feat(gatsby-source-drupal): secrets and delete functionality (#18345)

* added functionality to delete nodes and enforce secret for more secure preview instances

* added documentation for secret in config

* updated handleWebhookData and destructured varaibled from request

* using deleteNode from actions

* deleteNode working and reporting deleted node to user

* updated documentation on using secrets to be consistent with the rest of the readme.

* change destructuring due to failing tests

* fix undefined res

* added return for lint

packages/gatsby-source-drupal/README.md

@@ -171,7 +171,25 @@ In your Drupal module configuration, set the update URL to your Gatsby Preview i
 _NOTES_:
 
 - This is experimental feature in active development. APIs used for this feature are not yet stable - it can break while we iterate on API design (particularly when versions of `gatsby-source-drupal` and `Gatsby Live Preview` drupal module are incompatible).
-- It's not feature complete yet. There is no handling of deleting content yet.
+
+### Preview Secret
+
+While you don't need to pass any additional options for preview to work, you can pass a `secret` for added security between your drupal instance and gatsby preview. Ensure this secret matches the one set in your Drupal Gatsby Preview settings.
+
+```javascript
+// In your gatsby-config.js
+module.exports = {
+  plugins: [
+    {
+      resolve: `gatsby-source-drupal`,
+      options: {
+        baseUrl: `https://live-contentacms.pantheonsite.io/`,
+        secret: process.env.PREVIEW_SECRET, // optional, must match Drupal instance preview secret
+      },
+    },
+  ],
+}
+```
 
 ## How to query
 

packages/gatsby-source-drupal/src/gatsby-node.js

@@ -178,10 +178,19 @@ exports.onCreateDevServer = (
     }),
     async (req, res) => {
       if (!_.isEmpty(req.body)) {
-        // we are missing handling of node deletion
+        const requestBody = JSON.parse(JSON.parse(req.body))
+        const { secret, action, id } = requestBody
+        if (pluginOptions.secret && pluginOptions.secret !== secret) {
+          return reporter.warn(
+            `The secret in this request did not match your plugin options secret.`
+          )
+        }
+        if (action === `delete`) {
+          actions.deleteNode({ node: getNode(createNodeId(id)) })
+          return reporter.log(`Deleted node: ${id}`)
+        }
         const nodeToUpdate = JSON.parse(JSON.parse(req.body)).data
-
-        await handleWebhookUpdate(
+        return await handleWebhookUpdate(
           {
             nodeToUpdate,
             actions,
@@ -196,6 +205,7 @@ exports.onCreateDevServer = (
         )
       } else {
         res.status(400).send(`Received body was empty!`)
+        return reporter.log(`Received body was empty!`)
       }
     }
   )