@cloudflare/workers-auth 0.4.2 → 0.5.0

package/dist/cf/index.d.mts

@@ -0,0 +1,85 @@
+import { a as ConfigStorage, A as AuthConfigStorage, U as UserAuthConfig, b as OAuthFlowContext, k as ProfileStore } from '../file-format-CWtMNfzC.mjs';
+import { C as CliDescriptor, U as UserPreferences, A as AuthContext, a as CloudflareAuth, K as KeyringPreferenceContext, S as SetKeyringPreferenceResult } from '../keyring-preference-DMsAtawt.mjs';
+export { b as CloudflareLoginProps } from '../keyring-preference-DMsAtawt.mjs';
+import '@cloudflare/workers-utils';
+
+/**
+ * A JSON-file-on-disk storage backend (cf's on-disk format), a thin
+ * `JSON`-bound wrapper over the CLI-agnostic {@link createFileStorage}.
+ */
+declare function createJsonFileStorage<T extends object>(getPath: () => string): ConfigStorage<T>;
+declare const getAuthConfigFilePath: (profile?: string) => string;
+declare const getEncryptedAuthConfigFilePath: (profile?: string) => string;
+declare const defaultAuthConfigStorage: (profile?: string) => AuthConfigStorage;
+declare const readAuthConfigFile: (profile?: string) => UserAuthConfig | undefined;
+declare const writeAuthConfigFile: (config: UserAuthConfig, profile?: string) => void;
+
+declare const CF_SCOPES: readonly ["openid", "offline", "user:read", "account:read", "access:read", "access:write", "agw:read", "agw:run", "agw:write", "ai:read", "ai:write", "ai-search:read", "ai-search:run", "ai-search:write", "aiaudit:read", "aiaudit:write", "aig:read", "aig:write", "auditlogs:read", "browser:read", "browser:write", "cfone:read", "cfone:write", "cloudchamber:write", "connectivity:admin", "connectivity:bind", "connectivity:read", "constellation:write", "containers:write", "d1:write", "dex:read", "dex:write", "dns_analytics:read", "dns_records:edit", "dns_records:read", "dns_settings:read", "firstpartytags:write", "images:read", "images:write", "lb:edit", "lb:read", "logpush:read", "logpush:write", "mcp_portals:read", "mcp_portals:write", "notebook-examples:read", "notification:read", "notification:write", "pages:read", "pages:write", "pipelines:read", "pipelines:setup", "pipelines:write", "query_cache:write", "queues:write", "r2_catalog:write", "radar:read", "rag:read", "rag:write", "registrar:read", "registrar:write", "secrets_store:read", "secrets_store:write", "sso-connector:read", "sso-connector:write", "ssl_certs:write", "teams:pii", "teams:read", "teams:secure_location", "teams:write", "url_scanner:read", "url_scanner:write", "vectorize:write", "workers:read", "workers:write", "workers_builds:read", "workers_builds:write", "workers_deployments:read", "workers_kv:write", "workers_observability:read", "workers_observability:write", "workers_observability_telemetry:write", "workers_routes:write", "workers_scripts:write", "workers_tail:read", "zone:read"];
+/**
+ * The possible keys for a cf Scope.
+ *
+ * "offline_access" is automatically included.
+ */
+type Scope = (typeof CF_SCOPES)[number];
+declare let DefaultScopeKeys: Scope[];
+declare function setLoginScopeKeys(scopes: Scope[]): void;
+declare function validateScopeKeys(scopes: string[]): scopes is typeof DefaultScopeKeys;
+
+/**
+ * `CLOUDFLARE_CLIENT_ID` is the UUID of cf's registered OAuth app, used to
+ * identify the `cf` CLI to the Cloudflare OAuth server.
+ *
+ * Normally you should not need to set this explicitly. cf has a single
+ * registered OAuth app (there is no separate staging app), so the default is
+ * the same regardless of `WRANGLER_API_ENVIRONMENT`; override via the env var
+ * if a different app is ever needed.
+ */
+declare const getClientIdFromEnv: () => string;
+
+/**
+ * OS-keyring service identifier for the `cf` CLI. Distinct from wrangler's so
+ * the two CLIs' credentials never collide in the OS keychain. Becomes the `-s`
+ * arg to macOS `security`, the `service` attribute for Linux `secret-tool`, and
+ * the `service` arg to `@napi-rs/keyring` on Windows.
+ */
+declare const CF_KEYRING_SERVICE_NAME = "cloudflare";
+/**
+ * The `redirect_uri` registered on cf's OAuth app; also the local callback URL.
+ * cf uses the fixed local callback port 8877 (from its historical 8877–8886
+ * range).
+ */
+declare const CF_OAUTH_CALLBACK_URL = "http://localhost:8877/oauth/callback";
+
+/**
+ * The `cf` CLI's global config directory: `~/.config/cloudflare` (XDG) — no
+ * leading dot (unlike wrangler's `.wrangler`) and no legacy `~/.cloudflare`
+ * fallback, since `cf` is new and has no historical home-dir layout to be
+ * compatible with. Resolved lazily so `runInTempDir()` fixtures (which re-stub
+ * `HOME` / `XDG_CONFIG_HOME`) are honoured per call.
+ */
+declare function getCfConfigPath(): string;
+
+/**
+ * The cf {@link CliDescriptor}: JSON files under `~/.config/cloudflare`, cf's
+ * OAuth app / consent pages, the `"cloudflare"` keyring service, and cf-worded
+ * copy.
+ */
+declare const CF_CLI: CliDescriptor;
+declare const readUserPreferences: () => UserPreferences;
+declare const updateUserPreferences: (update: Partial<UserPreferences>) => void;
+/**
+ * Build cf's auth layer, injecting the few consumer primitives that can't move
+ * into the shared package (logger, interactive `prompt` / `select`, and the
+ * User-Agent string).
+ */
+declare function createCfAuth(ctx: AuthContext): CloudflareAuth;
+/** Consumer primitives {@link createCfProfileStore} needs. */
+interface CfProfileStoreContext {
+    logger: OAuthFlowContext["logger"];
+}
+/** Build cf's {@link ProfileStore} (JSON `.json` / `.enc` files under `~/.config/cloudflare`). */
+declare function createCfProfileStore(ctx: CfProfileStoreContext): ProfileStore;
+/** Apply and persist cf's global keyring-storage preference. */
+declare function setKeyringPreference(enabled: boolean, ctx: KeyringPreferenceContext): SetKeyringPreferenceResult;
+
+export { AuthContext, CF_CLI, CF_KEYRING_SERVICE_NAME, CF_OAUTH_CALLBACK_URL, type CfProfileStoreContext, CliDescriptor, CloudflareAuth, DefaultScopeKeys, KeyringPreferenceContext, type Scope, SetKeyringPreferenceResult, UserPreferences, createCfAuth, createCfProfileStore, createJsonFileStorage, defaultAuthConfigStorage, getAuthConfigFilePath, getCfConfigPath, getClientIdFromEnv, getEncryptedAuthConfigFilePath, readAuthConfigFile, readUserPreferences, setKeyringPreference, setLoginScopeKeys, updateUserPreferences, validateScopeKeys, writeAuthConfigFile };

package/dist/cf/index.mjs

@@ -0,0 +1,212 @@
+import { createAuthConfigFileHelpers, createPreferences, createKeyringPreference, createFileStorage, createCloudflareAuth, createCloudflareProfileStore } from '../chunk-WJE5I5WS.mjs';
+import '../chunk-FX4KV7FS.mjs';
+import { __name } from '../chunk-O6YSETKJ.mjs';
+import { getEnvironmentVariableFactory, getGlobalConfigPath, getCloudflareApiEnvironmentFromEnv } from '@cloudflare/workers-utils';
+import path from 'node:path';
+
+// src/cf/constants.ts
+var CF_KEYRING_SERVICE_NAME = "cloudflare";
+var CF_CLI_NAME = "cf";
+var CF_OAUTH_CALLBACK_URL = "http://localhost:8877/oauth/callback";
+var CF_CONSENT_PAGES = {
+  granted: {
+    url: "https://welcome.developers.workers.dev/cf-oauth-consent-granted"
+  },
+  denied: {
+    url: "https://welcome.developers.workers.dev/cf-oauth-consent-denied",
+    error: "Error: Consent denied. You must grant consent to cf in order to login.\nIf you don't want to do this consider passing an API token via the `CLOUDFLARE_API_TOKEN` environment variable"
+  }
+};
+var getClientIdFromEnv = getEnvironmentVariableFactory({
+  variableName: "CLOUDFLARE_CLIENT_ID",
+  defaultValue: /* @__PURE__ */ __name(() => "cbca97e7-c331-4cdd-8fd8-e25a451b98bf", "defaultValue")
+});
+function getCfConfigPath() {
+  return getGlobalConfigPath({
+    appName: "cloudflare",
+    leadingDot: false,
+    useLegacyHomeDir: false
+  });
+}
+__name(getCfConfigPath, "getCfConfigPath");
+
+// src/cf/scopes.ts
+var CF_SCOPES = [
+  "openid",
+  "offline",
+  "user:read",
+  "account:read",
+  "access:read",
+  "access:write",
+  "agw:read",
+  "agw:run",
+  "agw:write",
+  "ai:read",
+  "ai:write",
+  "ai-search:read",
+  "ai-search:run",
+  "ai-search:write",
+  "aiaudit:read",
+  "aiaudit:write",
+  "aig:read",
+  "aig:write",
+  "auditlogs:read",
+  "browser:read",
+  "browser:write",
+  "cfone:read",
+  "cfone:write",
+  "cloudchamber:write",
+  "connectivity:admin",
+  "connectivity:bind",
+  "connectivity:read",
+  "constellation:write",
+  "containers:write",
+  "d1:write",
+  "dex:read",
+  "dex:write",
+  "dns_analytics:read",
+  "dns_records:edit",
+  "dns_records:read",
+  "dns_settings:read",
+  "firstpartytags:write",
+  "images:read",
+  "images:write",
+  "lb:edit",
+  "lb:read",
+  "logpush:read",
+  "logpush:write",
+  "mcp_portals:read",
+  "mcp_portals:write",
+  "notebook-examples:read",
+  "notification:read",
+  "notification:write",
+  "pages:read",
+  "pages:write",
+  "pipelines:read",
+  "pipelines:setup",
+  "pipelines:write",
+  "query_cache:write",
+  "queues:write",
+  "r2_catalog:write",
+  "radar:read",
+  "rag:read",
+  "rag:write",
+  "registrar:read",
+  "registrar:write",
+  "secrets_store:read",
+  "secrets_store:write",
+  "sso-connector:read",
+  "sso-connector:write",
+  "ssl_certs:write",
+  "teams:pii",
+  "teams:read",
+  "teams:secure_location",
+  "teams:write",
+  "url_scanner:read",
+  "url_scanner:write",
+  "vectorize:write",
+  "workers:read",
+  "workers:write",
+  "workers_builds:read",
+  "workers_builds:write",
+  "workers_deployments:read",
+  "workers_kv:write",
+  "workers_observability:read",
+  "workers_observability:write",
+  "workers_observability_telemetry:write",
+  "workers_routes:write",
+  "workers_scripts:write",
+  "workers_tail:read",
+  "zone:read"
+];
+var DefaultScopeKeys = [...CF_SCOPES];
+function setLoginScopeKeys(scopes) {
+  DefaultScopeKeys = scopes;
+}
+__name(setLoginScopeKeys, "setLoginScopeKeys");
+var CF_SCOPE_SET = new Set(CF_SCOPES);
+function validateScopeKeys(scopes) {
+  return scopes.every((scope) => CF_SCOPE_SET.has(scope));
+}
+__name(validateScopeKeys, "validateScopeKeys");
+function getTemporaryAccountConfigFile() {
+  const environment = getCloudflareApiEnvironmentFromEnv();
+  return environment === "production" ? "cloudflare-temporary-account.json" : `cloudflare-temporary-account.${environment}.json`;
+}
+__name(getTemporaryAccountConfigFile, "getTemporaryAccountConfigFile");
+function getCfTemporaryAccountConfigPath() {
+  return path.join(getCfConfigPath(), getTemporaryAccountConfigFile());
+}
+__name(getCfTemporaryAccountConfigPath, "getCfTemporaryAccountConfigPath");
+
+// src/cf/auth-config-file.ts
+function createJsonFileStorage(getPath) {
+  return createFileStorage("json", getPath);
+}
+__name(createJsonFileStorage, "createJsonFileStorage");
+var {
+  getAuthConfigFilePath,
+  getEncryptedAuthConfigFilePath,
+  defaultAuthConfigStorage,
+  readAuthConfigFile,
+  writeAuthConfigFile
+} = createAuthConfigFileHelpers({
+  getConfigPath: getCfConfigPath,
+  format: "json"
+});
+
+// src/cf/index.ts
+var CF_CLI = {
+  cliName: CF_CLI_NAME,
+  commands: {
+    login: "cf auth login",
+    whoami: "cf auth whoami"
+  },
+  keyringServiceName: CF_KEYRING_SERVICE_NAME,
+  clientId: getClientIdFromEnv,
+  consent: CF_CONSENT_PAGES,
+  redirectUri: CF_OAUTH_CALLBACK_URL,
+  // cf only supports the scoped `CLOUDFLARE_API_TOKEN` env var, not the global
+  // API key + email pair, so the global-key resolution is disabled.
+  allowGlobalAuthKey: false,
+  getConfigPath: getCfConfigPath,
+  getTemporaryAccountConfigPath: getCfTemporaryAccountConfigPath,
+  fileFormat: "json",
+  accountCachePrefix: "cloudflare-account",
+  // cf gets its own cache dir (`.cache/cloudflare` / `.cloudflare/cache`) so
+  // `cf auth login`/`logout` never purges wrangler's shared cache.
+  cacheNamespace: "cloudflare",
+  // cf persists its default account in `config.json` (`defaults.accountId`);
+  // this label is surfaced in the "set account_id in your <file>" hint.
+  getConfigFileLabel: /* @__PURE__ */ __name(() => "cf config", "getConfigFileLabel"),
+  getDefaultScopeKeys: /* @__PURE__ */ __name(() => DefaultScopeKeys, "getDefaultScopeKeys")
+};
+var cfPreferences = createPreferences(getCfConfigPath);
+var { readUserPreferences, updateUserPreferences } = cfPreferences;
+function createCfAuth(ctx) {
+  return createCloudflareAuth(CF_CLI, ctx);
+}
+__name(createCfAuth, "createCfAuth");
+function createCfProfileStore(ctx) {
+  return createCloudflareProfileStore({
+    logger: ctx.logger,
+    getConfigPath: getCfConfigPath,
+    keyringServiceName: CF_KEYRING_SERVICE_NAME,
+    format: "json"
+  });
+}
+__name(createCfProfileStore, "createCfProfileStore");
+var cfKeyringPreference = createKeyringPreference({
+  loginCommand: CF_CLI.commands.login,
+  createProfileCommand: CF_CLI.commands.createProfile,
+  keyringServiceName: CF_KEYRING_SERVICE_NAME,
+  getConfigPath: getCfConfigPath,
+  format: "json",
+  preferences: cfPreferences
+});
+function setKeyringPreference(enabled, ctx) {
+  return cfKeyringPreference.setKeyringPreference(enabled, ctx);
+}
+__name(setKeyringPreference, "setKeyringPreference");
+
+export { CF_CLI, CF_KEYRING_SERVICE_NAME, CF_OAUTH_CALLBACK_URL, DefaultScopeKeys, createCfAuth, createCfProfileStore, createJsonFileStorage, defaultAuthConfigStorage, getAuthConfigFilePath, getCfConfigPath, getClientIdFromEnv, getEncryptedAuthConfigFilePath, readAuthConfigFile, readUserPreferences, setKeyringPreference, setLoginScopeKeys, updateUserPreferences, validateScopeKeys, writeAuthConfigFile };