Building blocks for a custom preview proxy in front of sandbox preview traffic.
Daytona's stock preview URLs go through its proxy; when you run your own (custom domains, your own auth, request shaping), your proxy must answer the questions Daytona's proxy answers — is this sandbox public, is this preview token valid, which sandbox does this signed URL belong to. These helpers are those checks:
# Is the sandbox public (no token needed)?
{:ok, true} = ExDaytona.PreviewProxy.public?(client, sandbox_id)
# Validate an x-daytona-preview-token a caller presented
{:ok, valid?} = ExDaytona.PreviewProxy.valid_token?(client, sandbox_id, token)
# Resolve a signed preview URL token to its sandbox
{:ok, sandbox_id} = ExDaytona.PreviewProxy.resolve_signed_token(client, signed_token, 3000)
# Verify signed tokens locally (no API round-trip per request)
{:ok, signing_key} = ExDaytona.PreviewProxy.signing_key(client, sandbox_id)All functions take the ExDaytona.Client so a proxy can hold one
long-lived client.
Authentication
Most of these endpoints authenticate proxy infrastructure, not
end users: with a regular user API key they return
403 "Invalid authentication context" (access?/2 is the exception
— it answers for the key's own principal). Running a custom preview
proxy requires credentials provisioned for that purpose (contact
Daytona).
Summary
Functions
Whether the API key's principal has preview access to the sandbox.
Whether Daytona's interstitial preview warning page is enabled for the sandbox's organization (a proxy may want to replicate or skip it).
Whether the sandbox is public (previews need no auth token).
Resolve a signed preview URL token (plus the port it was issued for) to its sandbox id.
The sandbox's signing key, for verifying signed preview URL tokens locally instead of calling the API per request.
Whether token is a valid preview auth token for the sandbox (what a
caller presents in the x-daytona-preview-token header).
Functions
@spec access?(ExDaytona.Client.t(), String.t()) :: {:ok, boolean()} | {:error, ExDaytona.Error.t()}
Whether the API key's principal has preview access to the sandbox.
@spec preview_warning?(ExDaytona.Client.t(), String.t()) :: {:ok, boolean()} | {:error, ExDaytona.Error.t()}
Whether Daytona's interstitial preview warning page is enabled for the sandbox's organization (a proxy may want to replicate or skip it).
@spec public?(ExDaytona.Client.t(), String.t()) :: {:ok, boolean()} | {:error, ExDaytona.Error.t()}
Whether the sandbox is public (previews need no auth token).
@spec resolve_signed_token(ExDaytona.Client.t(), String.t(), pos_integer()) :: {:ok, String.t()} | {:error, ExDaytona.Error.t()}
Resolve a signed preview URL token (plus the port it was issued for) to its sandbox id.
@spec signing_key(ExDaytona.Client.t(), String.t()) :: {:ok, String.t()} | {:error, ExDaytona.Error.t()}
The sandbox's signing key, for verifying signed preview URL tokens locally instead of calling the API per request.
@spec valid_token?(ExDaytona.Client.t(), String.t(), String.t()) :: {:ok, boolean()} | {:error, ExDaytona.Error.t()}
Whether token is a valid preview auth token for the sandbox (what a
caller presents in the x-daytona-preview-token header).