@cloudflare/workers-auth 0.14.1 → 0.15.1

package/dist/{file-format-DLf_MRuS.d.mts → authentication-error-DcqALFv6.d.mts}

@@ -1,4 +1,4 @@
-import { Logger, ComplianceConfig, ApiCredentials } from '@cloudflare/workers-utils';
+import { Logger, ComplianceConfig, ApiCredentials, UserError } from '@cloudflare/workers-utils';
 
 /**
  * Pluggable persistence for a typed config blob.
@@ -99,6 +99,8 @@ interface OAuthFlowTemporaryContext {
     storage: TemporaryAccountStorage;
     /** Consumer name used in temporary-account errors. */
     cliDisplayName?: string;
+    /** Consumer temporary-account flag spelling. Defaults to `--temporary-account`. */
+    temporaryAccountFlag?: string;
     /** Consumer command used to clear a cached temporary account. */
     logoutCommand?: string;
     /**
@@ -513,4 +515,10 @@ interface CredentialStore extends AuthConfigStorage {
  */
 type FileFormat = "toml" | "json";
 
-export { type AuthConfigStorage as A, type CredentialStore as C, type DeactivateDirectoryResult as D, type FileFormat as F, type LoginOrRefreshFailureReason as L, type OAuthFlowLogger as O, type ProfileConfigOperations as P, type TemporaryAccountRequest as T, type UserAuthConfig as U, type ConfigStorage as a, type DirectoryBindingOperations as b, type DirectoryBindingsStorage as c, type LoginOrRefreshResult as d, type LoginProps as e, type OAuthFlowContext as f, type ProfileStore as g, type TemporaryPreviewAccount as h, createOAuthFlow as i, createProfileStore as j, generateAuthUrl as k, generateRandomState as l, type TemporaryAccountLogger as m, type OAuthConsentPages as n, validateProfileName as v };
+/** Authentication failed before an API request, with a machine-readable reason. */
+declare class AuthenticationError extends UserError {
+    readonly reason: LoginOrRefreshFailureReason;
+    constructor(message: string, reason: LoginOrRefreshFailureReason, telemetryMessage: string);
+}
+
+export { type AuthConfigStorage as A, type CredentialStore as C, type DeactivateDirectoryResult as D, type FileFormat as F, type LoginOrRefreshFailureReason as L, type OAuthFlowLogger as O, type ProfileConfigOperations as P, type TemporaryAccountRequest as T, type UserAuthConfig as U, AuthenticationError as a, type ConfigStorage as b, type DirectoryBindingOperations as c, type DirectoryBindingsStorage as d, type LoginOrRefreshResult as e, type LoginProps as f, type OAuthFlowContext as g, type ProfileStore as h, type TemporaryPreviewAccount as i, createOAuthFlow as j, createProfileStore as k, generateAuthUrl as l, generateRandomState as m, type TemporaryAccountLogger as n, type OAuthConsentPages as o, validateProfileName as v };

package/dist/cf/index.d.mts

@@ -1,6 +1,7 @@
-import { a as ConfigStorage, A as AuthConfigStorage, U as UserAuthConfig, f as OAuthFlowContext, g as ProfileStore } from '../file-format-DLf_MRuS.mjs';
-import { C as CliDescriptor, A as AuthContext, a as CloudflareAuth, U as UserPreferences, K as KeyringPreferenceContext, S as SetKeyringPreferenceResult } from '../keyring-preference-DIwv0hwY.mjs';
-export { b as CloudflareLoginProps } from '../keyring-preference-DIwv0hwY.mjs';
+import { b as ConfigStorage, A as AuthConfigStorage, U as UserAuthConfig, g as OAuthFlowContext, h as ProfileStore } from '../authentication-error-DcqALFv6.mjs';
+export { a as AuthenticationError } from '../authentication-error-DcqALFv6.mjs';
+import { C as CliDescriptor, A as AuthContext, a as CloudflareAuth, U as UserPreferences, K as KeyringPreferenceContext, S as SetKeyringPreferenceResult } from '../keyring-preference-DGkctqNO.mjs';
+export { b as CloudflareLoginProps } from '../keyring-preference-DGkctqNO.mjs';
 import '@cloudflare/workers-utils';
 
 /**

package/dist/cf/index.mjs

@@ -1,6 +1,6 @@
 import { createRequire } from 'node:module';
-import { createAuthConfigFileHelpers, createPreferences, createKeyringPreference, createFileStorage, createCloudflareAuth, createCloudflareProfileStore } from '../chunk-F2REEYJC.mjs';
-import '../chunk-2K52M2W5.mjs';
+import { createAuthConfigFileHelpers, createPreferences, createKeyringPreference, createFileStorage, createCloudflareAuth, createCloudflareProfileStore } from '../chunk-L7K6HL3F.mjs';
+export { AuthenticationError } from '../chunk-3PJ54H4K.mjs';
 import { __name } from '../chunk-VAZEJK55.mjs';
 import { getEnvironmentVariableFactory, getGlobalConfigPath, getCloudflareApiEnvironmentFromEnv } from '@cloudflare/workers-utils';
 import path from 'node:path';
@@ -581,6 +581,7 @@ var {
 var CF_CLI = {
   cliName: CF_CLI_NAME,
   displayName: CF_DISPLAY_NAME,
+  temporaryAccountFlag: "--temporary-account",
   commands: {
     login: "cf auth login",
     logout: "cf auth logout",

package/dist/{chunk-2K52M2W5.mjs → chunk-3PJ54H4K.mjs}

@@ -421,13 +421,13 @@ function solveChallenge(challenge) {
 __name(solveChallenge, "solveChallenge");
 
 // src/temporary.ts
+var DEFAULT_TEMPORARY_ACCOUNT_FLAG = "--temporary-account";
 var TEMPORARY_TERMS_URLS = {
   termsOfService: "https://www.cloudflare.com/terms/",
   privacyPolicy: "https://www.cloudflare.com/privacypolicy/"
 };
 var TEMPORARY_TERMS_PROMPT = `You must accept Cloudflare's Terms of Service (${TEMPORARY_TERMS_URLS.termsOfService}) and Privacy Policy (${TEMPORARY_TERMS_URLS.privacyPolicy}) in order to continue. By typing "yes", you agree to these terms. Type "yes" to continue.`;
 var TEMPORARY_TERMS_NOTICE = `Continuing means you accept Cloudflare's Terms of Service (${TEMPORARY_TERMS_URLS.termsOfService}) and Privacy Policy (${TEMPORARY_TERMS_URLS.privacyPolicy}).`;
-var TEMPORARY_TERMS_ERROR = `You must accept Cloudflare's Terms of Service (${TEMPORARY_TERMS_URLS.termsOfService}) and Privacy Policy (${TEMPORARY_TERMS_URLS.privacyPolicy}) to use --temporary.`;
 var EVENT_ACCOUNT_ERRORS = /* @__PURE__ */ new Map([
   [
     1035,
@@ -674,9 +674,10 @@ async function getOrCreateTemporaryPreviewAccount(options) {
     TEMPORARY_TERMS_NOTICE
   );
   if (!termsAccepted) {
-    throw new UserError(TEMPORARY_TERMS_ERROR, {
-      telemetryMessage: "user temporary terms not accepted"
-    });
+    throw new UserError(
+      `You must accept Cloudflare's Terms of Service (${TEMPORARY_TERMS_URLS.termsOfService}) and Privacy Policy (${TEMPORARY_TERMS_URLS.privacyPolicy}) to use ${options.temporaryAccountFlag ?? DEFAULT_TEMPORARY_ACCOUNT_FLAG}.`,
+      { telemetryMessage: "user temporary terms not accepted" }
+    );
   }
   const temporaryPreviewAccount = await createTemporaryPreviewAccount(
     options.temporaryAccountLogger,
@@ -2700,11 +2701,21 @@ var EncryptedFileCredentialStore = class {
 };
 var PINNED_KEYRING_VERSION = "1.3.0";
 function defaultNpmRunner(args) {
-  return spawnSync("npm", args, {
+  const options = {
     encoding: "utf-8",
-    stdio: ["ignore", "pipe", "pipe"],
-    shell: process.platform === "win32"
-  });
+    stdio: ["ignore", "pipe", "pipe"]
+  };
+  if (process.platform === "win32") {
+    const env = { ...process.env };
+    const quotedArgRefs = args.map((arg, i) => {
+      const name = `WORKERS_AUTH_NPM_ARG_${i}`;
+      env[name] = arg;
+      return `"%${name}%"`;
+    });
+    const command = ["npm", ...quotedArgRefs].join(" ");
+    return spawnSync(command, { ...options, env, shell: true });
+  }
+  return spawnSync("npm", args, options);
 }
 __name(defaultNpmRunner, "defaultNpmRunner");
 var npmRunner = defaultNpmRunner;
@@ -3372,6 +3383,15 @@ function scrubEncryptedCredentials(options) {
   return { backendAvailable: false, encryptedFileExisted };
 }
 __name(scrubEncryptedCredentials, "scrubEncryptedCredentials");
+var AuthenticationError = class extends UserError {
+  constructor(message, reason, telemetryMessage) {
+    super(message, { telemetryMessage });
+    this.reason = reason;
+  }
+  static {
+    __name(this, "AuthenticationError");
+  }
+};
 /*! Bundled license information:
 
 smol-toml/dist/error.js:
@@ -3636,4 +3656,4 @@ smol-toml/dist/index.js:
    *)
 */
 
-export { EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, dedent, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, generateVerificationUrl, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, parseFile, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, stringifyFile, validateAccountId, validateProfileName };
+export { AuthenticationError, DEFAULT_TEMPORARY_ACCOUNT_FLAG, EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, dedent, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, generateVerificationUrl, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, parseFile, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, stringifyFile, validateAccountId, validateProfileName };

package/dist/{chunk-F2REEYJC.mjs → chunk-L7K6HL3F.mjs}

@@ -1,5 +1,5 @@
 import { createRequire } from 'node:module';
-import { stringifyFile, parseFile, dedent, createCredentialStorageContext, createOAuthFlow, getAuthFromEnv, createProfileStore, validateAccountId, getCloudflareAccountIdFromEnv, getAuthConfigFilePath, getEncryptedAuthConfigFilePath, scrubEncryptedCredentials, validateProfileName, getCloudflareAuthUseKeyringFromEnv } from './chunk-2K52M2W5.mjs';
+import { stringifyFile, parseFile, dedent, DEFAULT_TEMPORARY_ACCOUNT_FLAG, createCredentialStorageContext, createOAuthFlow, getAuthFromEnv, createProfileStore, AuthenticationError, validateAccountId, getCloudflareAccountIdFromEnv, getAuthConfigFilePath, getEncryptedAuthConfigFilePath, scrubEncryptedCredentials, validateProfileName, getCloudflareAuthUseKeyringFromEnv } from './chunk-3PJ54H4K.mjs';
 import { __name } from './chunk-VAZEJK55.mjs';
 import { existsSync, rmSync, mkdirSync, writeFileSync, chmodSync, readFileSync as readFileSync$1, readdirSync } from 'node:fs';
 import path3 from 'node:path';
@@ -786,6 +786,7 @@ function createCloudflareAuth(descriptor, ctx) {
   const { logger } = ctx;
   const temporaryAccountLogger = ctx.temporaryAccountLogger ?? logger;
   const cliName = descriptor.cliName;
+  const temporaryAccountFlag = descriptor.temporaryAccountFlag ?? DEFAULT_TEMPORARY_ACCOUNT_FLAG;
   const NOT_LOGGED_IN_ERROR_BODIES = notLoggedInErrorBodies(
     descriptor.commands.login
   );
@@ -829,6 +830,7 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
       ),
       cliDisplayName: descriptor.displayName,
       logoutCommand: descriptor.commands.logout,
+      temporaryAccountFlag,
       prompt: createTemporaryTermsPrompt({
         temporaryAccountLogger,
         prompt: ctx.prompt
@@ -962,9 +964,10 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
     const { throwOnEmpty = true } = options;
     const loginResult = await loginOrRefreshIfRequired(complianceConfig);
     if (!loginResult.loggedIn) {
-      throw new UserError(
+      throw new AuthenticationError(
         `Not logged in. ${NOT_LOGGED_IN_ERROR_BODIES[loginResult.reason]}${NOT_LOGGED_IN_WHOAMI_TIP}`,
-        { telemetryMessage: "cfetch auth login required" }
+        loginResult.reason,
+        "cfetch auth login required"
       );
     }
     const credentials = requireApiToken();
@@ -1094,7 +1097,7 @@ ${accounts.map(
       }
       if (getAPIToken()) {
         throw new UserError(
-          "You're already authenticated with Cloudflare, so `--temporary` can't be used. Temporary preview accounts are only for unauthenticated use. Either remove `--temporary` to use your existing account, or log out (and unset CLOUDFLARE_API_TOKEN) first.",
+          `You're already authenticated with Cloudflare, so \`${temporaryAccountFlag}\` can't be used. Temporary preview accounts are only for unauthenticated use. Either remove \`${temporaryAccountFlag}\` to use your existing account, or log out (and unset CLOUDFLARE_API_TOKEN) first.`,
           {
             telemetryMessage: "user temporary account already authenticated"
           }

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { O as OAuthFlowLogger, U as UserAuthConfig, A as AuthConfigStorage, C as CredentialStore, F as FileFormat } from './file-format-DLf_MRuS.mjs';
-export { a as ConfigStorage, D as DeactivateDirectoryResult, b as DirectoryBindingOperations, c as DirectoryBindingsStorage, L as LoginOrRefreshFailureReason, d as LoginOrRefreshResult, e as LoginProps, f as OAuthFlowContext, P as ProfileConfigOperations, g as ProfileStore, T as TemporaryAccountRequest, h as TemporaryPreviewAccount, i as createOAuthFlow, j as createProfileStore, k as generateAuthUrl, l as generateRandomState, v as validateProfileName } from './file-format-DLf_MRuS.mjs';
+import { O as OAuthFlowLogger, U as UserAuthConfig, A as AuthConfigStorage, C as CredentialStore, F as FileFormat } from './authentication-error-DcqALFv6.mjs';
+export { a as AuthenticationError, b as ConfigStorage, D as DeactivateDirectoryResult, c as DirectoryBindingOperations, d as DirectoryBindingsStorage, L as LoginOrRefreshFailureReason, e as LoginOrRefreshResult, f as LoginProps, g as OAuthFlowContext, P as ProfileConfigOperations, h as ProfileStore, T as TemporaryAccountRequest, i as TemporaryPreviewAccount, j as createOAuthFlow, k as createProfileStore, l as generateAuthUrl, m as generateRandomState, v as validateProfileName } from './authentication-error-DcqALFv6.mjs';
 import { ApiCredentials } from '@cloudflare/workers-utils';
 import { SpawnSyncReturns } from 'node:child_process';
 

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { createRequire } from 'node:module';
-export { EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, generateVerificationUrl, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, validateProfileName } from './chunk-2K52M2W5.mjs';
+export { AuthenticationError, EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, generateVerificationUrl, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, validateProfileName } from './chunk-3PJ54H4K.mjs';
 import './chunk-VAZEJK55.mjs';
 
 createRequire(import.meta.url || (typeof __filename === "string" ? __filename : "/"));

package/dist/{keyring-preference-DIwv0hwY.d.mts → keyring-preference-DGkctqNO.d.mts}

@@ -1,4 +1,4 @@
-import { f as OAuthFlowContext, m as TemporaryAccountLogger, n as OAuthConsentPages, F as FileFormat, C as CredentialStore, T as TemporaryAccountRequest, d as LoginOrRefreshResult, U as UserAuthConfig } from './file-format-DLf_MRuS.mjs';
+import { g as OAuthFlowContext, n as TemporaryAccountLogger, o as OAuthConsentPages, F as FileFormat, C as CredentialStore, T as TemporaryAccountRequest, e as LoginOrRefreshResult, U as UserAuthConfig } from './authentication-error-DcqALFv6.mjs';
 import { ApiCredentials, ComplianceConfig } from '@cloudflare/workers-utils';
 
 /** Minimal shape of the interactive `select` prompt's options for account selection. */
@@ -60,6 +60,8 @@ interface CliDescriptor {
      * {@link CliDescriptor.cliName}, which names the executable.
      */
     displayName: string;
+    /** Temporary-account flag spelling in user guidance. Defaults to `--temporary-account`. */
+    temporaryAccountFlag?: string;
     /** Commands surfaced in auth guidance. */
     commands: {
         login: string;
@@ -156,7 +158,7 @@ interface CloudflareAuth {
     getActiveProfile: () => string;
     /** The currently-active credential store for the active profile. */
     getCredentialStore: () => CredentialStore;
-    /** Mark whether `--temporary` is permitted for the current invocation. */
+    /** Mark whether temporary-account mode is permitted for the current invocation. */
     setTemporaryAllowed: (allowed: boolean, request?: TemporaryAccountRequest) => void;
     /** Resolve API credentials (env / temporary account / stored OAuth token). */
     getAPIToken: () => ApiCredentials | undefined;