include xsrf token in event stream request

JupyterHub 4.1 increases strictness of xsrf checks

omitting it is no longer allowed on `Sec-Fetch: cors` requests

nbgitpuller/handlers.py

@@ -29,6 +29,11 @@ def __init__(self, *args, **kwargs):
         if 'git_lock' not in self.settings:
             self.settings['git_lock'] = locks.Lock()
 
+    def get_login_url(self):
+        # raise on failed auth, not redirect
+        # can't redirect EventStream to login
+        raise web.HTTPError(403)
+
     @property
     def git_lock(self):
         return self.settings['git_lock']

nbgitpuller/static/js/gitsync.js

@@ -1,12 +1,13 @@
 export class GitSync {
-    constructor(baseUrl, repo, branch, depth, targetpath, path) {
+    constructor(baseUrl, repo, branch, depth, targetpath, path, xsrf) {
         // Class that talks to the API backend & emits events as appropriate
         this.baseUrl = baseUrl;
         this.repo = repo;
         this.branch = branch;
         this.depth = depth;
         this.targetpath = targetpath;
         this.redirectUrl = baseUrl + path;
+        this._xsrf = xsrf;
 
         this.callbacks = {};
     }
@@ -30,6 +31,7 @@ export class GitSync {
     start() {
         // Start git pulling handled by SyncHandler, declared in handlers.py
         let syncUrlParams = new URLSearchParams({
+            _xsrf: this._xsrf,
             repo: this.repo,
             targetpath: this.targetpath
         });

nbgitpuller/static/js/index.js

@@ -21,7 +21,8 @@ const gs = new GitSync(
     getBodyData('branch'),
     getBodyData('depth'),
     getBodyData('targetpath'),
-    getBodyData('path')
+    getBodyData('path'),
+    getBodyData('xsrf'),
 );
 
 const gsv = new GitSyncView(

nbgitpuller/templates/status.html

@@ -5,6 +5,7 @@
 data-base-url="{{ base_url | urlencode }}"
 data-repo="{{ repo | urlencode }}"
 data-path="{{ path | urlencode }}"
+data-xsrf="{{ xsrf_token | urlencode }}"
 {% if branch %}data-branch="{{ branch | urlencode }}"{% endif %}
 {% if depth %}data-depth="{{ depth | urlencode }}"{% endif %}
 data-targetpath="{{ targetpath | urlencode }}"