],
         ignoreInitial: true,
-  
+
         // same values as Eleventy
         awaitWriteFinish: {
           stabilityThreshold: 150,
@@ -100,7 +100,7 @@ class EleventyDevServer {
         this.logger.log( `File changed: ${path} (skips build)` );
         this.reloadFiles([path]);
       });
-      
+
       this._watcher.on("add", (path) => {
         this.logger.log( `File added: ${path} (skips build)` );
         this.reloadFiles([path]);
@@ -456,19 +456,19 @@ class EleventyDevServer {
     if(!res._shouldForceEnd) {
       let match = this.mapUrlToFilePath(req.url);
       debug( req.url, match );
-  
+
       if (match) {
         if (match.statusCode === 200 && match.filepath) {
           return this.renderFile(match.filepath, res);
         }
-  
+
         // Redirects, usually for trailing slash to .html stuff
         if (match.url) {
           res.statusCode = match.statusCode;
           res.setHeader("Location", match.url);
           return res.end();
         }
-  
+
         let raw404Path = this.getOutputDirFilePath("404.html");
         if(match.statusCode === 404 && this.isOutputFilePathExists(raw404Path)) {
           res.statusCode = match.statusCode;

From ce901583435ca897eec919cf0792a1b92d5042e3 Mon Sep 17 00:00:00 2001
From: Antony Gelberg <antony.gelberg@gmail.com>
Date: Mon, 30 Oct 2023 01:00:03 +0000
Subject: [PATCH 2/3] Support rebuild event from dev server

---
 server.js | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/server.js b/server.js
index 82e6464..d126e09 100644
--- a/server.js
+++ b/server.js
@@ -27,6 +27,7 @@ const DEFAULT_OPTIONS = {
   pathPrefix: "/",      // May be overridden by Eleventy, adds a virtual base directory to your project
   watch: [],            // Globs to pass to separate dev server chokidar for watching
   aliases: {},          // Aliasing feature
+  rebuildUrl: null,     // POST URL to trigger rebuild
 
   // Logger (fancier one is injected by Eleventy)
   logger: {
@@ -79,6 +80,10 @@ class EleventyDevServer {
     this.options.pathPrefix = this.cleanupPathPrefix(this.options.pathPrefix);
   }
 
+  setEventBus(_eventBus) {
+    this.eventBus = _eventBus;
+  }
+
   get watcher() {
     if(!this._watcher) {
       debug("Watching %O", this.options.watch);
@@ -415,6 +420,12 @@ class EleventyDevServer {
   }
 
   eleventyDevServerMiddleware(req, res, next) {
+    if (this.options.rebuildUrl && req.url === this.options.rebuildUrl && req.method === 'POST') {
+      this.eventBus.emit('eleventyDevServer.rebuild');
+      res.writeHead(200);
+      return res.end();
+    }
+
     if(req.url === `/${this.options.injectedScriptsFolder}/reload-client.js`) {
       if(this.options.liveReload) {
         res.setHeader("Content-Type", mime.getType("js"));

From 1c242aa56d444e6dd5f21b53bad1e82e5461df03 Mon Sep 17 00:00:00 2001
From: Antony Gelberg <antony.gelberg@gmail.com>
Date: Mon, 30 Oct 2023 11:41:31 +0000
Subject: [PATCH 3/3] Add x-11ty-rebuild-token to secure rebuild endpoint

---
 server.js | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/server.js b/server.js
index d126e09..d4715a5 100644
--- a/server.js
+++ b/server.js
@@ -28,6 +28,7 @@ const DEFAULT_OPTIONS = {
   watch: [],            // Globs to pass to separate dev server chokidar for watching
   aliases: {},          // Aliasing feature
   rebuildUrl: null,     // POST URL to trigger rebuild
+  rebuildUrlToken: "",  // Secret token in x-11ty-rebuild-token header
 
   // Logger (fancier one is injected by Eleventy)
   logger: {
@@ -421,6 +422,12 @@ class EleventyDevServer {
 
   eleventyDevServerMiddleware(req, res, next) {
     if (this.options.rebuildUrl && req.url === this.options.rebuildUrl && req.method === 'POST') {
+      const token = req.headers['x-11ty-rebuild-token'];
+      if (token !== this.options.rebuildUrlToken) {
+        res.writeHead(403, { 'Content-Type': 'text/plain' });
+        return res.end('Forbidden');
+      }
+
       this.eventBus.emit('eleventyDevServer.rebuild');
       res.writeHead(200);
       return res.end();