@auth-craft/aws-cf-stack 1.1.1 → 1.3.0

package/lib/common.sh

@@ -227,6 +227,17 @@ print_outputs_json() {
   jwtAlg="$(lambda_env "$fn" JWT_ALGORITHM)";             jwtAlg="${jwtAlg:-${LAMBDA_JWT_ALGORITHM:-EdDSA}}"
   svcPub="$(lambda_env "$fn" INTERNAL_JWT_PUBLIC_KEY)";   svcPub="${svcPub:-${LAMBDA_INTERNAL_JWT_PUBLIC_KEY:-}}"
 
+  # Worker names per scope (mirror deploy-gateway.sh: ${APP_NAME}-${STAGE}-${scope}).
+  # These are what a consumer's Cloudflare Pages project references in a Service Binding
+  # (`[[services]] service = "<worker name>"`) to front /{scope}/auth/* same-origin via
+  # @auth-craft/pages-auth-proxy. The binding lives in the consumer's Pages project, not
+  # here — `serviceBindings` is a ready-to-paste snippet they drop into their wrangler.toml.
+  local wnSystem="${APP_NAME}-${STAGE}-system"
+  local wnTenant="${APP_NAME}-${STAGE}-tenant"
+  local wnCustomer="${APP_NAME}-${STAGE}-customer"
+  local bindingSnippet
+  bindingSnippet=$(printf '[[services]]\nbinding = "AUTH_GATEWAY"\nservice = "%s"\n' "$wnCustomer")
+
   jq -n \
     --arg url "$url" --arg base "$base" --arg name "$name" \
     --arg table "$table" --arg backend "$backend" \
@@ -240,13 +251,17 @@ print_outputs_json() {
     --arg rpSystem "${CF_WORKER_ROUTE_PREFIX_SYSTEM:-/system}" \
     --arg rpTenant "${CF_WORKER_ROUTE_PREFIX_TENANT:-/tenant}" \
     --arg rpCustomer "${CF_WORKER_ROUTE_PREFIX_CUSTOMER:-/customer}" \
+    --arg wnSystem "$wnSystem" --arg wnTenant "$wnTenant" --arg wnCustomer "$wnCustomer" \
+    --arg bindingSnippet "$bindingSnippet" \
     '{stage:$stage, project:$project, region:$region,
       lambdaFunctionUrl:$url, apiBasePath:$base, authSystemName:$name,
       dynamodbTable:$table, backendUrl:$backend,
       jwtPublicKey:$jwtPub, jwtIssuer:$jwtIssuer, jwtAlgorithm:$jwtAlg,
       serviceJwtPublicKey:$svcPub,
       gatewayUrls:{system:$gwSystem, tenant:$gwTenant, customer:$gwCustomer},
-      routePrefixes:{system:$rpSystem, tenant:$rpTenant, customer:$rpCustomer}}'
+      workerNames:{system:$wnSystem, tenant:$wnTenant, customer:$wnCustomer},
+      routePrefixes:{system:$rpSystem, tenant:$rpTenant, customer:$rpCustomer},
+      pagesProxy:{serviceBindingExample:$bindingSnippet}}'
 }
 
 # ── Tool command resolution (#7: let a consumer pin its own binaries) ─────────

package/lib/deploy-gateway.sh

@@ -30,6 +30,48 @@ custom_domain_for() {
   echo "${!var:-}"
 }
 
+# Resolve whether to disable the public workers.dev URL for a scope (Pages-proxy /
+# Service-Binding deploys reach the worker in-network and don't need a public URL).
+# Precedence: CF_WORKER_DISABLE_PUBLIC_URL_<SCOPE> > CF_WORKER_DISABLE_PUBLIC_URL > '' (off).
+# Truthy values: 1 / true / yes (case-insensitive). Ignored when a custom domain is set.
+disable_public_url_for() {
+  local scope="$1" upper var val
+  upper="$(echo "$scope" | tr '[:lower:]' '[:upper:]')"
+  var="CF_WORKER_DISABLE_PUBLIC_URL_${upper}"
+  val="${!var:-${CF_WORKER_DISABLE_PUBLIC_URL:-}}"
+  case "$(echo "$val" | tr '[:upper:]' '[:lower:]')" in
+    1 | true | yes) echo 1 ;;
+    *) echo '' ;;
+  esac
+}
+
+# Resolve per-scope static CORS origins. Precedence:
+#   CF_ALLOWED_ORIGINS_<SCOPE> > CF_ALLOWED_ORIGINS > LAMBDA_CORS_ORIGINS > '*'.
+allowed_origins_for() {
+  local scope="$1" upper var
+  upper="$(echo "$scope" | tr '[:lower:]' '[:upper:]')"
+  var="CF_ALLOWED_ORIGINS_${upper}"
+  echo "${!var:-${CF_ALLOWED_ORIGINS:-${LAMBDA_CORS_ORIGINS:-*}}}"
+}
+
+# Resolve per-scope dynamic origin SUFFIXES (e.g. '.myplatform.com'). Precedence:
+#   CF_ALLOWED_ORIGIN_SUFFIXES_<SCOPE> > CF_ALLOWED_ORIGIN_SUFFIXES > '' (disabled).
+origin_suffixes_for() {
+  local scope="$1" upper var
+  upper="$(echo "$scope" | tr '[:lower:]' '[:upper:]')"
+  var="CF_ALLOWED_ORIGIN_SUFFIXES_${upper}"
+  echo "${!var:-${CF_ALLOWED_ORIGIN_SUFFIXES:-}}"
+}
+
+# Resolve a per-scope CORS KV namespace id (CF_CORS_KV_ID_CUSTOMER, …) — empty = no
+# dynamic KV allowlist for that scope. Typically only the customer scope sets this.
+cors_kv_id_for() {
+  local scope="$1" upper var
+  upper="$(echo "$scope" | tr '[:lower:]' '[:upper:]')"
+  var="CF_CORS_KV_ID_${upper}"
+  echo "${!var:-}"
+}
+
 # Enable the workers.dev subdomain for a worker with no custom domain (so it's reachable).
 enable_workers_dev() {
   local worker_name="$1"
@@ -60,11 +102,10 @@ deploy_gateway() {
   # Anti-drift: BACKEND_URL the worker forwards onto = Function URL + API base path.
   local backend_url="${LAMBDA_FUNCTION_URL%/}${API_BASE_PATH}"
 
-  # Shared config across the 3 workers.
-  local environment jwt_issuer allowed_origins
+  # Shared config across the 3 workers (CORS is now resolved PER SCOPE below).
+  local environment jwt_issuer
   environment="$RUNTIME_NODE_ENV"
   jwt_issuer="${LAMBDA_JWT_ISSUER:-${AUTH_SYSTEM_NAME:-$RESOURCE_NAME}}"
-  allowed_origins="${CF_ALLOWED_ORIGINS:-${LAMBDA_CORS_ORIGINS:-*}}"
 
   local jwt_alg="${LAMBDA_JWT_ALGORITHM:-EdDSA}"
   local svc_route="${LAMBDA_SERVICE_ROUTE_PATH:-/internal}"
@@ -74,22 +115,66 @@ deploy_gateway() {
 
   GATEWAY_URLS=()
   local scope worker_name route_prefix custom_domain url
+  local allowed_origins origin_suffixes cors_kv_id config_file disable_public_url
   for scope in system tenant customer; do
     worker_name="${APP_NAME}-${STAGE}-${scope}"
     route_prefix="$(route_prefix_for "$scope")"
     custom_domain="$(custom_domain_for "$scope")"
+    allowed_origins="$(allowed_origins_for "$scope")"
+    origin_suffixes="$(origin_suffixes_for "$scope")"
+    cors_kv_id="$(cors_kv_id_for "$scope")"
+    # A custom domain always needs the worker reachable, so the disable flag is ignored there.
+    disable_public_url=""
+    [[ -z "$custom_domain" ]] && disable_public_url="$(disable_public_url_for "$scope")"
 
     info "Deploying $worker_name (scope=$scope route_prefix=$route_prefix)…"
 
+    # A temp config is needed when either (a) a CORS KV id is set (a binding can't be
+    # set via --var) or (b) the public URL must be disabled (workers_dev/preview_urls are
+    # top-level config keys, not vars, and CF won't disable preview URLs just because
+    # workers.dev is off — both must be set explicitly). Otherwise use the shipped config.
+    config_file="$WRANGLER_DIR/wrangler.toml"
+    if [[ -n "$cors_kv_id" || -n "$disable_public_url" ]]; then
+      config_file="$(mktemp "${TMPDIR:-/tmp}/wrangler-${scope}.XXXXXX.toml")"
+      if [[ -n "$disable_public_url" ]]; then
+        # Turn off the workers.dev URL *and* the per-version preview URLs in a single
+        # deploy (no REST API round-trip; CF won't drop preview URLs just for workers_dev
+        # being off, so both are set explicitly). These are ROOT keys: they must precede
+        # any [table] header or TOML scopes them under it (e.g. [build]). We drop the
+        # shipped `workers_dev = true` (TOML forbids duplicate keys) and inject both flags
+        # immediately after the first root key (`name = …`), before [build].
+        awk '
+          /^[[:space:]]*workers_dev[[:space:]]*=/ { next }   # drop original (anywhere)
+          { print }
+          !injected && /^[[:space:]]*name[[:space:]]*=/ {
+            print "workers_dev = false"; print "preview_urls = false"; injected = 1
+          }
+        ' "$WRANGLER_DIR/wrangler.toml" >"$config_file"
+        info "  public URL disabled: workers.dev + preview URLs off (Pages-proxy / Service Binding only)"
+      else
+        cat "$WRANGLER_DIR/wrangler.toml" >"$config_file"
+      fi
+      if [[ -n "$cors_kv_id" ]]; then
+        {
+          echo ''
+          echo '[[kv_namespaces]]'
+          echo 'binding = "CORS_KV"'
+          echo "id = \"$cors_kv_id\""
+        } >>"$config_file"
+        info "  dynamic CORS: KV binding CORS_KV → $cors_kv_id"
+      fi
+    fi
+
     # Deploy the prebuilt bundle with per-scope vars (flags override the toml).
     wrangler deploy \
       --name "$worker_name" \
-      --config "$WRANGLER_DIR/wrangler.toml" \
+      --config "$config_file" \
       --no-bundle \
       --var "ENVIRONMENT:$environment" \
       --var "AUTH_SCOPE:$scope" \
       --var "ROUTE_PREFIX:$route_prefix" \
       --var "ALLOWED_ORIGINS:$allowed_origins" \
+      --var "ALLOWED_ORIGIN_SUFFIXES:$origin_suffixes" \
       --var "JWT_ISSUER:$jwt_issuer" \
       --var "JWT_ALLOWED_ALGORITHMS:$jwt_alg" \
       --var "SERVICE_ROUTE_PREFIX:$svc_route" \
@@ -97,6 +182,9 @@ deploy_gateway() {
       --var "SERVICE_JWT_ISSUER:$svc_iss" \
       --var "SERVICE_JWT_ALLOWED_ALGORITHMS:$svc_alg" >/dev/null
 
+    # Clean up the temp config (only created when KV was bound or public URL disabled).
+    [[ "$config_file" != "$WRANGLER_DIR/wrangler.toml" ]] && rm -f "$config_file"
+
     # Secrets (piped via stdin).
     put_secret "$worker_name" BACKEND_URL "$backend_url"
     put_secret "$worker_name" BACKEND_GATEWAY_SECRET "${LAMBDA_GATEWAY_SECRET:-}"
@@ -108,6 +196,10 @@ deploy_gateway() {
     if [[ -n "$custom_domain" ]]; then
       url="https://$custom_domain"
       info "  custom domain: $custom_domain (configure DNS/route separately)"
+    elif [[ -n "$disable_public_url" ]]; then
+      # workers.dev + preview URLs were turned off in the deploy config above; the worker
+      # is reachable only via its Service Binding (Pages proxy) — no public URL to print.
+      url="(no public URL — reached via Pages proxy / Service Binding)"
     else
       enable_workers_dev "$worker_name"
       if [[ -n "${CF_WORKERS_SUBDOMAIN:-}" ]]; then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@auth-craft/aws-cf-stack",
-  "version": "1.1.1",
+  "version": "1.3.0",
   "description": "Self-contained, versioned distribution of the Auth Craft AWS (DynamoDB + Lambda) + Cloudflare gateway stack. Bundles prebuilt Lambda/worker artifacts + CDK app so consumers deploy without cloning auth-craft.",
   "type": "module",
   "bin": {

package/wrangler/wrangler.toml

@@ -4,6 +4,11 @@
 # (assets/gateway/worker.js). deploy-gateway.sh overrides `name` and injects vars
 # per scope via `wrangler deploy --name <name> --var K:V ...`, and pushes secrets via
 # `wrangler secret put`. No source compile happens at deploy time.
+#
+# CORS_KV binding (dynamic CORS allowlist) is NOT declared here: a KV binding can't be
+# set via --var, so when CF_CORS_KV_ID_<SCOPE> is set deploy-gateway.sh deploys that
+# scope with a temp copy of this file that appends a [[kv_namespaces]] block. Leaving
+# it out here keeps scopes without a KV id (system/tenant) binding-free.
 name = "auth-craft-gateway"
 main = "../assets/gateway/worker.js"
 compatibility_date = "2024-11-27"