@brutal-ai/server 0.1.0 → 0.2.0

package/cli.js

@@ -48,14 +48,91 @@ function loadBrutalConfig(dir, { allowDefaults = false } = {}) {
   return config;
 }
 
+// worker/cli/access.ts
+var same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+async function ensureAccess(cf, want, dryRun = false) {
+  const emails = [...new Set(want.emails.map((e) => e.trim().toLowerCase()).filter(Boolean))];
+  if (emails.length === 0 || emails.some((e) => !e.includes("@"))) {
+    throw new Error("Access needs at least one email address to let in.");
+  }
+  const changes = [];
+  const org = await cf(["organization", "get"]);
+  const team = org?.auth_domain ?? "";
+  if (!team) {
+    throw new Error("This Cloudflare account has no Zero Trust organization yet. Open Zero Trust in the " + "Cloudflare dashboard once to create one (the Free plan is enough), then run this again.");
+  }
+  const idps = await cf(["identity-providers", "list"]) ?? [];
+  let otp = idps.find((i) => i.type === "onetimepin");
+  if (!otp) {
+    changes.push("create the one-time PIN login");
+    otp = dryRun ? { id: "(new)", type: "onetimepin" } : await cf(["identity-providers", "create"], {
+      name: "One-time PIN",
+      type: "onetimepin",
+      config: {}
+    });
+  }
+  const policyName = `Brutal ${want.worker}: owners`;
+  const policyBody = {
+    name: policyName,
+    decision: "allow",
+    include: emails.map((email) => ({ email: { email } })),
+    exclude: [],
+    require: []
+  };
+  const policies = await cf(["access", "policies", "list"]) ?? [];
+  let policy = policies.find((p) => p.name === policyName);
+  if (!policy) {
+    changes.push(`create the policy "${policyName}" (allow ${emails.join(", ")})`);
+    policy = dryRun ? { id: "(new)", ...policyBody } : await cf(["access", "policies", "create"], policyBody);
+  } else if (policy.decision !== "allow" || !same(policy.include, policyBody.include)) {
+    changes.push(`correct the policy "${policyName}" (allow ${emails.join(", ")} only)`);
+    if (!dryRun) {
+      policy = await cf(["access", "policies", "update", policy.id], policyBody);
+    }
+  }
+  const domain = `${want.host}/dashboard`;
+  const title = `Brutal (${want.host})`;
+  const appBody = {
+    name: title,
+    domain,
+    type: "self_hosted",
+    session_duration: want.sessionDuration,
+    allowed_idps: [otp.id],
+    auto_redirect_to_identity: true,
+    app_launcher_visible: false,
+    policies: [{ id: policy.id, precedence: 1 }]
+  };
+  const apps = await cf(["access", "applications", "list"]) ?? [];
+  let app = apps.find((a) => a.domain === domain);
+  if (!app) {
+    changes.push(`create the application for ${domain} (${want.sessionDuration} sessions)`);
+    if (!dryRun)
+      app = await cf(["access", "applications", "create"], appBody);
+  } else if (app.name !== title || app.type !== "self_hosted" || app.session_duration !== want.sessionDuration || !same(app.allowed_idps, [otp.id]) || app.auto_redirect_to_identity !== true || !same((app.policies ?? []).map((p) => p.id), [policy.id])) {
+    changes.push(`correct the application for ${domain}`);
+    if (!dryRun)
+      app = await cf(["access", "applications", "update", app.id], appBody);
+  }
+  return { team, aud: app?.aud ?? "", changes };
+}
+function parseCfJson(stdout) {
+  const lines = stdout.split(`
+`);
+  const start = lines.findIndex((l) => l.startsWith("[") || l.startsWith("{"));
+  if (start === -1)
+    return null;
+  return JSON.parse(lines.slice(start).join(`
+`));
+}
+
 // worker/cli/brutal-server.ts
 var root = process.cwd();
 var [command, ...rest] = process.argv.slice(2);
 process.env.CF_SEND_TELEMETRY ??= "false";
-var commands = { setup, deploy, secrets, dev };
+var commands = { setup, deploy, secrets, dev, access };
 var run = command ? commands[command] : undefined;
 if (!run) {
-  console.log("Usage: brutal-server <setup|deploy|secrets|dev>");
+  console.log("Usage: brutal-server <setup|deploy|secrets|dev|access>");
   process.exit(command ? 1 : 0);
 }
 await run();
@@ -125,6 +202,50 @@ Setup code: ${setupCode}`);
   console.log(`Open /setup on your instance and enter it to make your keys.
 `);
 }
+async function access() {
+  const dryRun = rest.includes("--dry-run");
+  await requireAuth();
+  const current = readConfigFile(root);
+  const config = loadBrutalConfig(root);
+  if (!config.domain) {
+    console.error("Access needs a custom domain: run `bun run setup` and give one, deploy, then run this.");
+    process.exit(1);
+  }
+  let emails = config.access?.emails ?? [];
+  if (emails.length === 0) {
+    const answer = prompt("Email(s) allowed to sign in to the dashboard, comma-separated:");
+    emails = (answer ?? "").split(",").map((e) => e.trim()).filter(Boolean);
+  }
+  const cf = async (args, body) => {
+    const extra = body === undefined ? [] : ["--body", JSON.stringify(body)];
+    const out = await $`bunx cf zero-trust ${args} ${extra}`.nothrow().quiet();
+    if (out.exitCode !== 0) {
+      throw new Error(`cf zero-trust ${args.join(" ")} failed: ${out.stderr.toString() || out.stdout.toString()}`);
+    }
+    return parseCfJson(out.stdout.toString());
+  };
+  console.log(`
+Cloudflare Access for https://${config.domain}/dashboard
+`);
+  const ensured = await ensureAccess(cf, { host: config.domain, worker: config.worker, emails, sessionDuration: "24h" }, dryRun);
+  for (const change of ensured.changes)
+    console.log(`${dryRun ? "Would" : "\u2713"} ${change}`);
+  if (ensured.changes.length === 0)
+    console.log("\u2713 Access is already as it should be");
+  if (dryRun)
+    return;
+  const next = {
+    ...current ?? config,
+    worker: current?.worker ?? config.worker,
+    access: { emails, team: ensured.team, aud: ensured.aud }
+  };
+  writeFileSync(configPath(root), `${JSON.stringify(next, null, 2)}
+`);
+  console.log(`\u2713 Wrote the team and application to ${basename(configPath(root))}`);
+  console.log(`
+Next: bun run deploy. The dashboard then signs in with a code mailed to you.
+`);
+}
 async function dev() {
   process.exit(await interactive(["bunx", "cf", "dev", "--port", "8787", ...rest]));
 }

package/config.d.ts

@@ -6,6 +6,8 @@ export type BrutalConfig = {
   database?: string;
   /** Custom domain on a zone in your Cloudflare account. Without one, workers.dev serves it. */
   domain?: string | null;
+  /** Cloudflare Access in front of /dashboard; `brutal-server access` sets it up. */
+  access?: { emails: string[]; team?: string; aud?: string } | null;
 };
 
 /**

package/config.js

@@ -46,6 +46,7 @@ function defineBrutal({ dir, entrypoint }) {
       allowDefaults: argv.includes("dev") || argv.includes("types")
     });
     const domain = brutal.domain || null;
+    const access = domain && brutal.access?.team && brutal.access.aud ? brutal.access : null;
     return {
       worker: {
         name: brutal.worker,
@@ -57,7 +58,12 @@ function defineBrutal({ dir, entrypoint }) {
         workersDev: !domain,
         previewUrls: false,
         env: {
-          DB: bindings.d1({ name: brutal.database ?? brutal.worker })
+          DB: bindings.d1({ name: brutal.database ?? brutal.worker }),
+          ...access && {
+            ACCESS_TEAM: bindings.text(access.team ?? ""),
+            ACCESS_AUD: bindings.text(access.aud ?? ""),
+            ACCESS_EMAILS: bindings.text(access.emails.join(","))
+          }
         }
       }
     };

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.0",
+  "version": "0.2.0",
   "license": "MIT",
   "name": "@brutal-ai/server",
   "description": "Brutal: feedback from your agents, deployed to your own Cloudflare account",