@authhero/cloudflare-adapter 2.35.2 → 2.36.0

package/dist/cloudflare-adapter.mjs

@@ -126,7 +126,7 @@ function v(e) {
 		domain_metadata: i
 	};
 }
-function ee(e) {
+function y(e) {
 	return {
 		create: async (t, n) => {
 			let { sslOverrides: r, rest: i } = _(n.domain_metadata), { result: a, errors: o, success: s } = h.parse(await g(e).post({
@@ -248,7 +248,7 @@ function ee(e) {
 }
 //#endregion
 //#region src/cache/index.ts
-var te = class {
+var ee = class {
 	config;
 	cache = null;
 	constructor(e) {
@@ -322,8 +322,8 @@ var te = class {
 		console.warn("CloudflareCache.clear() is not implemented - Cloudflare Cache API does not support clearing all entries");
 	}
 };
-function ne(e = {}) {
-	return new te({
+function te(e = {}) {
+	return new ee({
 		defaultTtlSeconds: 300,
 		keyPrefix: "authhero",
 		getTimeoutMs: 200,
@@ -332,14 +332,14 @@ function ne(e = {}) {
 }
 //#endregion
 //#region ../../node_modules/.pnpm/nanoid@5.1.15/node_modules/nanoid/url-alphabet/index.js
-var re = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", y = (e = 21) => {
+var ne = "useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict", b = (e = 21) => {
 	let t = "", n = crypto.getRandomValues(new Uint8Array(e |= 0));
-	for (; e--;) t += re[n[e] & 63];
+	for (; e--;) t += ne[n[e] & 63];
 	return t;
 };
 //#endregion
 //#region src/r2-sql-logs/query.ts
-async function b(e, t) {
+async function x(e, t) {
 	let n = e.timeout || 3e4, r = new AbortController(), i = setTimeout(() => r.abort(), n);
 	try {
 		let n = `https://api.sql.cloudflarestorage.com/api/v1/accounts/${e.accountId}/r2-sql/query/${e.warehouseName}`, i = await fetch(n, {
@@ -359,15 +359,15 @@ async function b(e, t) {
 		clearTimeout(i);
 	}
 }
-function x(e) {
+function S(e) {
 	return `'${e.replace(/'/g, "''")}'`;
 }
-function S(e) {
+function C(e) {
 	return `"${e.replace(/"/g, "\"\"")}"`;
 }
 //#endregion
 //#region src/r2-sql-logs/logs.ts
-function C(e) {
+function w(e) {
 	let t = (e) => {
 		if (!e) return "";
 		try {
@@ -407,16 +407,16 @@ function C(e) {
 		} : void 0
 	};
 }
-function ie(e) {
+function re(e) {
 	return async (t, n) => {
-		let r = n.log_id || y(), i = {
+		let r = n.log_id || b(), i = {
 			...n,
 			log_id: r
 		};
-		return await ae(e, t, i), i;
+		return await ie(e, t, i), i;
 	};
 }
-async function ae(e, t, n) {
+async function ie(e, t, n) {
 	let r = (e) => e ? JSON.stringify(e) : void 0, i = {
 		id: n.log_id,
 		tenant_id: t,
@@ -467,22 +467,22 @@ async function ae(e, t, n) {
 		throw console.error("Failed to send log to Pipeline:", e), e;
 	}
 }
-function w(e) {
+function ae(e) {
 	return async (t, n) => {
-		let r = e.namespace || "default", i = e.tableName || "logs", a = await b(e, `
-      SELECT * FROM ${S(r)}.${S(i)}
-      WHERE tenant_id = ${x(t)}
-        AND id = ${x(n)}
+		let r = e.namespace || "default", i = e.tableName || "logs", a = await x(e, `
+      SELECT * FROM ${C(r)}.${C(i)}
+      WHERE tenant_id = ${S(t)}
+        AND id = ${S(n)}
       LIMIT 1
     `);
 		if (a.length === 0) return null;
 		let o = a[0];
-		return o ? C(o) : null;
+		return o ? w(o) : null;
 	};
 }
 //#endregion
 //#region src/r2-sql-logs/list.ts
-function T(e) {
+function oe(e) {
 	let t = {}, n = /(\w+):(?:"([^"]*)"|(\S+))/g, r;
 	for (; (r = n.exec(e)) !== null;) {
 		let e = r[1], n = r[2] === void 0 ? r[3] : r[2];
@@ -490,40 +490,40 @@ function T(e) {
 	}
 	return t;
 }
-function E(e) {
+function T(e) {
 	let t = [];
 	for (let [n, r] of Object.entries(e)) {
 		let e = n.replace(/[^a-zA-Z0-9_]/g, "");
-		e && r && t.push(`${S(e)} = ${x(r)}`);
+		e && r && t.push(`${C(e)} = ${S(r)}`);
 	}
 	return t;
 }
-function oe(e) {
+function E(e) {
 	return async (t, n = {}) => {
-		let { page: r = 0, per_page: i = 50, include_totals: a = !1, sort: o, q: s } = n, c = e.namespace || "default", l = e.tableName || "logs", u = [`tenant_id = ${x(t)}`];
+		let { page: r = 0, per_page: i = 50, include_totals: a = !1, sort: o, q: s } = n, c = e.namespace || "default", l = e.tableName || "logs", u = [`tenant_id = ${S(t)}`];
 		if (s) {
-			let e = T(s);
-			u.push(...E(e));
+			let e = oe(s);
+			u.push(...T(e));
 		}
 		let d = u.join(" AND "), f = "ORDER BY date DESC";
 		if (o && o.sort_by) {
 			let e = o.sort_by.replace(/[^a-zA-Z0-9_]/g, ""), t = o.sort_order === "asc" ? "ASC" : "DESC";
-			f = `ORDER BY ${S(e)} ${t}`;
+			f = `ORDER BY ${C(e)} ${t}`;
 		}
-		let p = r * i, m = `LIMIT ${i} OFFSET ${p}`, h = (await b(e, `
-      SELECT * FROM ${S(c)}.${S(l)}
+		let p = r * i, m = `LIMIT ${i} OFFSET ${p}`, h = (await x(e, `
+      SELECT * FROM ${C(c)}.${C(l)}
       WHERE ${d}
       ${f}
       ${m}
-    `)).map(C);
+    `)).map(w);
 		if (!a) return {
 			logs: h,
 			start: 0,
 			limit: 0,
 			length: 0
 		};
-		let g = (await b(e, `
-      SELECT COUNT(*) as count FROM ${S(c)}.${S(l)}
+		let g = (await x(e, `
+      SELECT COUNT(*) as count FROM ${C(c)}.${C(l)}
       WHERE ${d}
     `))[0]?.count || 0;
 		return {
@@ -554,9 +554,9 @@ function D(e) {
 	if (!e.authToken) throw Error("R2 SQL logs adapter requires \"authToken\" configuration");
 	if (!e.warehouseName) throw Error("R2 SQL logs adapter requires \"warehouseName\" configuration");
 	return {
-		create: ie(e),
-		list: oe(e),
-		get: w(e)
+		create: re(e),
+		list: E(e),
+		get: ae(e)
 	};
 }
 //#endregion
@@ -626,7 +626,7 @@ function j(e) {
 }
 function ce(e) {
 	return async (t, n) => {
-		let r = n.log_id || y(), i = {
+		let r = n.log_id || b(), i = {
 			...n,
 			log_id: r
 		};
@@ -1584,27 +1584,66 @@ function Ue(e) {
 		apiToken: e.apiToken,
 		fetch: e.fetch,
 		timeoutMs: e.timeoutMs
-	}), n = e.scriptNameTemplate ?? Re, r = e.d1NameTemplate ?? ze, i = e.scriptMetadata?.main_module ?? Be, a = e.scriptMetadata?.compatibility_date ?? Ve, o = e.scriptMetadata?.compatibility_flags ?? ["nodejs_compat"], s = e.dispatchNamespace;
-	async function c(e) {
+	}), n = e.scriptNameTemplate ?? Re, r = e.d1NameTemplate ?? ze, i = e.scriptMetadata?.main_module ?? Be, a = e.scriptMetadata?.compatibility_date ?? Ve, o = e.scriptMetadata?.compatibility_flags ?? ["nodejs_compat"], s = e.dispatchNamespace, c = e.logger;
+	async function l(e) {
 		let n = (await t.listD1Databases(e)).find((t) => t.name === e);
-		if (n) return n.uuid;
+		if (n) return {
+			id: n.uuid,
+			created: !1
+		};
 		try {
-			return (await t.createD1Database(e)).uuid;
+			return {
+				id: (await t.createD1Database(e)).uuid,
+				created: !0
+			};
 		} catch (n) {
 			if (!He(n)) throw n;
 			let r = (await t.listD1Databases(e)).find((t) => t.name === e);
-			if (r) return r.uuid;
+			if (r) return {
+				id: r.uuid,
+				created: !1
+			};
 			throw n;
 		}
 	}
-	async function l(n) {
-		for (let r of e.migrations) try {
-			await t.execD1(n, r.sql);
-		} catch (e) {
-			throw e instanceof Error ? Error(`Failed to apply migration "${r.name}" to D1 ${n}: ${e.message}`, { cause: e }) : e;
+	let u = "_authhero_provisioner_migrations";
+	function d(e, t) {
+		let n = [];
+		for (let r of e) for (let e of r.results ?? []) if (e && typeof e == "object" && t in e) {
+			let r = e[t];
+			typeof r == "string" && n.push(r);
 		}
+		return n;
+	}
+	async function f(e) {
+		return d(await t.execD1(e, `SELECT name FROM sqlite_master WHERE type='table' AND name='${u}';`), "name").length > 0;
+	}
+	async function p(e) {
+		await t.execD1(e, `CREATE TABLE IF NOT EXISTS ${u} (name TEXT PRIMARY KEY, applied_at TEXT NOT NULL);`);
+	}
+	async function m(e) {
+		let n = await t.execD1(e, `SELECT name FROM ${u};`);
+		return new Set(d(n, "name"));
 	}
-	async function u(n, r) {
+	function h(e) {
+		return e.replace(/'/g, "''");
+	}
+	async function g(e, n) {
+		let r = (/* @__PURE__ */ new Date()).toISOString();
+		await t.execD1(e, `INSERT OR IGNORE INTO ${u} (name, applied_at) VALUES ('${h(n)}', '${h(r)}');`);
+	}
+	async function _(n) {
+		let r = await m(n);
+		for (let i of e.migrations) if (!r.has(i.name)) {
+			try {
+				await t.execD1(n, i.sql);
+			} catch (e) {
+				throw e instanceof Error ? Error(`Failed to apply migration "${i.name}" to D1 ${n}: ${e.message}`, { cause: e }) : e;
+			}
+			await g(n, i.name);
+		}
+	}
+	async function v(n, r) {
 		let c = [
 			{
 				type: "d1",
@@ -1627,31 +1666,44 @@ function Ue(e) {
 			tags: ["authhero-tenant", `tenant:${n}`]
 		});
 	}
-	async function d(n, r) {
+	async function y(n, r) {
 		let i = await e.secrets(r);
 		for (let [e, r] of Object.entries(i)) await t.setNamespacedScriptSecret(s, n, e, r);
 	}
 	return {
-		async onProvision(e) {
-			let t = Z(n, e), i = Z(r, e), a = await c(i);
-			return await l(a), await u(t, a), await d(t, e), {
-				d1DatabaseId: a,
-				scriptName: t,
-				d1Name: i
+		async onProvision(t) {
+			let i = Z(n, t), a = Z(r, t), { id: o, created: s } = await l(a), u = s ? !1 : await f(o);
+			if (s || u) await p(o), await _(o);
+			else {
+				c?.warn(`D1 "${a}" has no migration-tracking table — assuming it predates tracking and is fully migrated; backfilling the tracking table and skipping migrations.`), await p(o);
+				for (let t of e.migrations) await g(o, t.name);
+			}
+			return await v(i, o), await y(i, t), {
+				d1DatabaseId: o,
+				scriptName: i,
+				d1Name: a
 			};
 		},
 		async onDeprovision(e) {
-			let i = Z(n, e), a = Z(r, e);
+			let i = Z(n, e), a = Z(r, e), o = [];
 			try {
 				await t.deleteNamespacedScript(s, i);
 			} catch (e) {
-				if (!Q(e)) throw e;
+				Q(e) || o.push(e);
 			}
-			let o = (await t.listD1Databases(a)).find((e) => e.name === a);
-			if (o) try {
-				await t.deleteD1Database(o.uuid);
+			try {
+				let e = (await t.listD1Databases(a)).find((e) => e.name === a);
+				if (e) try {
+					await t.deleteD1Database(e.uuid);
+				} catch (e) {
+					Q(e) || o.push(e);
+				}
 			} catch (e) {
-				if (!Q(e)) throw e;
+				o.push(e);
+			}
+			if (o.length > 0) {
+				let t = o.map((e) => e instanceof Error ? e.message : String(e)).join("; ");
+				throw Error(`Deprovision of tenant "${e}" had ${o.length} failure(s): ${t}`, { cause: o[0] });
 			}
 		}
 	};
@@ -1662,8 +1714,14 @@ function We(e) {
 	return e.deployment_type === "wfp";
 }
 function $(e) {
-	let { provisioner: t, tenants: n } = e, r = e.shouldProvision ?? We, i = e.logger;
-	async function a(e, t) {
+	if (typeof e != "object" || !e) return [];
+	let t = [];
+	for (let n of Object.values(e)) if (typeof n == "object" && n && "errors" in n && Array.isArray(n.errors)) for (let e of n.errors) typeof e == "string" && t.push(e);
+	return t;
+}
+function Ge(e) {
+	let { provisioner: t, tenants: n, syncDefaults: r } = e, i = e.shouldProvision ?? We, a = e.logger;
+	async function o(e, t) {
 		let r = t instanceof Error ? t.message : String(t);
 		try {
 			await n.update(e, {
@@ -1672,59 +1730,83 @@ function $(e) {
 				provisioning_state_changed_at: (/* @__PURE__ */ new Date()).toISOString()
 			});
 		} catch (t) {
-			i?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`, t);
+			a?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`, t);
 		}
 	}
 	return {
 		async onProvision(e) {
-			let i = await n.get(e);
-			if (i && r(i)) try {
-				let r = await t.onProvision(e);
-				await n.update(e, {
-					d1_database_id: r.d1DatabaseId,
-					worker_script_name: r.scriptName,
-					provisioning_state: "ready",
-					provisioning_error: void 0,
-					provisioning_state_changed_at: (/* @__PURE__ */ new Date()).toISOString()
-				});
+			let s = await n.get(e);
+			if (!s || !i(s)) return;
+			let c;
+			try {
+				c = await t.onProvision(e);
 			} catch (t) {
-				throw await a(e, t), t;
+				throw await o(e, t), t;
 			}
+			let l = {
+				d1_database_id: c.d1DatabaseId,
+				worker_script_name: c.scriptName
+			};
+			try {
+				if (r) {
+					let t = $(await r(e));
+					if (t.length > 0) throw Error(`sync-defaults seed reported ${t.length} error(s): ${t.join("; ")}`);
+				}
+			} catch (t) {
+				let r = t instanceof Error ? t.message : String(t);
+				try {
+					await n.update(e, {
+						...l,
+						provisioning_state: "failed",
+						provisioning_error: r.slice(0, 2048),
+						provisioning_state_changed_at: (/* @__PURE__ */ new Date()).toISOString()
+					});
+				} catch (t) {
+					a?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`, t);
+				}
+				throw t;
+			}
+			await n.update(e, {
+				...l,
+				provisioning_state: "ready",
+				provisioning_error: void 0,
+				provisioning_state_changed_at: (/* @__PURE__ */ new Date()).toISOString()
+			});
 		},
 		async onDeprovision(e) {
-			let i = await n.get(e);
-			i && !r(i) || await t.onDeprovision(e);
+			let r = await n.get(e);
+			r && !i(r) || await t.onDeprovision(e);
 		}
 	};
 }
 //#endregion
 //#region src/wfp-provisioner/wfp-forward.ts
-var Ge = "DISPATCHER", Ke = "tenant-{tenant_id}-auth";
-function qe(e) {
+var Ke = "DISPATCHER", qe = "tenant-{tenant_id}-auth";
+function Je(e) {
 	return typeof e == "object" && !!e && "get" in e && typeof Reflect.get(e, "get") == "function";
 }
-function Je(e, t) {
+function Ye(e, t) {
 	return e.replace(/\{tenant_id\}/g, t);
 }
-function Ye(e) {
-	let { tenants: t, controlPlaneTenantId: n, dispatcherBinding: r = Ge, scriptNameTemplate: i = Ke, resolveTenantId: a = (e) => e.req.header("tenant-id") } = e;
+function Xe(e) {
+	let { tenants: t, controlPlaneTenantId: n, dispatcherBinding: r = Ke, scriptNameTemplate: i = qe, resolveTenantId: a = (e) => e.req.header("tenant-id") } = e;
 	return async (e, o) => {
 		let s = await a(e);
 		if (!s || s === n) return o();
 		let c = await t.get(s);
 		if (!c || c.deployment_type !== "wfp" || c.provisioning_state && c.provisioning_state !== "ready") return o();
 		let l = Reflect.get(e.env ?? {}, r);
-		if (!qe(l)) return o();
-		let u = Je(i, s);
+		if (!Je(l)) return o();
+		let u = Ye(i, s);
 		return l.get(u).fetch(e.req.raw);
 	};
 }
 //#endregion
 //#region src/index.ts
-function Xe(e) {
+function Ze(e) {
 	let t = {
-		customDomains: ee(e),
-		cache: ne({
+		customDomains: y(e),
+		cache: te({
 			...e.cacheName && { cacheName: e.cacheName },
 			...e.defaultTtlSeconds !== void 0 && { defaultTtlSeconds: e.defaultTtlSeconds },
 			...e.keyPrefix && { keyPrefix: e.keyPrefix }
@@ -1736,4 +1818,4 @@ function Xe(e) {
 	return n && (t.rateLimit = n), t;
 }
 //#endregion
-export { X as CloudflareApiClient, Y as CloudflareApiError, je as CloudflareCodeExecutor, J as DispatchNamespaceCodeExecutor, Ie as WorkerLoaderCodeExecutor, G as createAnalyticsEngineActionExecutionsAdapter, B as createAnalyticsEngineAnalyticsAdapter, V as createAnalyticsEngineLogsAdapter, L as createAnalyticsEngineStatsAdapter, K as createCloudflareRateLimitAdapter, Ue as createCloudflareWfpD1Provisioner, D as createR2SQLLogsAdapter, se as createR2SQLStatsAdapter, Ye as createWfpForwardMiddleware, $ as createWfpTenantProvisioningHook, Xe as default, q as generateWorkerScript };
+export { X as CloudflareApiClient, Y as CloudflareApiError, je as CloudflareCodeExecutor, J as DispatchNamespaceCodeExecutor, Ie as WorkerLoaderCodeExecutor, G as createAnalyticsEngineActionExecutionsAdapter, B as createAnalyticsEngineAnalyticsAdapter, V as createAnalyticsEngineLogsAdapter, L as createAnalyticsEngineStatsAdapter, K as createCloudflareRateLimitAdapter, Ue as createCloudflareWfpD1Provisioner, D as createR2SQLLogsAdapter, se as createR2SQLStatsAdapter, Xe as createWfpForwardMiddleware, Ge as createWfpTenantProvisioningHook, Ze as default, q as generateWorkerScript };