@authhero/cloudflare-adapter 2.36.0 → 2.37.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cloudflare-adapter.cjs +28 -28
- package/dist/cloudflare-adapter.d.ts +50 -0
- package/dist/cloudflare-adapter.mjs +177 -136
- package/dist/tsconfig.types.tsbuildinfo +1 -1
- package/dist/types/wfp-provisioner/tenant-hook.d.ts +13 -0
- package/dist/types/wfp-provisioner/types.d.ts +37 -0
- package/package.json +4 -4
|
@@ -1,9 +1,9 @@
|
|
|
1
|
-
Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,i,o,s)=>{if(i&&typeof i==`object`||typeof i==`function`)for(var c=r(i),l=0,u=c.length,d;l<u;l++)d=c[l],!a.call(e,d)&&d!==o&&t(e,d,{get:(e=>i[e]).bind(null,d),enumerable:!(s=n(i,d))||s.enumerable});return e},s=(n,r,a)=>(a=n==null?{}:e(i(n)),o(r||!n||!n.__esModule?t(a,`default`,{value:n,enumerable:!0}):a,n));let c=require("@authhero/adapter-interfaces"),l=require("@hono/zod-openapi"),u=require("hono/http-exception"),d=require("wretch");d=s(d);let f=require("wretch/middlewares");var p=l.z.object({code:l.z.number(),message:l.z.string()}),m=l.z.object({message:l.z.string()}),h=l.z.object({emails:l.z.array(l.z.string()).optional(),http_body:l.z.string().optional(),http_url:l.z.string().optional(),txt_name:l.z.string().optional(),txt_value:l.z.string().optional()}),g=l.z.object({ciphers:l.z.array(l.z.string()).optional(),early_hints:l.z.string().optional(),http2:l.z.string().optional(),min_tls_version:l.z.string().optional(),tls_1_3:l.z.string().optional()}),_=l.z.object({id:l.z.string(),bundle_method:l.z.string().optional(),certificate_authority:l.z.string(),custom_certificate:l.z.string().optional(),custom_csr_id:l.z.string().optional(),custom_key:l.z.string().optional(),expires_on:l.z.string().optional(),hosts:l.z.array(l.z.string()).optional(),issuer:l.z.string().optional(),method:l.z.string(),serial_number:l.z.string().optional(),settings:g.optional(),signature:l.z.string().optional(),type:l.z.string(),uploaded_on:l.z.string().optional(),validation_errors:l.z.array(m).optional(),validation_records:l.z.array(h).optional(),wildcard:l.z.boolean()}),v=l.z.object({name:l.z.string(),type:l.z.string(),value:l.z.string()}),y=l.z.object({http_body:l.z.string().optional(),http_url:l.z.string().optional()}),b=l.z.object({id:l.z.string(),ssl:_,hostname:l.z.string(),custom_metadata:l.z.record(l.z.string(),l.z.string()).optional(),custom_origin_server:l.z.string().optional(),custom_origin_sni:l.z.string().optional(),ownership_verification:v.optional(),ownership_verification_http:y.optional(),status:l.z.string(),verification_errors:l.z.array(l.z.string()).optional(),created_at:l.z.string()}),x=l.z.object({errors:l.z.array(p),messages:l.z.array(p),success:l.z.boolean(),result:b});l.z.object({errors:l.z.array(p),messages:l.z.array(p),success:l.z.boolean(),result:l.z.array(b)});function S(e){return(0,d.default)(`https://api.cloudflare.com/client/v4/zones/${e.zoneId}`).headers({"X-Auth-Email":e.authEmail,"X-Auth-Key":e.authKey,"Content-Type":`application/json`}).middlewares([(0,f.retry)(),(0,f.dedupe)()])}function C(e){let t={},n={};if(!e)return{sslOverrides:t,rest:n};for(let[r,i]of Object.entries(e))r.startsWith(`ssl.`)?t[r.slice(4)]=i:n[r]=i;return{sslOverrides:t,rest:n}}function w(e){let t=[];if(e.ssl.validation_records)for(let n of e.ssl.validation_records)n.txt_name&&n.txt_value&&t.push({name:`txt`,record:n.txt_value,domain:n.txt_name});if(e.ownership_verification&&t.push({name:`txt`,record:e.ownership_verification.value,domain:e.ownership_verification.name}),e.ownership_verification_http?.http_body&&e.ownership_verification_http?.http_url&&t.push({name:`http`,http_body:e.ownership_verification_http.http_body,http_url:e.ownership_verification_http.http_url}),e.ssl.validation_records)for(let n of e.ssl.validation_records)n.http_body&&n.http_url&&t.push({name:`http`,http_body:n.http_body,http_url:n.http_url});let n={...e.domain_metadata||{},"ssl.method":e.ssl.method,"ssl.type":e.ssl.type,"ssl.certificate_authority":e.ssl.certificate_authority};return{custom_domain_id:e.id,domain:e.hostname,primary:e.primary,status:e.status===`active`?`ready`:`pending`,type:e.type??`auth0_managed_certs`,verification:{methods:l.z.array(c.verificationMethodsSchema).parse(t)},domain_metadata:n}}function ee(e){return{create:async(t,n)=>{let{sslOverrides:r,rest:i}=C(n.domain_metadata),{result:a,errors:o,success:s}=x.parse(await S(e).post({hostname:n.domain,ssl:{method:`txt`,type:`dv`,...r},custom_metadata:e.enterprise?{tenant_id:t}:void 0},`/custom_hostnames`).json());if(!s)throw Error(JSON.stringify(o));let c=w({...a,primary:!1,type:n.type,domain_metadata:i});return await e.customDomainAdapter.create(t,{custom_domain_id:c.custom_domain_id,domain:c.domain,type:c.type,domain_metadata:n.domain_metadata}),await e.customDomainAdapter.update(t,c.custom_domain_id,{status:c.status,primary:c.primary,verification:c.verification}),c},get:async(t,n)=>{let r=await e.customDomainAdapter.get(t,n);if(!r)throw new u.HTTPException(404);let i;try{i=await S(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json()}catch(e){return console.warn(`[custom-domains] CF fetch failed for ${n} (tenant=${t}); returning stale DB row:`,e instanceof Error?e.message:e),r}let a=x.safeParse(i);if(!a.success||!a.data.success)return console.warn(`[custom-domains] CF response unparseable for ${n} (tenant=${t}); returning stale DB row.`,a.success?{cfErrors:a.data.errors}:{zodIssues:a.error.issues,body:i}),r;let{result:o}=a.data;if(e.enterprise&&o.custom_metadata?.tenant_id!==t)throw new u.HTTPException(404);let s;try{s=w({...r,...o})}catch(e){return console.warn(`[custom-domains] mapCustomDomainResponse failed for ${n} (tenant=${t}); returning stale DB row.`,e instanceof Error?e.message:e),r}if(s.status!==r.status||JSON.stringify(s.verification)!==JSON.stringify(r.verification))try{await e.customDomainAdapter.update(t,n,{status:s.status,verification:s.verification})}catch(e){console.warn(`[custom-domains] DB writeback failed for ${n} (tenant=${t}); returning merged response without DB sync.`,e instanceof Error?e.message:e)}return s},getByDomain:async t=>e.customDomainAdapter.getByDomain(t),list:async t=>e.customDomainAdapter.list(t),remove:async(t,n)=>{if(e.enterprise){let{result:r,success:i}=x.parse(await S(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json());if(!i||r.custom_metadata?.tenant_id!==t)throw new u.HTTPException(404)}let r=await S(e).delete(`/custom_hostnames/${encodeURIComponent(n)}`).res();return r.ok&&await e.customDomainAdapter.remove(t,n),r.ok},update:async(t,n,r)=>{let{sslOverrides:i}=C(r.domain_metadata),a={};if(Object.keys(i).length>0){let t;try{t=await S(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json()}catch(e){throw new u.HTTPException(503,{message:`Failed to fetch current custom hostname state: ${e instanceof Error?e.message:String(e)}`})}let r=x.safeParse(t);if(!r.success||!r.data.success)throw new u.HTTPException(503,{message:`Failed to parse current custom hostname state: ${JSON.stringify(r.success?r.data.errors:r.error.issues)}`});a.ssl={method:r.data.result.ssl.method,type:r.data.result.ssl.type,certificate_authority:r.data.result.ssl.certificate_authority,...i}}if(Object.keys(a).length>0){let t=await S(e).patch(a,`/custom_hostnames/${encodeURIComponent(n)}`).res().catch(e=>{throw new u.HTTPException(503,{message:`Failed to update custom hostname: ${e instanceof Error?e.message:String(e)}`})});if(!t.ok)throw new u.HTTPException(503,{message:await t.text()})}return e.customDomainAdapter.update(t,n,r)},uploadCertificate:async(t,n,r)=>{let i=await e.customDomainAdapter.get(t,n);if(!i)throw new u.HTTPException(404);let a=await S(e).patch({ssl:{custom_certificate:r.certificate,custom_key:r.private_key}},`/custom_hostnames/${encodeURIComponent(n)}`).json(),{result:o,errors:s,success:c}=x.parse(a);if(!c)throw new u.HTTPException(503,{message:JSON.stringify(s)});let l=w({...i,...o});return await e.customDomainAdapter.update(t,n,{status:l.status,verification:l.verification}),l}}}var te=class{config;cache=null;constructor(e){this.config=e}async getCache(){if(this.cache)return this.cache;if(typeof caches>`u`)throw Error(`caches API is not available - CloudflareCache should only be used in Cloudflare Workers`);return this.config.cacheName?this.cache=await caches.open(this.config.cacheName):this.cache=caches.default,this.cache}getKey(e){return this.config.keyPrefix?`${this.config.keyPrefix}:${e}`:e}createRequest(e){return new Request(`https://cache.internal/${this.getKey(e)}`)}async matchWithTimeout(e,t){let n=this.config.getTimeoutMs??200;return n<=0?e.match(t):new Promise(r=>{let i=setTimeout(()=>r(void 0),n);e.match(t).then(e=>{clearTimeout(i),r(e)},()=>{clearTimeout(i),r(void 0)})})}async get(e){try{let t=await this.getCache(),n=this.createRequest(e),r=await this.matchWithTimeout(t,n);if(!r)return null;let i=await r.text();if(!i)return await this.delete(e),null;let a;try{a=JSON.parse(i)}catch{return await this.delete(e),null}return a.expiresAt&&new Date(a.expiresAt)<new Date?(await this.delete(e),null):a.value}catch(t){return console.error(`CloudflareCache: get error for key ${e}:`,t),null}}async set(e,t,n){try{let r=await this.getCache(),i=n??this.config.defaultTtlSeconds,a=i!==void 0,o=a?Math.max(0,i):0,s={value:t,expiresAt:a?new Date(Date.now()+(o>0?o*1e3:-1)).toISOString():void 0,cachedAt:new Date().toISOString()},c=this.createRequest(e),l={"Content-Type":`application/json`};a&&o>0&&(l[`Cache-Control`]=`max-age=${o}`);let u=new Response(JSON.stringify(s),{headers:l});await r.put(c,u)}catch(t){console.error(`CloudflareCache: set error for key ${e}:`,t)}}async delete(e){try{let t=await this.getCache(),n=this.createRequest(e);return await t.delete(n)}catch(t){return console.error(`CloudflareCache: delete error for key ${e}:`,t),!1}}async deleteByPrefix(e){return console.warn(`CloudflareCache.deleteByPrefix() is not implemented - Cloudflare Cache API does not support prefix-based deletion`),0}async clear(){console.warn(`CloudflareCache.clear() is not implemented - Cloudflare Cache API does not support clearing all entries`)}};function ne(e={}){return new te({defaultTtlSeconds:300,keyPrefix:`authhero`,getTimeoutMs:200,...e})}var re=`useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict`,T=(e=21)=>{let t=``,n=crypto.getRandomValues(new Uint8Array(e|=0));for(;e--;)t+=re[n[e]&63];return t};async function E(e,t){let n=e.timeout||3e4,r=new AbortController,i=setTimeout(()=>r.abort(),n);try{let n=`https://api.sql.cloudflarestorage.com/api/v1/accounts/${e.accountId}/r2-sql/query/${e.warehouseName}`,i=await fetch(n,{method:`POST`,headers:{"Content-Type":`application/json`,Authorization:`Bearer ${e.authToken}`},body:JSON.stringify({query:t}),signal:r.signal});if(!i.ok)throw Error(`R2 SQL query failed: ${i.status} ${i.statusText}`);let a=await i.json();if(!a.success&&a.errors)throw Error(`R2 SQL error: ${a.errors.join(`, `)}`);return a.data||a.result?.data||[]}finally{clearTimeout(i)}}function D(e){return`'${e.replace(/'/g,`''`)}'`}function O(e){return`"${e.replace(/"/g,`""`)}"`}function k(e){let t=e=>{if(!e)return``;try{return JSON.parse(e)}catch{return e}};return{type:e.type,date:e.date,description:e.description,ip:e.ip,user_agent:e.user_agent,details:t(e.details),isMobile:!!e.isMobile,user_id:e.user_id,user_name:e.user_name,connection:e.connection,connection_id:e.connection_id,client_id:e.client_id,client_name:e.client_name,audience:e.audience,scope:e.scope,strategy:e.strategy,strategy_type:e.strategy_type,hostname:e.hostname,auth0_client:t(e.auth0_client),log_id:e.id,location_info:e.country_code||e.city_name||e.latitude||e.longitude||e.time_zone||e.continent_code?{country_code:e.country_code||``,city_name:e.city_name||``,latitude:e.latitude||``,longitude:e.longitude||``,time_zone:e.time_zone||``,continent_code:e.continent_code||``}:void 0}}function ie(e){return async(t,n)=>{let r=n.log_id||T(),i={...n,log_id:r};return await ae(e,t,i),i}}async function ae(e,t,n){let r=e=>e?JSON.stringify(e):void 0,i={id:n.log_id,tenant_id:t,type:n.type,date:n.date,description:n.description?.substring(0,256),ip:n.ip,user_agent:n.user_agent,details:r(n.details)?.substring(0,8192),isMobile:+!!n.isMobile,user_id:n.user_id,user_name:n.user_name,connection:n.connection,connection_id:n.connection_id,client_id:n.client_id,client_name:n.client_name,audience:n.audience,scope:n.scope,strategy:n.strategy,strategy_type:n.strategy_type,hostname:n.hostname,auth0_client:r(n.auth0_client),log_id:n.log_id,country_code:n.location_info?.country_code,city_name:n.location_info?.city_name,latitude:n.location_info?.latitude,longitude:n.location_info?.longitude,time_zone:n.location_info?.time_zone,continent_code:n.location_info?.continent_code};try{if(e.pipelineBinding)await e.pipelineBinding.send([i]);else if(e.pipelineEndpoint){let t=e.timeout||3e4,n=new AbortController,r=setTimeout(()=>n.abort(),t);try{let t=await fetch(e.pipelineEndpoint,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify([i]),signal:n.signal});if(!t.ok)throw Error(`Pipeline ingestion failed: ${t.status} ${t.statusText}`)}finally{clearTimeout(r)}}else throw Error(`Either pipelineEndpoint or pipelineBinding must be configured`)}catch(e){throw console.error(`Failed to send log to Pipeline:`,e),e}}function A(e){return async(t,n)=>{let r=e.namespace||`default`,i=e.tableName||`logs`,a=await E(e,`
|
|
1
|
+
Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{value:`Module`}});var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,i,o,s)=>{if(i&&typeof i==`object`||typeof i==`function`)for(var c=r(i),l=0,u=c.length,d;l<u;l++)d=c[l],!a.call(e,d)&&d!==o&&t(e,d,{get:(e=>i[e]).bind(null,d),enumerable:!(s=n(i,d))||s.enumerable});return e},s=(n,r,a)=>(a=n==null?{}:e(i(n)),o(r||!n||!n.__esModule?t(a,`default`,{value:n,enumerable:!0}):a,n));let c=require("@authhero/adapter-interfaces"),l=require("@hono/zod-openapi"),u=require("hono/http-exception"),d=require("wretch");d=s(d);let f=require("wretch/middlewares");var p=l.z.object({code:l.z.number(),message:l.z.string()}),m=l.z.object({message:l.z.string()}),h=l.z.object({emails:l.z.array(l.z.string()).optional(),http_body:l.z.string().optional(),http_url:l.z.string().optional(),txt_name:l.z.string().optional(),txt_value:l.z.string().optional()}),g=l.z.object({ciphers:l.z.array(l.z.string()).optional(),early_hints:l.z.string().optional(),http2:l.z.string().optional(),min_tls_version:l.z.string().optional(),tls_1_3:l.z.string().optional()}),_=l.z.object({id:l.z.string(),bundle_method:l.z.string().optional(),certificate_authority:l.z.string(),custom_certificate:l.z.string().optional(),custom_csr_id:l.z.string().optional(),custom_key:l.z.string().optional(),expires_on:l.z.string().optional(),hosts:l.z.array(l.z.string()).optional(),issuer:l.z.string().optional(),method:l.z.string(),serial_number:l.z.string().optional(),settings:g.optional(),signature:l.z.string().optional(),type:l.z.string(),uploaded_on:l.z.string().optional(),validation_errors:l.z.array(m).optional(),validation_records:l.z.array(h).optional(),wildcard:l.z.boolean()}),v=l.z.object({name:l.z.string(),type:l.z.string(),value:l.z.string()}),y=l.z.object({http_body:l.z.string().optional(),http_url:l.z.string().optional()}),b=l.z.object({id:l.z.string(),ssl:_,hostname:l.z.string(),custom_metadata:l.z.record(l.z.string(),l.z.string()).optional(),custom_origin_server:l.z.string().optional(),custom_origin_sni:l.z.string().optional(),ownership_verification:v.optional(),ownership_verification_http:y.optional(),status:l.z.string(),verification_errors:l.z.array(l.z.string()).optional(),created_at:l.z.string()}),x=l.z.object({errors:l.z.array(p),messages:l.z.array(p),success:l.z.boolean(),result:b});l.z.object({errors:l.z.array(p),messages:l.z.array(p),success:l.z.boolean(),result:l.z.array(b)});function S(e){return(0,d.default)(`https://api.cloudflare.com/client/v4/zones/${e.zoneId}`).headers({"X-Auth-Email":e.authEmail,"X-Auth-Key":e.authKey,"Content-Type":`application/json`}).middlewares([(0,f.retry)(),(0,f.dedupe)()])}function C(e){let t={},n={};if(!e)return{sslOverrides:t,rest:n};for(let[r,i]of Object.entries(e))r.startsWith(`ssl.`)?t[r.slice(4)]=i:n[r]=i;return{sslOverrides:t,rest:n}}function w(e){let t=[];if(e.ssl.validation_records)for(let n of e.ssl.validation_records)n.txt_name&&n.txt_value&&t.push({name:`txt`,record:n.txt_value,domain:n.txt_name});if(e.ownership_verification&&t.push({name:`txt`,record:e.ownership_verification.value,domain:e.ownership_verification.name}),e.ownership_verification_http?.http_body&&e.ownership_verification_http?.http_url&&t.push({name:`http`,http_body:e.ownership_verification_http.http_body,http_url:e.ownership_verification_http.http_url}),e.ssl.validation_records)for(let n of e.ssl.validation_records)n.http_body&&n.http_url&&t.push({name:`http`,http_body:n.http_body,http_url:n.http_url});let n={...e.domain_metadata||{},"ssl.method":e.ssl.method,"ssl.type":e.ssl.type,"ssl.certificate_authority":e.ssl.certificate_authority};return{custom_domain_id:e.id,domain:e.hostname,primary:e.primary,status:e.status===`active`?`ready`:`pending`,type:e.type??`auth0_managed_certs`,verification:{methods:l.z.array(c.verificationMethodsSchema).parse(t)},domain_metadata:n}}function ee(e){return{create:async(t,n)=>{let{sslOverrides:r,rest:i}=C(n.domain_metadata),{result:a,errors:o,success:s}=x.parse(await S(e).post({hostname:n.domain,ssl:{method:`txt`,type:`dv`,...r},custom_metadata:e.enterprise?{tenant_id:t}:void 0},`/custom_hostnames`).json());if(!s)throw Error(JSON.stringify(o));let c=w({...a,primary:!1,type:n.type,domain_metadata:i});return await e.customDomainAdapter.create(t,{custom_domain_id:c.custom_domain_id,domain:c.domain,type:c.type,domain_metadata:n.domain_metadata}),await e.customDomainAdapter.update(t,c.custom_domain_id,{status:c.status,primary:c.primary,verification:c.verification}),c},get:async(t,n)=>{let r=await e.customDomainAdapter.get(t,n);if(!r)throw new u.HTTPException(404);let i;try{i=await S(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json()}catch(e){return console.warn(`[custom-domains] CF fetch failed for ${n} (tenant=${t}); returning stale DB row:`,e instanceof Error?e.message:e),r}let a=x.safeParse(i);if(!a.success||!a.data.success)return console.warn(`[custom-domains] CF response unparseable for ${n} (tenant=${t}); returning stale DB row.`,a.success?{cfErrors:a.data.errors}:{zodIssues:a.error.issues,body:i}),r;let{result:o}=a.data;if(e.enterprise&&o.custom_metadata?.tenant_id!==t)throw new u.HTTPException(404);let s;try{s=w({...r,...o})}catch(e){return console.warn(`[custom-domains] mapCustomDomainResponse failed for ${n} (tenant=${t}); returning stale DB row.`,e instanceof Error?e.message:e),r}if(s.status!==r.status||JSON.stringify(s.verification)!==JSON.stringify(r.verification))try{await e.customDomainAdapter.update(t,n,{status:s.status,verification:s.verification})}catch(e){console.warn(`[custom-domains] DB writeback failed for ${n} (tenant=${t}); returning merged response without DB sync.`,e instanceof Error?e.message:e)}return s},getByDomain:async t=>e.customDomainAdapter.getByDomain(t),list:async t=>e.customDomainAdapter.list(t),remove:async(t,n)=>{if(e.enterprise){let{result:r,success:i}=x.parse(await S(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json());if(!i||r.custom_metadata?.tenant_id!==t)throw new u.HTTPException(404)}let r=await S(e).delete(`/custom_hostnames/${encodeURIComponent(n)}`).res();return r.ok&&await e.customDomainAdapter.remove(t,n),r.ok},update:async(t,n,r)=>{let{sslOverrides:i}=C(r.domain_metadata),a={};if(Object.keys(i).length>0){let t;try{t=await S(e).get(`/custom_hostnames/${encodeURIComponent(n)}`).json()}catch(e){throw new u.HTTPException(503,{message:`Failed to fetch current custom hostname state: ${e instanceof Error?e.message:String(e)}`})}let r=x.safeParse(t);if(!r.success||!r.data.success)throw new u.HTTPException(503,{message:`Failed to parse current custom hostname state: ${JSON.stringify(r.success?r.data.errors:r.error.issues)}`});a.ssl={method:r.data.result.ssl.method,type:r.data.result.ssl.type,certificate_authority:r.data.result.ssl.certificate_authority,...i}}if(Object.keys(a).length>0){let t=await S(e).patch(a,`/custom_hostnames/${encodeURIComponent(n)}`).res().catch(e=>{throw new u.HTTPException(503,{message:`Failed to update custom hostname: ${e instanceof Error?e.message:String(e)}`})});if(!t.ok)throw new u.HTTPException(503,{message:await t.text()})}return e.customDomainAdapter.update(t,n,r)},uploadCertificate:async(t,n,r)=>{let i=await e.customDomainAdapter.get(t,n);if(!i)throw new u.HTTPException(404);let a=await S(e).patch({ssl:{custom_certificate:r.certificate,custom_key:r.private_key}},`/custom_hostnames/${encodeURIComponent(n)}`).json(),{result:o,errors:s,success:c}=x.parse(a);if(!c)throw new u.HTTPException(503,{message:JSON.stringify(s)});let l=w({...i,...o});return await e.customDomainAdapter.update(t,n,{status:l.status,verification:l.verification}),l}}}var te=class{config;cache=null;constructor(e){this.config=e}async getCache(){if(this.cache)return this.cache;if(typeof caches>`u`)throw Error(`caches API is not available - CloudflareCache should only be used in Cloudflare Workers`);return this.config.cacheName?this.cache=await caches.open(this.config.cacheName):this.cache=caches.default,this.cache}getKey(e){return this.config.keyPrefix?`${this.config.keyPrefix}:${e}`:e}createRequest(e){return new Request(`https://cache.internal/${this.getKey(e)}`)}async matchWithTimeout(e,t){let n=this.config.getTimeoutMs??200;return n<=0?e.match(t):new Promise(r=>{let i=setTimeout(()=>r(void 0),n);e.match(t).then(e=>{clearTimeout(i),r(e)},()=>{clearTimeout(i),r(void 0)})})}async get(e){try{let t=await this.getCache(),n=this.createRequest(e),r=await this.matchWithTimeout(t,n);if(!r)return null;let i=await r.text();if(!i)return await this.delete(e),null;let a;try{a=JSON.parse(i)}catch{return await this.delete(e),null}return a.expiresAt&&new Date(a.expiresAt)<new Date?(await this.delete(e),null):a.value}catch(t){return console.error(`CloudflareCache: get error for key ${e}:`,t),null}}async set(e,t,n){try{let r=await this.getCache(),i=n??this.config.defaultTtlSeconds,a=i!==void 0,o=a?Math.max(0,i):0,s={value:t,expiresAt:a?new Date(Date.now()+(o>0?o*1e3:-1)).toISOString():void 0,cachedAt:new Date().toISOString()},c=this.createRequest(e),l={"Content-Type":`application/json`};a&&o>0&&(l[`Cache-Control`]=`max-age=${o}`);let u=new Response(JSON.stringify(s),{headers:l});await r.put(c,u)}catch(t){console.error(`CloudflareCache: set error for key ${e}:`,t)}}async delete(e){try{let t=await this.getCache(),n=this.createRequest(e);return await t.delete(n)}catch(t){return console.error(`CloudflareCache: delete error for key ${e}:`,t),!1}}async deleteByPrefix(e){return console.warn(`CloudflareCache.deleteByPrefix() is not implemented - Cloudflare Cache API does not support prefix-based deletion`),0}async clear(){console.warn(`CloudflareCache.clear() is not implemented - Cloudflare Cache API does not support clearing all entries`)}};function ne(e={}){return new te({defaultTtlSeconds:300,keyPrefix:`authhero`,getTimeoutMs:200,...e})}var re=`useandom-26T198340PX75pxJACKVERYMINDBUSHWOLF_GQZbfghjklqvwyzrict`,T=(e=21)=>{let t=``,n=crypto.getRandomValues(new Uint8Array(e|=0));for(;e--;)t+=re[n[e]&63];return t};async function E(e,t){let n=e.timeout||3e4,r=new AbortController,i=setTimeout(()=>r.abort(),n);try{let n=`https://api.sql.cloudflarestorage.com/api/v1/accounts/${e.accountId}/r2-sql/query/${e.warehouseName}`,i=await fetch(n,{method:`POST`,headers:{"Content-Type":`application/json`,Authorization:`Bearer ${e.authToken}`},body:JSON.stringify({query:t}),signal:r.signal});if(!i.ok)throw Error(`R2 SQL query failed: ${i.status} ${i.statusText}`);let a=await i.json();if(!a.success&&a.errors)throw Error(`R2 SQL error: ${a.errors.join(`, `)}`);return a.data||a.result?.data||[]}finally{clearTimeout(i)}}function D(e){return`'${e.replace(/'/g,`''`)}'`}function O(e){return`"${e.replace(/"/g,`""`)}"`}function k(e){let t=e=>{if(!e)return``;try{return JSON.parse(e)}catch{return e}};return{type:e.type,date:e.date,description:e.description,ip:e.ip,user_agent:e.user_agent,details:t(e.details),isMobile:!!e.isMobile,user_id:e.user_id,user_name:e.user_name,connection:e.connection,connection_id:e.connection_id,client_id:e.client_id,client_name:e.client_name,audience:e.audience,scope:e.scope,strategy:e.strategy,strategy_type:e.strategy_type,hostname:e.hostname,auth0_client:t(e.auth0_client),log_id:e.id,location_info:e.country_code||e.city_name||e.latitude||e.longitude||e.time_zone||e.continent_code?{country_code:e.country_code||``,city_name:e.city_name||``,latitude:e.latitude||``,longitude:e.longitude||``,time_zone:e.time_zone||``,continent_code:e.continent_code||``}:void 0}}function ie(e){return async(t,n)=>{let r=n.log_id||T(),i={...n,log_id:r};return await ae(e,t,i),i}}async function ae(e,t,n){let r=e=>e?JSON.stringify(e):void 0,i={id:n.log_id,tenant_id:t,type:n.type,date:n.date,description:n.description?.substring(0,256),ip:n.ip,user_agent:n.user_agent,details:r(n.details)?.substring(0,8192),isMobile:+!!n.isMobile,user_id:n.user_id,user_name:n.user_name,connection:n.connection,connection_id:n.connection_id,client_id:n.client_id,client_name:n.client_name,audience:n.audience,scope:n.scope,strategy:n.strategy,strategy_type:n.strategy_type,hostname:n.hostname,auth0_client:r(n.auth0_client),log_id:n.log_id,country_code:n.location_info?.country_code,city_name:n.location_info?.city_name,latitude:n.location_info?.latitude,longitude:n.location_info?.longitude,time_zone:n.location_info?.time_zone,continent_code:n.location_info?.continent_code};try{if(e.pipelineBinding)await e.pipelineBinding.send([i]);else if(e.pipelineEndpoint){let t=e.timeout||3e4,n=new AbortController,r=setTimeout(()=>n.abort(),t);try{let t=await fetch(e.pipelineEndpoint,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify([i]),signal:n.signal});if(!t.ok)throw Error(`Pipeline ingestion failed: ${t.status} ${t.statusText}`)}finally{clearTimeout(r)}}else throw Error(`Either pipelineEndpoint or pipelineBinding must be configured`)}catch(e){throw console.error(`Failed to send log to Pipeline:`,e),e}}function oe(e){return async(t,n)=>{let r=e.namespace||`default`,i=e.tableName||`logs`,a=await E(e,`
|
|
2
2
|
SELECT * FROM ${O(r)}.${O(i)}
|
|
3
3
|
WHERE tenant_id = ${D(t)}
|
|
4
4
|
AND id = ${D(n)}
|
|
5
5
|
LIMIT 1
|
|
6
|
-
`);if(a.length===0)return null;let o=a[0];return o?k(o):null}}function
|
|
6
|
+
`);if(a.length===0)return null;let o=a[0];return o?k(o):null}}function se(e){let t={},n=/(\w+):(?:"([^"]*)"|(\S+))/g,r;for(;(r=n.exec(e))!==null;){let e=r[1],n=r[2]===void 0?r[3]:r[2];!e||n===void 0||(t[e]=n)}return t}function ce(e){let t=[];for(let[n,r]of Object.entries(e)){let e=n.replace(/[^a-zA-Z0-9_]/g,``);e&&r&&t.push(`${O(e)} = ${D(r)}`)}return t}function le(e){return async(t,n={})=>{let{page:r=0,per_page:i=50,include_totals:a=!1,sort:o,q:s}=n,c=e.namespace||`default`,l=e.tableName||`logs`,u=[`tenant_id = ${D(t)}`];if(s){let e=se(s);u.push(...ce(e))}let d=u.join(` AND `),f=`ORDER BY date DESC`;if(o&&o.sort_by){let e=o.sort_by.replace(/[^a-zA-Z0-9_]/g,``),t=o.sort_order===`asc`?`ASC`:`DESC`;f=`ORDER BY ${O(e)} ${t}`}let p=r*i,m=`LIMIT ${i} OFFSET ${p}`,h=(await E(e,`
|
|
7
7
|
SELECT * FROM ${O(c)}.${O(l)}
|
|
8
8
|
WHERE ${d}
|
|
9
9
|
${f}
|
|
@@ -11,59 +11,59 @@ Object.defineProperties(exports,{__esModule:{value:!0},[Symbol.toStringTag]:{val
|
|
|
11
11
|
`)).map(k);if(!a)return{logs:h,start:0,limit:0,length:0};let g=(await E(e,`
|
|
12
12
|
SELECT COUNT(*) as count FROM ${O(c)}.${O(l)}
|
|
13
13
|
WHERE ${d}
|
|
14
|
-
`))[0]?.count||0;return{logs:h,start:p,limit:i,length:Number(g)}}}function
|
|
14
|
+
`))[0]?.count||0;return{logs:h,start:p,limit:i,length:Number(g)}}}function ue(){return{async getDaily(){throw Error(`Stats queries are not supported by R2 SQL logs adapter. Use Analytics Engine or Kysely adapter instead.`)},async getActiveUsers(){throw Error(`Stats queries are not supported by R2 SQL logs adapter. Use Analytics Engine or Kysely adapter instead.`)}}}function A(e){let t=!!e.pipelineEndpoint,n=!!e.pipelineBinding;if(!t&&!n)throw Error(`R2 SQL logs adapter requires one of: "pipelineEndpoint" or "pipelineBinding"`);if(!e.authToken)throw Error(`R2 SQL logs adapter requires "authToken" configuration`);if(!e.warehouseName)throw Error(`R2 SQL logs adapter requires "warehouseName" configuration`);return{create:ie(e),list:le(e),get:oe(e)}}async function j(e,t){let n=e.timeout||3e4,r=new AbortController,i=setTimeout(()=>r.abort(),n);try{let n=`https://api.cloudflare.com/client/v4/accounts/${e.accountId}/analytics_engine/sql`,i=await fetch(n,{method:`POST`,headers:{"Content-Type":`text/plain`,Authorization:`Bearer ${e.apiToken}`},body:t,signal:r.signal});if(!i.ok){let e=await i.text();throw Error(`Analytics Engine query failed: ${i.status} ${i.statusText} - ${e}`)}let a=await i.json();if(!a.success&&a.errors&&a.errors.length>0)throw Error(`Analytics Engine error: ${a.errors.map(e=>e.message).join(`, `)}`);return a.data||[]}finally{clearTimeout(i)}}function M(e){return`'${e.replace(/'/g,`''`).replace(/\\/g,`\\\\`)}'`}function N(e){return`"${e.replace(/"/g,`""`)}"`}function P(e){let t=e=>{if(e)try{return JSON.parse(e)}catch{return}},n=e.double2||e.timestamp,r=n?new Date(n).toISOString():``;return{log_id:e.blob1,type:e.blob3,date:r,description:e.blob4,ip:e.blob5,user_agent:e.blob6,user_id:e.blob7,user_name:e.blob8,connection:e.blob9,connection_id:e.blob10,client_id:e.blob11,client_name:e.blob12,audience:e.blob13,scope:e.blob14,strategy:e.blob15,strategy_type:e.blob16,hostname:e.blob17,details:t(e.blob18),auth0_client:t(e.blob19),location_info:t(e.blob20),isMobile:e.double1===1}}function de(e){return async(t,n)=>{let r=n.log_id||T(),i={...n,log_id:r};return fe(e,t,i),i}}function fe(e,t,n){if(!e.analyticsEngineBinding){console.error(`Analytics Engine binding not configured`);return}let r=e=>e==null?``:typeof e==`string`?e:JSON.stringify(e),i=(e,t=1024)=>e.substring(0,t);try{e.analyticsEngineBinding.writeDataPoint({blobs:[i(n.log_id),i(t),i(n.type||``),i(n.description||``),i(n.ip||``),i(n.user_agent||``),i(n.user_id||``),i(n.user_name||``),i(n.connection||``),i(n.connection_id||``),i(n.client_id||``),i(n.client_name||``),i(n.audience||``),i(n.scope||``),i(n.strategy||``),i(n.strategy_type||``),i(n.hostname||``),i(r(n.details)),i(r(n.auth0_client)),i(r(n.location_info))],doubles:[+!!n.isMobile,new Date(n.date).getTime()],indexes:[t.substring(0,96)]})}catch(e){console.error(`Failed to write log to Analytics Engine:`,e)}}function pe(e){return async(t,n)=>{let r=await j(e,`
|
|
15
15
|
SELECT *
|
|
16
|
-
FROM ${
|
|
17
|
-
WHERE index1 = ${
|
|
18
|
-
AND blob1 = ${
|
|
16
|
+
FROM ${N(e.dataset||`authhero_logs`)}
|
|
17
|
+
WHERE index1 = ${M(t)}
|
|
18
|
+
AND blob1 = ${M(n)}
|
|
19
19
|
LIMIT 1
|
|
20
|
-
`);return r.length===0||!r[0]?null:
|
|
20
|
+
`);return r.length===0||!r[0]?null:P(r[0])}}function me(e){let t={},n=/(\w+):(?:"([^"]*)"|(\S+))/g,r;for(;(r=n.exec(e))!==null;){let e=r[1],n=r[2]===void 0?r[3]:r[2];!e||n===void 0||(t[e]||(t[e]=[]),t[e].push(n))}return t}function F(e){return{log_id:`blob1`,tenant_id:`blob2`,type:`blob3`,description:`blob4`,ip:`blob5`,user_agent:`blob6`,user_id:`blob7`,user_name:`blob8`,connection:`blob9`,connection_id:`blob10`,client_id:`blob11`,client_name:`blob12`,audience:`blob13`,scope:`blob14`,strategy:`blob15`,strategy_type:`blob16`,hostname:`blob17`}[e]||null}function he(e){let t=[];for(let[n,r]of Object.entries(e)){let e=r.filter(e=>e!==``);if(e.length===0)continue;if(n===`success`){let n=[],r=new Set;for(let t of e)r.has(t)||(r.add(t),t===`true`?n.push(`blob3 LIKE 's%'`):t===`false`&&n.push(`blob3 LIKE 'f%'`));n.length>0&&t.push(`(${n.join(` OR `)})`);continue}let i=F(n);if(i)if(e.length===1)t.push(`${i} = ${M(e[0])}`);else{let n=e.map(e=>M(e)).join(`, `);t.push(`${i} IN (${n})`)}}return t}function ge(e){return e===`date`?`double2`:F(e)||`timestamp`}function _e(e){return async(t,n={})=>{let{page:r=0,per_page:i=50,include_totals:a=!1,sort:o,q:s,from_date:c,to_date:l}=n,u=e.dataset||`authhero_logs`,d=[`index1 = ${M(t)}`];if(s){let e=me(s);d.push(...he(e))}typeof c==`number`&&Number.isFinite(c)&&d.push(`double2 >= ${Math.floor(c)*1e3}`),typeof l==`number`&&Number.isFinite(l)&&d.push(`double2 <= ${Math.floor(l)*1e3}`);let f=d.join(` AND `),p=`ORDER BY timestamp DESC`;o&&o.sort_by&&(p=`ORDER BY ${ge(o.sort_by)} ${o.sort_order===`asc`?`ASC`:`DESC`}`);let m=r*i,h=`LIMIT ${i} OFFSET ${m}`,g=(await j(e,`
|
|
21
21
|
SELECT *
|
|
22
|
-
FROM ${
|
|
22
|
+
FROM ${N(u)}
|
|
23
23
|
WHERE ${f}
|
|
24
24
|
${p}
|
|
25
25
|
${h}
|
|
26
|
-
`)).map(
|
|
26
|
+
`)).map(P);if(!a)return{logs:g,start:0,limit:0,length:0};let _=`
|
|
27
27
|
SELECT count() as count
|
|
28
|
-
FROM ${
|
|
28
|
+
FROM ${N(u)}
|
|
29
29
|
WHERE ${f}
|
|
30
|
-
`;try{let t=(await
|
|
30
|
+
`;try{let t=(await j(e,_))[0]?.count||0;return{logs:g,start:m,limit:i,length:Number(t)}}catch{return{logs:g,start:m,limit:i,length:g.length}}}}var I=[`s`],ve=[`pwd_leak`];function L(e){return`${e.slice(0,4)}-${e.slice(4,6)}-${e.slice(6,8)}`}function R(e){return e.toISOString().split(`T`)[0]}function ye(e){let t=e.dataset||`authhero_logs`;return{async getDaily(n,r={}){let{from:i,to:a}=r,o=new Date,s=new Date(o);s.setDate(s.getDate()-30);let c=i?L(i):R(s),l=a?L(a):R(o),u=new Date(`${c}T00:00:00Z`).getTime(),d=new Date(`${l}T23:59:59.999Z`).getTime();return(await j(e,`
|
|
31
31
|
SELECT
|
|
32
32
|
toDate(toDateTime(double2 / 1000)) AS date,
|
|
33
|
-
SUM(CASE WHEN blob3 IN (${
|
|
33
|
+
SUM(CASE WHEN blob3 IN (${I.map(e=>M(e)).join(`, `)}) THEN 1 ELSE 0 END) AS logins,
|
|
34
34
|
SUM(CASE WHEN blob3 = 'ss' THEN 1 ELSE 0 END) AS signups,
|
|
35
|
-
SUM(CASE WHEN blob3 IN (${
|
|
35
|
+
SUM(CASE WHEN blob3 IN (${ve.map(e=>M(e)).join(`, `)}) THEN 1 ELSE 0 END) AS leaked_passwords,
|
|
36
36
|
MIN(double2) AS first_event,
|
|
37
37
|
MAX(double2) AS last_event
|
|
38
38
|
FROM "${t}"
|
|
39
|
-
WHERE index1 = ${
|
|
39
|
+
WHERE index1 = ${M(n)}
|
|
40
40
|
AND double2 >= ${u}
|
|
41
41
|
AND double2 <= ${d}
|
|
42
42
|
GROUP BY date
|
|
43
43
|
ORDER BY date ASC
|
|
44
|
-
`)).map(e=>({date:String(e.date),logins:Number(e.logins)||0,signups:Number(e.signups)||0,leaked_passwords:Number(e.leaked_passwords)||0,created_at:e.first_event?new Date(Number(e.first_event)).toISOString():new Date().toISOString(),updated_at:e.last_event?new Date(Number(e.last_event)).toISOString():new Date().toISOString()}))},async getActiveUsers(n){let r=new Date;r.setDate(r.getDate()-30);let i=r.getTime(),a=
|
|
44
|
+
`)).map(e=>({date:String(e.date),logins:Number(e.logins)||0,signups:Number(e.signups)||0,leaked_passwords:Number(e.leaked_passwords)||0,created_at:e.first_event?new Date(Number(e.first_event)).toISOString():new Date().toISOString(),updated_at:e.last_event?new Date(Number(e.last_event)).toISOString():new Date().toISOString()}))},async getActiveUsers(n){let r=new Date;r.setDate(r.getDate()-30);let i=r.getTime(),a=I.map(e=>M(e)).join(`, `),o=(await j(e,`
|
|
45
45
|
SELECT COUNT(DISTINCT blob7) AS count
|
|
46
46
|
FROM "${t}"
|
|
47
|
-
WHERE index1 = ${
|
|
47
|
+
WHERE index1 = ${M(n)}
|
|
48
48
|
AND double2 >= ${i}
|
|
49
49
|
AND blob3 IN (${a})
|
|
50
50
|
AND blob7 IS NOT NULL
|
|
51
51
|
AND blob7 != ''
|
|
52
|
-
`))[0];return o&&o.count!==void 0&&Number(o.count)||0}}}var
|
|
52
|
+
`))[0];return o&&o.count!==void 0&&Number(o.count)||0}}}var be={"active-users":[`s`,`seacft`],logins:[`s`,`f`,`fp`],signups:[`ss`,`fs`],"refresh-tokens":[`seacft`,`fertft`],sessions:[`slo`]},xe={connection:`blob9`,client_id:`blob11`,user_type:`blob16`,event:`blob3`},Se={connection:`blob9`,client_id:`blob11`,user_type:`blob16`,user_id:`blob7`},Ce={"active-users":{expr:`count(DISTINCT blob7)`,alias:`active_users`,type:`UInt64`},logins:{expr:`count()`,alias:`logins`,type:`UInt64`},signups:{expr:`count()`,alias:`signups`,type:`UInt64`},"refresh-tokens":{expr:`count()`,alias:`refresh_tokens`,type:`UInt64`},sessions:{expr:`count()`,alias:`sessions`,type:`UInt64`}};function we(e,t){let n=`toDateTime(intDiv(double2, 1000), ${M(t)})`;switch(e){case`hour`:return`toStartOfHour(${n})`;case`week`:return`toStartOfWeek(${n})`;case`month`:return`toStartOfMonth(${n})`;default:return`toStartOfDay(${n})`}}function Te(e){return e===`hour`?`DateTime`:`Date`}function Ee(e,t,n){let r=new Date(e.from).getTime(),i=new Date(e.to).getTime(),a=n.map(e=>M(e)).join(`, `),o=[`index1 = ${M(t)}`,`double2 >= ${r}`,`double2 < ${i}`,`blob3 IN (${a})`];for(let[t,n]of Object.entries(Se)){let r=e.filters[t];if(r&&r.length>0){let e=r.map(e=>M(e)).join(`, `);o.push(`${n} IN (${e})`)}}return o.join(` AND `)}function De(e,t,n){if(e.order_by){let t=e.order_by.startsWith(`-`);return`${N(t?e.order_by.slice(1):e.order_by)} ${t?`DESC`:`ASC`}`}return t.length>0&&t[0]===`time`?`${N(`time`)} ASC`:`${N(n)} DESC`}function z(e){let t=e.dataset||`authhero_logs`;return{async query(n,r,i){let a=be[r],o=Ce[r],s=[],c=[];for(let e of i.group_by)if(e===`time`){let e=we(i.interval,i.tz);s.push(`${e} AS ${N(`time`)}`),c.push({name:`time`,type:Te(i.interval)})}else{let t=xe[e];s.push(`${t} AS ${N(e)}`),c.push({name:e,type:`String`})}c.push({name:o.alias,type:o.type});let l=[...s,`${o.expr} AS ${N(o.alias)}`],u=i.group_by.length?`GROUP BY ${i.group_by.map(e=>N(e===`time`?`time`:e)).join(`, `)}`:``,d=De(i,i.group_by.map(e=>e===`time`?`time`:e),o.alias),f=`
|
|
53
53
|
SELECT ${l.join(`, `)}
|
|
54
|
-
FROM ${
|
|
55
|
-
WHERE ${
|
|
54
|
+
FROM ${N(t)}
|
|
55
|
+
WHERE ${Ee(i,n,a)}
|
|
56
56
|
${u}
|
|
57
57
|
ORDER BY ${d}
|
|
58
58
|
LIMIT ${Math.max(0,i.limit)} OFFSET ${Math.max(0,i.offset)}
|
|
59
59
|
FORMAT JSON
|
|
60
|
-
`,p=`https://api.cloudflare.com/client/v4/accounts/${e.accountId}/analytics_engine/sql`,m=e.timeout||3e4,h=new AbortController,g=setTimeout(()=>h.abort(),m),_=Date.now();try{let t=await fetch(p,{method:`POST`,headers:{"Content-Type":`text/plain`,Authorization:`Bearer ${e.apiToken}`},body:f,signal:h.signal});if(!t.ok){let e=await t.text();throw Error(`Analytics Engine query failed: ${t.status} ${t.statusText} - ${e}`)}let n=await t.json();if(n.success===!1&&n.errors?.length)throw Error(`Analytics Engine error: ${n.errors.map(e=>e.message).join(`, `)}`);let r=n.data??[];return{meta:n.meta??c,data:r,rows:n.rows??r.length,rows_before_limit_at_least:n.rows_before_limit_at_least??r.length,statistics:{elapsed:(Date.now()-_)/1e3}}}finally{clearTimeout(g)}}}}function
|
|
60
|
+
`,p=`https://api.cloudflare.com/client/v4/accounts/${e.accountId}/analytics_engine/sql`,m=e.timeout||3e4,h=new AbortController,g=setTimeout(()=>h.abort(),m),_=Date.now();try{let t=await fetch(p,{method:`POST`,headers:{"Content-Type":`text/plain`,Authorization:`Bearer ${e.apiToken}`},body:f,signal:h.signal});if(!t.ok){let e=await t.text();throw Error(`Analytics Engine query failed: ${t.status} ${t.statusText} - ${e}`)}let n=await t.json();if(n.success===!1&&n.errors?.length)throw Error(`Analytics Engine error: ${n.errors.map(e=>e.message).join(`, `)}`);let r=n.data??[];return{meta:n.meta??c,data:r,rows:n.rows??r.length,rows_before_limit_at_least:n.rows_before_limit_at_least??r.length,statistics:{elapsed:(Date.now()-_)/1e3}}}finally{clearTimeout(g)}}}}function B(e){return e.analyticsEngineBinding||console.warn(`Analytics Engine: No binding configured. Logs will not be written to Analytics Engine.`),(!e.accountId||!e.apiToken)&&console.warn(`Analytics Engine: accountId and apiToken are required for querying logs via SQL API.`),{create:de(e),list:_e(e),get:pe(e)}}var Oe=`authhero_action_executions`,ke=1024,Ae=`[truncated]`;function V(e){if(!(typeof e!=`string`||e.length===0))try{return JSON.parse(e)}catch{return}}function je(e){let t=c.actionExecutionStatusSchema.safeParse(e);return t.success?t.data:`unspecified`}function H(e,t=ke){return e.length<=t?e:`${e.substring(0,t-11)}${Ae}`}function U(e){return e==null?``:JSON.stringify(e)}function Me(e){let t=typeof e.blob6==`string`&&e.blob6.length>0?e.blob6:typeof e.double1==`number`?new Date(e.double1).toISOString():``,n=typeof e.blob7==`string`&&e.blob7.length>0?e.blob7:t;return{id:typeof e.blob1==`string`?e.blob1:``,tenant_id:typeof e.index1==`string`?e.index1:``,trigger_id:typeof e.blob2==`string`?e.blob2:``,status:je(e.blob3),results:V(e.blob4)??[],logs:V(e.blob5),created_at:t,updated_at:n}}function Ne(e){return async(t,n)=>{let r=Date.now(),i=new Date(r).toISOString(),a={id:n.id,tenant_id:t,trigger_id:n.trigger_id,status:n.status,results:n.results,logs:n.logs,created_at:i,updated_at:i};return Pe(e,t,a,r),a}}function Pe(e,t,n,r){if(!e.analyticsEngineBinding){console.error(`Analytics Engine action_executions binding not configured; skipping write`);return}try{e.analyticsEngineBinding.writeDataPoint({blobs:[H(n.id),H(n.trigger_id),H(n.status),H(U(n.results)),H(U(n.logs)),H(n.created_at),H(n.updated_at)],doubles:[r],indexes:[t.substring(0,96)]})}catch(e){console.error(`Failed to write action_execution to Analytics Engine:`,e)}}function Fe(e){return async(t,n)=>{let r=await j(e,`
|
|
61
61
|
SELECT *
|
|
62
|
-
FROM ${
|
|
63
|
-
WHERE index1 = ${
|
|
64
|
-
AND blob1 = ${
|
|
62
|
+
FROM ${N(e.dataset||Oe)}
|
|
63
|
+
WHERE index1 = ${M(t)}
|
|
64
|
+
AND blob1 = ${M(n)}
|
|
65
65
|
LIMIT 1
|
|
66
|
-
`);return r.length===0||!r[0]?null:
|
|
66
|
+
`);return r.length===0||!r[0]?null:Me(r[0])}}function W(e){return e.analyticsEngineBinding||console.warn(`Analytics Engine: No action_executions binding configured. Executions will not be written.`),(!e.accountId||!e.apiToken)&&console.warn(`Analytics Engine: accountId and apiToken are required to read action_executions via the SQL API.`),{create:Ne(e),get:Fe(e)}}function Ie(){return{async getGeoInfo(e){try{let t=e[`cf-ipcountry`],n=e[`cf-ipcity`],r=e[`cf-iplatitude`],i=e[`cf-iplongitude`],a=e[`cf-timezone`],o=e[`cf-ipcontinent`];return t?{country_code:t,city_name:n||``,latitude:r||``,longitude:i||``,time_zone:a||``,continent_code:o||``}:null}catch(e){return console.warn(`Failed to get geo info from Cloudflare headers:`,e),null}}}}var Le=class{bindings;constructor(e){this.bindings=e}async consume(e,t){let n=this.bindings[e];if(!n)return{allowed:!0};try{let{success:e}=await n.limit({key:t});return{allowed:e}}catch(t){return console.error(`CloudflareRateLimit: limit() error for scope ${e}:`,t),{allowed:!0}}}};function G(e){if(e&&Object.keys(e).some(t=>e[t]))return new Le(e)}function K(e){return`// Auto-generated AuthHero code hook worker
|
|
67
67
|
|
|
68
68
|
const fnNames = {
|
|
69
69
|
"post-user-login": "onExecutePostLogin",
|
|
@@ -166,9 +166,9 @@ export default {
|
|
|
166
166
|
}
|
|
167
167
|
},
|
|
168
168
|
};
|
|
169
|
-
`}var
|
|
170
|
-
const TRIGGER_FN_NAMES = ${JSON.stringify(
|
|
171
|
-
const API_SHAPES = ${JSON.stringify(
|
|
169
|
+
`}var q=class{config;constructor(e){this.config=e}async execute(e){let t=Date.now();if(!e.hookCodeId)return{success:!1,error:`DispatchNamespaceCodeExecutor requires hookCodeId`,durationMs:Date.now()-t,apiCalls:[]};let n=`hook-${e.hookCodeId}`,r=JSON.stringify({triggerId:e.triggerId,event:e.event});try{let i;if(this.config.dispatcher)i=await this.config.dispatcher.get(n,{},{limits:{cpuMs:e.cpuLimitMs??5e3}}).fetch(new Request(`https://hook.internal/execute`,{method:`POST`,headers:{"Content-Type":`application/json`},body:r}));else if(this.config.dispatchUrl)i=await fetch(`${this.config.dispatchUrl}/${n}`,{method:`POST`,headers:{"Content-Type":`application/json`,Authorization:`Bearer ${this.config.apiToken}`},body:r});else return{success:!1,error:`No dispatcher binding or dispatchUrl configured`,durationMs:Date.now()-t,apiCalls:[]};if(!i.ok){let e=await i.text();return{success:!1,error:`Worker invocation failed (${i.status}): ${e}`,durationMs:Date.now()-t,apiCalls:[]}}return{...await i.json(),durationMs:Date.now()-t}}catch(e){return{success:!1,error:e instanceof Error?e.message:String(e),durationMs:Date.now()-t,apiCalls:[]}}}async deploy(e,t){let n=`hook-${e}`,r=K(t),i=`https://api.cloudflare.com/client/v4/accounts/${this.config.accountId}/workers/dispatch/namespaces/${this.config.dispatchNamespace}/scripts/${n}`,a=JSON.stringify({main_module:`index.js`,compatibility_date:this.config.compatibilityDate??`2024-11-20`}),o=new FormData;o.append(`metadata`,new Blob([a],{type:`application/json`})),o.append(`index.js`,new Blob([r],{type:`application/javascript+module`}),`index.js`);let s=await fetch(i,{method:`PUT`,headers:{Authorization:`Bearer ${this.config.apiToken}`},body:o});if(!s.ok){let e=await s.text();throw Error(`Failed to deploy hook worker ${n}: ${s.status} ${e}`)}}async remove(e){let t=`hook-${e}`,n=`https://api.cloudflare.com/client/v4/accounts/${this.config.accountId}/workers/dispatch/namespaces/${this.config.dispatchNamespace}/scripts/${t}`,r=await fetch(n,{method:`DELETE`,headers:{Authorization:`Bearer ${this.config.apiToken}`}});if(!r.ok&&r.status!==404){let e=await r.text();throw Error(`Failed to remove hook worker ${t}: ${r.status} ${e}`)}}},Re=q,ze={"post-user-login":`onExecutePostLogin`,"credentials-exchange":`onExecuteCredentialsExchange`,"pre-user-registration":`onExecutePreUserRegistration`,"post-user-registration":`onExecutePostUserRegistration`},Be={"post-user-login":{accessToken:[`setCustomClaim`],idToken:[`setCustomClaim`],access:[`deny`],prompt:[`render`],redirect:[`sendUserTo`]},"credentials-exchange":{accessToken:[`setCustomClaim`],idToken:[`setCustomClaim`],access:[`deny`]},"pre-user-registration":{user:[`setUserMetadata`,`setLinkedTo`],access:[`deny`]},"post-user-registration":{}};async function Ve(e){let t=new TextEncoder().encode(e),n=await crypto.subtle.digest(`SHA-256`,t),r=new Uint8Array(n),i=``;for(let e of r)i+=e.toString(16).padStart(2,`0`);return i}function He(e){return`
|
|
170
|
+
const TRIGGER_FN_NAMES = ${JSON.stringify(ze)};
|
|
171
|
+
const API_SHAPES = ${JSON.stringify(Be)};
|
|
172
172
|
const MAX_LOG_ENTRIES = 50;
|
|
173
173
|
const MAX_LOG_LENGTH = 500;
|
|
174
174
|
|
|
@@ -266,4 +266,4 @@ export default {
|
|
|
266
266
|
}
|
|
267
267
|
},
|
|
268
268
|
};
|
|
269
|
-
`}var He=class{loader;compatibilityDate;constructor(e){this.loader=e.loader,this.compatibilityDate=e.compatibilityDate||`2025-01-01`}async execute(e){let t=Date.now();try{let t=Ve(e.code),n={compatibilityDate:this.compatibilityDate,mainModule:`hook.js`,modules:{"hook.js":t}},r=e.hookCodeId?`${e.hookCodeId}-${await Be(e.code)}`:null;return await(await(r?this.loader.get(r,async()=>n):this.loader.load(n)).getEntrypoint().fetch(new Request(`https://hook/execute`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({event:e.event,triggerId:e.triggerId})}))).json()}catch(e){return{success:!1,error:e instanceof Error?e.message:String(e),durationMs:Date.now()-t,apiCalls:[]}}}},Y=class extends Error{status;endpoint;errors;body;constructor(e,t,n,r=[]){super(`Cloudflare API ${e} ${t}: ${Ue(n,256)}`),this.name=`CloudflareApiError`,this.status=e,this.endpoint=t,this.body=n,this.errors=r}};function Ue(e,t){return e.length<=t?e:`${e.slice(0,t)}…`}var X=class{accountId;apiToken;fetchImpl;timeoutMs;baseUrl;constructor(e){this.accountId=e.accountId,this.apiToken=e.apiToken,this.fetchImpl=e.fetch??((...e)=>fetch(...e)),this.timeoutMs=e.timeoutMs??3e4,this.baseUrl=(e.baseUrl??`https://api.cloudflare.com/client/v4`).replace(/\/+$/,``)}async createD1Database(e){let t=`/accounts/${encodeURIComponent(this.accountId)}/d1/database`;return(await this.request(`POST`,t,{body:JSON.stringify({name:e})})).result}async listD1Databases(e){let t=e?`?name=${encodeURIComponent(e)}`:``,n=`/accounts/${encodeURIComponent(this.accountId)}/d1/database${t}`;return(await this.request(`GET`,n)).result??[]}async deleteD1Database(e){let t=`/accounts/${encodeURIComponent(this.accountId)}/d1/database/${encodeURIComponent(e)}`;await this.request(`DELETE`,t)}async execD1(e,t){let n=`/accounts/${encodeURIComponent(this.accountId)}/d1/database/${encodeURIComponent(e)}/query`;return(await this.request(`POST`,n,{body:JSON.stringify({sql:t})})).result??[]}async uploadNamespacedScript(e,t,n){let r=`/accounts/${this.accountId}/workers/dispatch/namespaces/${encodeURIComponent(e)}/scripts/${encodeURIComponent(t)}`,i={main_module:n.mainModule,compatibility_date:n.compatibilityDate,compatibility_flags:n.compatibilityFlags??[],bindings:n.bindings??[],tags:n.tags},a=new FormData;a.append(`metadata`,new Blob([JSON.stringify(i)],{type:`application/json`})),a.append(n.mainModule,new Blob([n.script],{type:`application/javascript+module`}),n.mainModule),await this.request(`PUT`,r,{body:a})}async deleteNamespacedScript(e,t){let n=`/accounts/${this.accountId}/workers/dispatch/namespaces/${encodeURIComponent(e)}/scripts/${encodeURIComponent(t)}`;await this.request(`DELETE`,n)}async setNamespacedScriptSecret(e,t,n,r){let i=`/accounts/${this.accountId}/workers/dispatch/namespaces/${encodeURIComponent(e)}/scripts/${encodeURIComponent(t)}/secrets`;await this.request(`PUT`,i,{body:JSON.stringify({name:n,text:r,type:`secret_text`})})}async request(e,t,n){let r=`${this.baseUrl}${t}`,i=new AbortController,a=setTimeout(()=>i.abort(),this.timeoutMs),o={Authorization:`Bearer ${this.apiToken}`,...n?.headers??{}};n?.body&&!(n.body instanceof FormData)&&!o[`Content-Type`]&&(o[`Content-Type`]=`application/json`);let s;try{s=await this.fetchImpl(r,{method:e,headers:o,body:n?.body,signal:i.signal})}finally{clearTimeout(a)}let c=await s.text();if(!s.ok){let e=[];try{let t=JSON.parse(c);Array.isArray(t.errors)&&(e=t.errors)}catch{}throw new Y(s.status,t,c,e)}if(!(c===``||s.status===204))return JSON.parse(c)}},We=`{tenant_id}`,Ge=`tenant-{tenant_id}`,Ke=`index.js`,qe=`2026-05-01`;function Z(e,t){return e.replace(/\{tenant_id\}/g,t)}function Je(e){if(!(e instanceof Y))return!1;let t=e.body.toLowerCase();return e.status===409||t.includes(`already exists`)||t.includes(`name is already taken`)||t.includes(`already in use`)}function Q(e){return e instanceof Y?e.status===404:!1}function $(e){let t=new X({accountId:e.accountId,apiToken:e.apiToken,fetch:e.fetch,timeoutMs:e.timeoutMs}),n=e.scriptNameTemplate??We,r=e.d1NameTemplate??Ge,i=e.scriptMetadata?.main_module??Ke,a=e.scriptMetadata?.compatibility_date??qe,o=e.scriptMetadata?.compatibility_flags??[`nodejs_compat`],s=e.dispatchNamespace,c=e.logger;async function l(e){let n=(await t.listD1Databases(e)).find(t=>t.name===e);if(n)return{id:n.uuid,created:!1};try{return{id:(await t.createD1Database(e)).uuid,created:!0}}catch(n){if(!Je(n))throw n;let r=(await t.listD1Databases(e)).find(t=>t.name===e);if(r)return{id:r.uuid,created:!1};throw n}}let u=`_authhero_provisioner_migrations`;function d(e,t){let n=[];for(let r of e)for(let e of r.results??[])if(e&&typeof e==`object`&&t in e){let r=e[t];typeof r==`string`&&n.push(r)}return n}async function f(e){return d(await t.execD1(e,`SELECT name FROM sqlite_master WHERE type='table' AND name='${u}';`),`name`).length>0}async function p(e){await t.execD1(e,`CREATE TABLE IF NOT EXISTS ${u} (name TEXT PRIMARY KEY, applied_at TEXT NOT NULL);`)}async function m(e){let n=await t.execD1(e,`SELECT name FROM ${u};`);return new Set(d(n,`name`))}function h(e){return e.replace(/'/g,`''`)}async function g(e,n){let r=new Date().toISOString();await t.execD1(e,`INSERT OR IGNORE INTO ${u} (name, applied_at) VALUES ('${h(n)}', '${h(r)}');`)}async function _(n){let r=await m(n);for(let i of e.migrations)if(!r.has(i.name)){try{await t.execD1(n,i.sql)}catch(e){throw e instanceof Error?Error(`Failed to apply migration "${i.name}" to D1 ${n}: ${e.message}`,{cause:e}):e}await g(n,i.name)}}async function v(n,r){let c=[{type:`d1`,name:`AUTH_DB`,id:r},{type:`plain_text`,name:`CONTROL_PLANE_BASE_URL`,text:e.controlPlaneBaseUrl},...e.extraBindings??[]];await t.uploadNamespacedScript(s,n,{script:e.tenantWorkerScript,mainModule:i,compatibilityDate:a,compatibilityFlags:o,bindings:c,tags:[`authhero-tenant`,`tenant:${n}`]})}async function y(n,r){let i=await e.secrets(r);for(let[e,r]of Object.entries(i))await t.setNamespacedScriptSecret(s,n,e,r)}return{async onProvision(t){let i=Z(n,t),a=Z(r,t),{id:o,created:s}=await l(a),u=s?!1:await f(o);if(s||u)await p(o),await _(o);else{c?.warn(`D1 "${a}" has no migration-tracking table — assuming it predates tracking and is fully migrated; backfilling the tracking table and skipping migrations.`),await p(o);for(let t of e.migrations)await g(o,t.name)}return await v(i,o),await y(i,t),{d1DatabaseId:o,scriptName:i,d1Name:a}},async onDeprovision(e){let i=Z(n,e),a=Z(r,e),o=[];try{await t.deleteNamespacedScript(s,i)}catch(e){Q(e)||o.push(e)}try{let e=(await t.listD1Databases(a)).find(e=>e.name===a);if(e)try{await t.deleteD1Database(e.uuid)}catch(e){Q(e)||o.push(e)}}catch(e){o.push(e)}if(o.length>0){let t=o.map(e=>e instanceof Error?e.message:String(e)).join(`; `);throw Error(`Deprovision of tenant "${e}" had ${o.length} failure(s): ${t}`,{cause:o[0]})}}}}function Ye(e){return e.deployment_type===`wfp`}function Xe(e){if(typeof e!=`object`||!e)return[];let t=[];for(let n of Object.values(e))if(typeof n==`object`&&n&&`errors`in n&&Array.isArray(n.errors))for(let e of n.errors)typeof e==`string`&&t.push(e);return t}function Ze(e){let{provisioner:t,tenants:n,syncDefaults:r}=e,i=e.shouldProvision??Ye,a=e.logger;async function o(e,t){let r=t instanceof Error?t.message:String(t);try{await n.update(e,{provisioning_state:`failed`,provisioning_error:r.slice(0,2048),provisioning_state_changed_at:new Date().toISOString()})}catch(t){a?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`,t)}}return{async onProvision(e){let s=await n.get(e);if(!s||!i(s))return;let c;try{c=await t.onProvision(e)}catch(t){throw await o(e,t),t}let l={d1_database_id:c.d1DatabaseId,worker_script_name:c.scriptName};try{if(r){let t=Xe(await r(e));if(t.length>0)throw Error(`sync-defaults seed reported ${t.length} error(s): ${t.join(`; `)}`)}}catch(t){let r=t instanceof Error?t.message:String(t);try{await n.update(e,{...l,provisioning_state:`failed`,provisioning_error:r.slice(0,2048),provisioning_state_changed_at:new Date().toISOString()})}catch(t){a?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`,t)}throw t}await n.update(e,{...l,provisioning_state:`ready`,provisioning_error:void 0,provisioning_state_changed_at:new Date().toISOString()})},async onDeprovision(e){let r=await n.get(e);r&&!i(r)||await t.onDeprovision(e)}}}var Qe=`DISPATCHER`,$e=`tenant-{tenant_id}-auth`;function et(e){return typeof e==`object`&&!!e&&`get`in e&&typeof Reflect.get(e,`get`)==`function`}function tt(e,t){return e.replace(/\{tenant_id\}/g,t)}function nt(e){let{tenants:t,controlPlaneTenantId:n,dispatcherBinding:r=Qe,scriptNameTemplate:i=$e,resolveTenantId:a=e=>e.req.header(`tenant-id`)}=e;return async(e,o)=>{let s=await a(e);if(!s||s===n)return o();let c=await t.get(s);if(!c||c.deployment_type!==`wfp`||c.provisioning_state&&c.provisioning_state!==`ready`)return o();let l=Reflect.get(e.env??{},r);if(!et(l))return o();let u=tt(i,s);return l.get(u).fetch(e.req.raw)}}function rt(e){let t={customDomains:ee(e),cache:ne({...e.cacheName&&{cacheName:e.cacheName},...e.defaultTtlSeconds!==void 0&&{defaultTtlSeconds:e.defaultTtlSeconds},...e.keyPrefix&&{keyPrefix:e.keyPrefix}}),geo:Fe()};e.r2SqlLogs?t.logs=j(e.r2SqlLogs):e.analyticsEngineLogs&&(t.logs=V(e.analyticsEngineLogs)),e.analyticsEngineLogs&&(t.analytics=B(e.analyticsEngineLogs)),e.analyticsEngineActionExecutions&&(t.actionExecutions=G(e.analyticsEngineActionExecutions));let n=K(e.rateLimitBindings);return n&&(t.rateLimit=n),t}exports.CloudflareApiClient=X,exports.CloudflareApiError=Y,exports.CloudflareCodeExecutor=Le,exports.DispatchNamespaceCodeExecutor=J,exports.WorkerLoaderCodeExecutor=He,exports.createAnalyticsEngineActionExecutionsAdapter=G,exports.createAnalyticsEngineAnalyticsAdapter=B,exports.createAnalyticsEngineLogsAdapter=V,exports.createAnalyticsEngineStatsAdapter=ve,exports.createCloudflareRateLimitAdapter=K,exports.createCloudflareWfpD1Provisioner=$,exports.createR2SQLLogsAdapter=j,exports.createR2SQLStatsAdapter=le,exports.createWfpForwardMiddleware=nt,exports.createWfpTenantProvisioningHook=Ze,exports.default=rt,exports.generateWorkerScript=q;
|
|
269
|
+
`}var Ue=class{loader;compatibilityDate;constructor(e){this.loader=e.loader,this.compatibilityDate=e.compatibilityDate||`2025-01-01`}async execute(e){let t=Date.now();try{let t=He(e.code),n={compatibilityDate:this.compatibilityDate,mainModule:`hook.js`,modules:{"hook.js":t}},r=e.hookCodeId?`${e.hookCodeId}-${await Ve(e.code)}`:null;return await(await(r?this.loader.get(r,async()=>n):this.loader.load(n)).getEntrypoint().fetch(new Request(`https://hook/execute`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({event:e.event,triggerId:e.triggerId})}))).json()}catch(e){return{success:!1,error:e instanceof Error?e.message:String(e),durationMs:Date.now()-t,apiCalls:[]}}}},J=class extends Error{status;endpoint;errors;body;constructor(e,t,n,r=[]){super(`Cloudflare API ${e} ${t}: ${We(n,256)}`),this.name=`CloudflareApiError`,this.status=e,this.endpoint=t,this.body=n,this.errors=r}};function We(e,t){return e.length<=t?e:`${e.slice(0,t)}…`}var Y=class{accountId;apiToken;fetchImpl;timeoutMs;baseUrl;constructor(e){this.accountId=e.accountId,this.apiToken=e.apiToken,this.fetchImpl=e.fetch??((...e)=>fetch(...e)),this.timeoutMs=e.timeoutMs??3e4,this.baseUrl=(e.baseUrl??`https://api.cloudflare.com/client/v4`).replace(/\/+$/,``)}async createD1Database(e){let t=`/accounts/${encodeURIComponent(this.accountId)}/d1/database`;return(await this.request(`POST`,t,{body:JSON.stringify({name:e})})).result}async listD1Databases(e){let t=e?`?name=${encodeURIComponent(e)}`:``,n=`/accounts/${encodeURIComponent(this.accountId)}/d1/database${t}`;return(await this.request(`GET`,n)).result??[]}async deleteD1Database(e){let t=`/accounts/${encodeURIComponent(this.accountId)}/d1/database/${encodeURIComponent(e)}`;await this.request(`DELETE`,t)}async execD1(e,t){let n=`/accounts/${encodeURIComponent(this.accountId)}/d1/database/${encodeURIComponent(e)}/query`;return(await this.request(`POST`,n,{body:JSON.stringify({sql:t})})).result??[]}async uploadNamespacedScript(e,t,n){let r=`/accounts/${this.accountId}/workers/dispatch/namespaces/${encodeURIComponent(e)}/scripts/${encodeURIComponent(t)}`,i={main_module:n.mainModule,compatibility_date:n.compatibilityDate,compatibility_flags:n.compatibilityFlags??[],bindings:n.bindings??[],tags:n.tags},a=new FormData;a.append(`metadata`,new Blob([JSON.stringify(i)],{type:`application/json`})),a.append(n.mainModule,new Blob([n.script],{type:`application/javascript+module`}),n.mainModule),await this.request(`PUT`,r,{body:a})}async deleteNamespacedScript(e,t){let n=`/accounts/${this.accountId}/workers/dispatch/namespaces/${encodeURIComponent(e)}/scripts/${encodeURIComponent(t)}`;await this.request(`DELETE`,n)}async setNamespacedScriptSecret(e,t,n,r){let i=`/accounts/${this.accountId}/workers/dispatch/namespaces/${encodeURIComponent(e)}/scripts/${encodeURIComponent(t)}/secrets`;await this.request(`PUT`,i,{body:JSON.stringify({name:n,text:r,type:`secret_text`})})}async request(e,t,n){let r=`${this.baseUrl}${t}`,i=new AbortController,a=setTimeout(()=>i.abort(),this.timeoutMs),o={Authorization:`Bearer ${this.apiToken}`,...n?.headers??{}};n?.body&&!(n.body instanceof FormData)&&!o[`Content-Type`]&&(o[`Content-Type`]=`application/json`);let s;try{s=await this.fetchImpl(r,{method:e,headers:o,body:n?.body,signal:i.signal})}finally{clearTimeout(a)}let c=await s.text();if(!s.ok){let e=[];try{let t=JSON.parse(c);Array.isArray(t.errors)&&(e=t.errors)}catch{}throw new J(s.status,t,c,e)}if(!(c===``||s.status===204))return JSON.parse(c)}},Ge=`{tenant_id}`,Ke=`tenant-{tenant_id}`,qe=`index.js`,Je=`2026-05-01`,X=64;function Z(e,t){return e.replace(/\{tenant_id\}/g,t)}function Ye(e){if(!(e instanceof J))return!1;let t=e.body.toLowerCase();return e.status===409||t.includes(`already exists`)||t.includes(`name is already taken`)||t.includes(`already in use`)}function Q(e){return e instanceof J?e.status===404:!1}function Xe(e){let t=new Y({accountId:e.accountId,apiToken:e.apiToken,fetch:e.fetch,timeoutMs:e.timeoutMs}),n=e.scriptNameTemplate??Ge,r=e.d1NameTemplate??Ke,i=e.scriptMetadata?.main_module??qe,a=e.scriptMetadata?.compatibility_date??Je,o=e.scriptMetadata?.compatibility_flags??[`nodejs_compat`],s=e.dispatchNamespace,c=e.logger;async function l(e){let n=(await t.listD1Databases(e)).find(t=>t.name===e);if(n)return{id:n.uuid,created:!1};try{return{id:(await t.createD1Database(e)).uuid,created:!0}}catch(n){if(!Ye(n))throw n;let r=(await t.listD1Databases(e)).find(t=>t.name===e);if(r)return{id:r.uuid,created:!1};throw n}}let u=`_authhero_provisioner_migrations`;function d(e,t){let n=[];for(let r of e)for(let e of r.results??[])if(e&&typeof e==`object`&&t in e){let r=e[t];typeof r==`string`&&n.push(r)}return n}async function f(e){return d(await t.execD1(e,`SELECT name FROM sqlite_master WHERE type='table' AND name='${u}';`),`name`).length>0}async function p(e){await t.execD1(e,`CREATE TABLE IF NOT EXISTS ${u} (name TEXT PRIMARY KEY, applied_at TEXT NOT NULL);`)}async function m(e){let n=await t.execD1(e,`SELECT name FROM ${u};`);return new Set(d(n,`name`))}function h(e){return e.replace(/'/g,`''`)}async function g(e,n){let r=new Date().toISOString();await t.execD1(e,`INSERT OR IGNORE INTO ${u} (name, applied_at) VALUES ('${h(n)}', '${h(r)}');`)}async function _(n){let r=await m(n);for(let i of e.migrations)if(!r.has(i.name)){try{await t.execD1(n,i.sql)}catch(e){throw e instanceof Error?Error(`Failed to apply migration "${i.name}" to D1 ${n}: ${e.message}`,{cause:e}):e}await g(n,i.name)}}async function v(n,r){let c=[{type:`d1`,name:`AUTH_DB`,id:r},{type:`plain_text`,name:`CONTROL_PLANE_BASE_URL`,text:e.controlPlaneBaseUrl},...e.extraBindings??[]];await t.uploadNamespacedScript(s,n,{script:e.tenantWorkerScript,mainModule:i,compatibilityDate:a,compatibilityFlags:o,bindings:c,tags:[`authhero-tenant`,`tenant:${n}`]})}async function y(n,r){let i=await e.secrets(r);for(let[e,r]of Object.entries(i))await t.setNamespacedScriptSecret(s,n,e,r)}return{async onProvision(t){let i=Z(n,t),a=Z(r,t),o=e.migrations[e.migrations.length-1]?.name;if(o!==void 0&&o.length>X)throw Error(`Migration name "${o}" exceeds the ${X}-character database_version limit.`);let{id:s,created:u}=await l(a),d=u?!1:await f(s);if(u||d)await p(s),await _(s);else{c?.warn(`D1 "${a}" has no migration-tracking table — assuming it predates tracking and is fully migrated; backfilling the tracking table and skipping migrations.`),await p(s);for(let t of e.migrations)await g(s,t.name)}return await v(i,s),await y(i,t),{d1DatabaseId:s,scriptName:i,d1Name:a,bundleConfiguration:e.bundleConfiguration,workerVersion:e.workerVersion,databaseVersion:o}},async onDeprovision(e){let i=Z(n,e),a=Z(r,e),o=[];try{await t.deleteNamespacedScript(s,i)}catch(e){Q(e)||o.push(e)}try{let e=(await t.listD1Databases(a)).find(e=>e.name===a);if(e)try{await t.deleteD1Database(e.uuid)}catch(e){Q(e)||o.push(e)}}catch(e){o.push(e)}if(o.length>0){let t=o.map(e=>e instanceof Error?e.message:String(e)).join(`; `);throw Error(`Deprovision of tenant "${e}" had ${o.length} failure(s): ${t}`,{cause:o[0]})}}}}function Ze(e){return e.deployment_type===`wfp`}function $(e){if(typeof e!=`object`||!e)return[];let t=[];for(let n of Object.values(e))if(typeof n==`object`&&n&&`errors`in n&&Array.isArray(n.errors))for(let e of n.errors)typeof e==`string`&&t.push(e);return t}function Qe(e){let{provisioner:t,tenants:n,syncDefaults:r}=e,i=e.shouldProvision??Ze,a=e.logger;async function o(e,t){let r=t instanceof Error?t.message:String(t);try{await n.update(e,{provisioning_state:`failed`,provisioning_error:r.slice(0,2048),provisioning_state_changed_at:new Date().toISOString()})}catch(t){a?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`,t)}}async function s(e){let i;try{i=await t.onProvision(e)}catch(t){throw await o(e,t),t}let s={d1_database_id:i.d1DatabaseId,worker_script_name:i.scriptName,bundle_configuration:i.bundleConfiguration,worker_version:i.workerVersion,database_version:i.databaseVersion};try{if(r){let t=$(await r(e));if(t.length>0)throw Error(`sync-defaults seed reported ${t.length} error(s): ${t.join(`; `)}`)}await n.update(e,{...s,provisioning_state:`ready`,provisioning_error:void 0,provisioning_state_changed_at:new Date().toISOString()})}catch(t){let r=t instanceof Error?t.message:String(t);try{await n.update(e,{...s,provisioning_state:`failed`,provisioning_error:r.slice(0,2048),provisioning_state_changed_at:new Date().toISOString()})}catch(t){a?.warn(`Failed to write provisioning_state="failed" for tenant ${e}:`,t)}throw t}}return{async onProvision(e){let t=await n.get(e);t&&i(t)&&await s(e)},async onUpgrade(e){let t=await n.get(e);if(!t)throw Error(`Cannot upgrade tenant "${e}": not found.`);if(!i(t))throw Error(`Cannot upgrade tenant "${e}": not a WFP-provisioned tenant.`);try{await n.update(e,{provisioning_state:`pending`,provisioning_error:void 0,provisioning_state_changed_at:new Date().toISOString()})}catch(t){a?.warn(`Failed to write provisioning_state="pending" for tenant ${e}:`,t)}await s(e)},async onDeprovision(e){let r=await n.get(e);r&&!i(r)||await t.onDeprovision(e)}}}var $e=`DISPATCHER`,et=`tenant-{tenant_id}-auth`;function tt(e){return typeof e==`object`&&!!e&&`get`in e&&typeof Reflect.get(e,`get`)==`function`}function nt(e,t){return e.replace(/\{tenant_id\}/g,t)}function rt(e){let{tenants:t,controlPlaneTenantId:n,dispatcherBinding:r=$e,scriptNameTemplate:i=et,resolveTenantId:a=e=>e.req.header(`tenant-id`)}=e;return async(e,o)=>{let s=await a(e);if(!s||s===n)return o();let c=await t.get(s);if(!c||c.deployment_type!==`wfp`||c.provisioning_state&&c.provisioning_state!==`ready`)return o();let l=Reflect.get(e.env??{},r);if(!tt(l))return o();let u=nt(i,s),d;try{d=await l.get(u).fetch(e.req.raw)}catch(t){let n=t instanceof Error?t.message:String(t),r=/not\s*found|no\s*such|does not exist/i.test(n),i=r?`wfp_worker_not_found`:`wfp_dispatch_failed`;return console.error(`[wfp-forward] ${i} tenant=${s} script=${u}: ${n}`),e.header(`X-Authhero-Error`,i),e.header(`X-Wfp-Tenant`,s),e.json({error:i,detail:r?`Tenant '${s}' is marked ready but its worker '${u}' is not deployed in the dispatch namespace.`:`The worker for tenant '${s}' could not be reached.`,tenant_id:s},r?503:502)}if(d.status>=500){let e=d.headers.get(`X-Authhero-Error`);console.error(`[wfp-forward] tenant worker ${d.status}${e?` (${e})`:``} tenant=${s} script=${u}`)}if(d.status===101||`webSocket`in d)return d;let f=new Response(d.body,d);return f.headers.set(`X-Wfp-Tenant`,s),f}}function it(e){let t={customDomains:ee(e),cache:ne({...e.cacheName&&{cacheName:e.cacheName},...e.defaultTtlSeconds!==void 0&&{defaultTtlSeconds:e.defaultTtlSeconds},...e.keyPrefix&&{keyPrefix:e.keyPrefix}}),geo:Ie()};e.r2SqlLogs?t.logs=A(e.r2SqlLogs):e.analyticsEngineLogs&&(t.logs=B(e.analyticsEngineLogs)),e.analyticsEngineLogs&&(t.analytics=z(e.analyticsEngineLogs)),e.analyticsEngineActionExecutions&&(t.actionExecutions=W(e.analyticsEngineActionExecutions));let n=G(e.rateLimitBindings);return n&&(t.rateLimit=n),t}exports.CloudflareApiClient=Y,exports.CloudflareApiError=J,exports.CloudflareCodeExecutor=Re,exports.DispatchNamespaceCodeExecutor=q,exports.WorkerLoaderCodeExecutor=Ue,exports.createAnalyticsEngineActionExecutionsAdapter=W,exports.createAnalyticsEngineAnalyticsAdapter=z,exports.createAnalyticsEngineLogsAdapter=B,exports.createAnalyticsEngineStatsAdapter=ye,exports.createCloudflareRateLimitAdapter=G,exports.createCloudflareWfpD1Provisioner=Xe,exports.createR2SQLLogsAdapter=A,exports.createR2SQLStatsAdapter=ue,exports.createWfpForwardMiddleware=rt,exports.createWfpTenantProvisioningHook=Qe,exports.default=it,exports.generateWorkerScript=K;
|
|
@@ -689,8 +689,26 @@ interface CloudflareWfpD1ProvisionerOptions {
|
|
|
689
689
|
/**
|
|
690
690
|
* SQL migrations applied in array order to every new tenant D1. Typically
|
|
691
691
|
* loaded from `@authhero/drizzle`'s shipped migrations via your build tool.
|
|
692
|
+
*
|
|
693
|
+
* The name of the LAST entry is reported back as the tenant's
|
|
694
|
+
* `database_version` (the schema version this bundle targets), so keep the
|
|
695
|
+
* array ordered and the names stable.
|
|
692
696
|
*/
|
|
693
697
|
migrations: ProvisionerMigration[];
|
|
698
|
+
/**
|
|
699
|
+
* Identifier of the worker image / variant being deployed (e.g.
|
|
700
|
+
* `"authhero-drizzle-d1"`). Recorded verbatim on the tenant row as
|
|
701
|
+
* `bundle_configuration` so the control plane can tell which build a tenant
|
|
702
|
+
* runs. Optional — omit if you don't track image variants.
|
|
703
|
+
*/
|
|
704
|
+
bundleConfiguration?: string;
|
|
705
|
+
/**
|
|
706
|
+
* Release tag or git SHA of `tenantWorkerScript`, supplied by the operator
|
|
707
|
+
* at build time. Recorded verbatim on the tenant row as `worker_version` so
|
|
708
|
+
* the control plane can detect when a tenant lags the current build and
|
|
709
|
+
* needs an upgrade. Optional but strongly recommended.
|
|
710
|
+
*/
|
|
711
|
+
workerVersion?: string;
|
|
694
712
|
/**
|
|
695
713
|
* Resolver that returns the secret values to set on the tenant worker.
|
|
696
714
|
* Called once per `onProvision`. The provisioner uploads each entry via
|
|
@@ -751,6 +769,25 @@ interface ProvisionResult {
|
|
|
751
769
|
d1DatabaseId: string;
|
|
752
770
|
scriptName: string;
|
|
753
771
|
d1Name: string;
|
|
772
|
+
/**
|
|
773
|
+
* The worker image / variant that was deployed — echoes back
|
|
774
|
+
* `options.bundleConfiguration` (undefined if not configured). The hook
|
|
775
|
+
* persists it to `tenants.bundle_configuration`.
|
|
776
|
+
*/
|
|
777
|
+
bundleConfiguration?: string;
|
|
778
|
+
/**
|
|
779
|
+
* The release tag / git SHA that was deployed — echoes back
|
|
780
|
+
* `options.workerVersion` (undefined if not configured). The hook persists
|
|
781
|
+
* it to `tenants.worker_version`.
|
|
782
|
+
*/
|
|
783
|
+
workerVersion?: string;
|
|
784
|
+
/**
|
|
785
|
+
* Name of the latest migration applied to the tenant D1 (the last entry in
|
|
786
|
+
* `options.migrations`), i.e. the schema version the deployed bundle
|
|
787
|
+
* targets. `undefined` when no migrations are configured. The hook persists
|
|
788
|
+
* it to `tenants.database_version`.
|
|
789
|
+
*/
|
|
790
|
+
databaseVersion?: string;
|
|
754
791
|
}
|
|
755
792
|
/**
|
|
756
793
|
* What `createCloudflareWfpD1Provisioner` returns — the two lifecycle
|
|
@@ -891,6 +928,19 @@ interface WfpTenantProvisioningHookOptions {
|
|
|
891
928
|
interface WfpTenantProvisioningHook {
|
|
892
929
|
onProvision(tenantId: string): Promise<void>;
|
|
893
930
|
onDeprovision(tenantId: string): Promise<void>;
|
|
931
|
+
/**
|
|
932
|
+
* Re-run provisioning for an already-existing WFP tenant to pull it onto the
|
|
933
|
+
* current bundle + migrations — i.e. an upgrade. Re-uploads the worker
|
|
934
|
+
* script (an upload overwrites), reconciles any migrations not yet applied to
|
|
935
|
+
* the tenant D1, re-runs `syncDefaults`, then rewrites `worker_version`,
|
|
936
|
+
* `bundle_configuration`, and `database_version` so the recorded versions
|
|
937
|
+
* reflect what now runs. Marks `provisioning_state = "pending"` while the
|
|
938
|
+
* upgrade is in flight and `ready` on success (`failed` on error).
|
|
939
|
+
*
|
|
940
|
+
* Throws if the tenant doesn't exist or isn't WFP-provisioned — callers
|
|
941
|
+
* (e.g. a management-API redeploy endpoint) surface that as a 4xx.
|
|
942
|
+
*/
|
|
943
|
+
onUpgrade(tenantId: string): Promise<void>;
|
|
894
944
|
}
|
|
895
945
|
declare function createWfpTenantProvisioningHook(options: WfpTenantProvisioningHookOptions): WfpTenantProvisioningHook;
|
|
896
946
|
|