Function withAPIToken

packages/gitbook/src/middleware.ts:175–396

(apiToken: string | null)

    request.headers.delete('x-gitbook-disable-tracking');

    const withAPIToken = async (apiToken: string | null) => {
        const siteURLData = await throwIfDataError(
            lookupPublishedContentByUrl({
                url: siteRequestURL.toString(),
                visitorPayload: {
                    jwtToken: visitorToken?.token ?? undefined,
                    unsignedClaims,
                },
                // When the visitor auth token is pulled from the cookie, set redirectOnError when calling resolvePublishedContentByUrl to allow
                // redirecting when the token is invalid as we could be dealing with stale token stored in the cookie.
                // For example when the VA backend signature has changed but the token stored in the cookie is not yet expired.
                redirectOnError: visitorToken?.source === 'visitor-auth-cookie',

                // Use the API token passed in the request, if any
                // as it could be used for .preview hostnames
                apiToken,
            })
        );

        const cookies: ResponseCookies = visitorParamsCookie
            ? [
                  // If visitor.* params were passed to the site URL, include a session cookie to persist these params across navigation.
                  visitorParamsCookie,
              ]
            : [];

        //
        // Handle redirects
        //
        if ('redirect' in siteURLData) {
            // biome-ignore lint/suspicious/noConsole: we want to log the redirect
            console.log('redirect', siteURLData.redirect);
            if (siteURLData.target === 'content') {
                let contentRedirect = new URL(siteURLData.redirect, request.url);

                // For content redirects, we redirect using the /url/:url format
                // during development and testing in 'url' mode.
                if (mode === 'url') {
                    const urlObject = new URL(siteURLData.redirect);
                    contentRedirect = new URL(
                        `/url/${urlObject.host}${urlObject.pathname}${urlObject.search}`,
                        request.url
                    );
                }

                // Keep the same search params as the original request
                // as it might contain a VA token
                contentRedirect.search = request.nextUrl.search;

                return NextResponse.redirect(contentRedirect);
            }

            return NextResponse.redirect(siteURLData.redirect);
        }

        cookies.push(
            ...getResponseCookiesForVisitorAuth(
                getVisitorAuthBasePath(siteRequestURL, siteURLData),