@cloudflare/workers-auth 0.4.2 → 0.5.0

package/dist/wrangler/index.d.mts

@@ -0,0 +1,119 @@
+import { a as ConfigStorage, A as AuthConfigStorage, U as UserAuthConfig, b as OAuthFlowContext, k as ProfileStore } from '../file-format-CWtMNfzC.mjs';
+import { A as AuthContext, a as CloudflareAuth, b as CloudflareLoginProps, C as CliDescriptor, U as UserPreferences, K as KeyringPreferenceContext, S as SetKeyringPreferenceResult } from '../keyring-preference-DMsAtawt.mjs';
+import '@cloudflare/workers-utils';
+
+/**
+ * A TOML-file-on-disk storage backend, parameterised by the path it reads and
+ * writes. Wrangler's historical file format is TOML, so this is a thin
+ * `TOML`-bound wrapper over the CLI-agnostic {@link createFileStorage}.
+ */
+declare function createTomlFileStorage<T extends object>(getPath: () => string): ConfigStorage<T>;
+declare const getAuthConfigFilePath: (profile?: string) => string;
+declare const getEncryptedAuthConfigFilePath: (profile?: string) => string;
+declare const defaultAuthConfigStorage: (profile?: string) => AuthConfigStorage;
+declare const readAuthConfigFile: (profile?: string) => UserAuthConfig | undefined;
+declare const writeAuthConfigFile: (config: UserAuthConfig, profile?: string) => void;
+
+declare const DefaultScopes: {
+    readonly "account:read": "See your account info such as account details, analytics, and memberships.";
+    readonly "user:read": "See your user info such as name, email address, and account memberships.";
+    readonly "workers:write": "See and change Cloudflare Workers data such as zones, KV storage, namespaces, scripts, and routes.";
+    readonly "workers_kv:write": "See and change Cloudflare Workers KV Storage data such as keys and namespaces.";
+    readonly "workers_routes:write": "See and change Cloudflare Workers data such as filters and routes.";
+    readonly "workers_scripts:write": "See and change Cloudflare Workers scripts, durable objects, subdomains, triggers, and tail data.";
+    readonly "workers_tail:read": "See Cloudflare Workers tail and script data.";
+    readonly "d1:write": "See and change D1 Databases.";
+    readonly "pages:write": "See and change Cloudflare Pages projects, settings and deployments.";
+    readonly "zone:read": "Grants read level access to account zone.";
+    readonly "ssl_certs:write": "See and manage mTLS certificates for your account";
+    readonly "ai:write": "See and change Workers AI catalog and assets";
+    readonly "ai-search:write": "See and change AI Search data";
+    readonly "ai-search:run": "Run search queries on your AI Search instances";
+    readonly "websearch.run": "Run search queries against Cloudflare Web Search";
+    readonly "agent-memory:write": "See and change Agent Memory data such as keys and namespaces.";
+    readonly "queues:write": "See and change Cloudflare Queues settings and data";
+    readonly "pipelines:write": "See and change Cloudflare Pipelines configurations and data";
+    readonly "secrets_store:write": "See and change secrets + stores within the Secrets Store";
+    readonly "artifacts:write": "See and change Cloudflare Artifacts data such as registries and artifacts";
+    readonly "flagship:write": "See and change Flagship feature flags and apps";
+    readonly "containers:write": "Manage Workers Containers";
+    readonly "cloudchamber:write": "Manage Cloudchamber";
+    readonly "connectivity:admin": "See, change, and bind to Connectivity Directory services, including creating services targeting Cloudflare Tunnel.";
+    readonly "email_routing:write": "See and change Email Routing settings, rules, and destination addresses.";
+    readonly "email_sending:write": "See and change Email Sending settings and configuration.";
+    readonly "browser:write": "See and manage Browser Run sessions";
+    readonly "challenge-widgets.write": "See and change Turnstile widgets";
+};
+/**
+ * The possible keys for a Scope.
+ *
+ * "offline_access" is automatically included.
+ */
+type Scope = keyof typeof DefaultScopes;
+declare let DefaultScopeKeys: Scope[];
+declare function setLoginScopeKeys(scopes: Scope[]): void;
+declare function validateScopeKeys(scopes: string[]): scopes is typeof DefaultScopeKeys;
+
+/**
+ * `WRANGLER_CLIENT_ID` is the UUID of Wrangler's registered OAuth app, used to
+ * identify Wrangler to the Cloudflare OAuth server.
+ *
+ * This is wrangler CLI config (the app UUIDs and the `WRANGLER_*` variable
+ * name are Wrangler's), so it lives in the `/wrangler` layer rather than the
+ * shared core — a future `/cf` entrypoint has its own OAuth app.
+ *
+ * Normally you should not need to set this explicitly. To switch to the staging
+ * environment set `WRANGLER_API_ENVIRONMENT=staging` instead.
+ */
+declare const getClientIdFromEnv: () => string;
+
+/**
+ * Keyring service identifier passed to `createCredentialStorageContext` and to
+ * the opt-out scrub in wrangler's `commands.ts`. Exported (re-exported from
+ * `./index.ts`) so every site stays in sync — this becomes the `-s` arg to
+ * macOS `security`, the `service` attribute for Linux `secret-tool`, and the
+ * `service` arg to `@napi-rs/keyring`'s `Entry` on Windows.
+ */
+declare const WRANGLER_KEYRING_SERVICE_NAME = "wrangler";
+/** The `redirect_uri` registered on Wrangler's OAuth app. */
+declare const OAUTH_CALLBACK_URL = "http://localhost:8976/oauth/callback";
+
+/** @deprecated Use {@link AuthContext}. Kept as an alias for wrangler's historical name. */
+type WranglerAuthContext = AuthContext;
+/** @deprecated Use {@link CloudflareAuth}. */
+type WranglerAuth = CloudflareAuth;
+/** @deprecated Use {@link CloudflareLoginProps}. */
+type WranglerLoginProps = CloudflareLoginProps;
+/**
+ * The wrangler {@link CliDescriptor}: TOML files under wrangler's global config
+ * directory, wrangler's OAuth app / consent pages, the `"wrangler"` keyring
+ * service, and wrangler-worded copy.
+ */
+declare const WRANGLER_CLI: CliDescriptor;
+declare const readUserPreferences: () => UserPreferences;
+declare const updateUserPreferences: (update: Partial<UserPreferences>) => void;
+
+/**
+ * Build wrangler's auth layer, injecting the few consumer primitives that can't
+ * move into the shared package (logger, interactive `prompt` / `select`, and
+ * the User-Agent string).
+ */
+declare function createWranglerAuth(ctx: AuthContext): CloudflareAuth;
+/** Consumer primitives {@link createWranglerProfileStore} needs. */
+interface WranglerProfileStoreContext {
+    logger: OAuthFlowContext["logger"];
+}
+/**
+ * Build wrangler's {@link ProfileStore} (TOML `.toml` / `.enc` files under the
+ * global config dir), bound to wrangler's config path, keyring service, and
+ * TOML format.
+ */
+declare function createWranglerProfileStore(ctx: WranglerProfileStoreContext): ProfileStore;
+/**
+ * Apply and persist the global keyring-storage preference. Shared by
+ * `wrangler auth keyring enable|disable` and `wrangler login --use-keyring` /
+ * `--no-use-keyring`.
+ */
+declare function setKeyringPreference(enabled: boolean, ctx: KeyringPreferenceContext): SetKeyringPreferenceResult;
+
+export { DefaultScopeKeys, DefaultScopes, KeyringPreferenceContext, OAUTH_CALLBACK_URL, type Scope, SetKeyringPreferenceResult, UserPreferences, WRANGLER_CLI, WRANGLER_KEYRING_SERVICE_NAME, type WranglerAuth, type WranglerAuthContext, type WranglerLoginProps, type WranglerProfileStoreContext, createTomlFileStorage, createWranglerAuth, createWranglerProfileStore, defaultAuthConfigStorage, getAuthConfigFilePath, getClientIdFromEnv, getEncryptedAuthConfigFilePath, readAuthConfigFile, readUserPreferences, setKeyringPreference, setLoginScopeKeys, updateUserPreferences, validateScopeKeys, writeAuthConfigFile };

package/dist/wrangler/index.mjs

@@ -0,0 +1,139 @@
+import { createAuthConfigFileHelpers, createPreferences, createKeyringPreference, createFileStorage, createCloudflareAuth, createCloudflareProfileStore } from '../chunk-WJE5I5WS.mjs';
+import '../chunk-FX4KV7FS.mjs';
+import { __name } from '../chunk-O6YSETKJ.mjs';
+import { getEnvironmentVariableFactory, getCloudflareApiEnvironmentFromEnv, getGlobalConfigPath, configFileName } from '@cloudflare/workers-utils';
+import path from 'node:path';
+
+// src/core/scopes.ts
+var DefaultScopes = {
+  "account:read": "See your account info such as account details, analytics, and memberships.",
+  "user:read": "See your user info such as name, email address, and account memberships.",
+  "workers:write": "See and change Cloudflare Workers data such as zones, KV storage, namespaces, scripts, and routes.",
+  "workers_kv:write": "See and change Cloudflare Workers KV Storage data such as keys and namespaces.",
+  "workers_routes:write": "See and change Cloudflare Workers data such as filters and routes.",
+  "workers_scripts:write": "See and change Cloudflare Workers scripts, durable objects, subdomains, triggers, and tail data.",
+  "workers_tail:read": "See Cloudflare Workers tail and script data.",
+  "d1:write": "See and change D1 Databases.",
+  "pages:write": "See and change Cloudflare Pages projects, settings and deployments.",
+  "zone:read": "Grants read level access to account zone.",
+  "ssl_certs:write": "See and manage mTLS certificates for your account",
+  "ai:write": "See and change Workers AI catalog and assets",
+  "ai-search:write": "See and change AI Search data",
+  "ai-search:run": "Run search queries on your AI Search instances",
+  "websearch.run": "Run search queries against Cloudflare Web Search",
+  "agent-memory:write": "See and change Agent Memory data such as keys and namespaces.",
+  "queues:write": "See and change Cloudflare Queues settings and data",
+  "pipelines:write": "See and change Cloudflare Pipelines configurations and data",
+  "secrets_store:write": "See and change secrets + stores within the Secrets Store",
+  "artifacts:write": "See and change Cloudflare Artifacts data such as registries and artifacts",
+  "flagship:write": "See and change Flagship feature flags and apps",
+  "containers:write": "Manage Workers Containers",
+  "cloudchamber:write": "Manage Cloudchamber",
+  "connectivity:admin": "See, change, and bind to Connectivity Directory services, including creating services targeting Cloudflare Tunnel.",
+  "email_routing:write": "See and change Email Routing settings, rules, and destination addresses.",
+  "email_sending:write": "See and change Email Sending settings and configuration.",
+  "browser:write": "See and manage Browser Run sessions",
+  "challenge-widgets.write": "See and change Turnstile widgets"
+};
+var DefaultScopeKeys = Object.keys(DefaultScopes);
+function setLoginScopeKeys(scopes) {
+  DefaultScopeKeys = scopes;
+}
+__name(setLoginScopeKeys, "setLoginScopeKeys");
+function validateScopeKeys(scopes) {
+  return scopes.every((scope) => scope in DefaultScopes);
+}
+__name(validateScopeKeys, "validateScopeKeys");
+
+// src/wrangler/constants.ts
+var WRANGLER_KEYRING_SERVICE_NAME = "wrangler";
+var WRANGLER_CLI_NAME = "wrangler";
+var OAUTH_CALLBACK_URL = "http://localhost:8976/oauth/callback";
+var WRANGLER_CONSENT_PAGES = {
+  granted: {
+    url: "https://welcome.developers.workers.dev/wrangler-oauth-consent-granted"
+  },
+  denied: {
+    url: "https://welcome.developers.workers.dev/wrangler-oauth-consent-denied",
+    error: "Error: Consent denied. You must grant consent to Wrangler in order to login.\nIf you don't want to do this consider passing an API token via the `CLOUDFLARE_API_TOKEN` environment variable"
+  }
+};
+var getClientIdFromEnv = getEnvironmentVariableFactory({
+  variableName: "WRANGLER_CLIENT_ID",
+  defaultValue: /* @__PURE__ */ __name(() => getCloudflareApiEnvironmentFromEnv() === "staging" ? "4b2ea6cc-9421-4761-874b-ce550e0e3def" : "54d11594-84e4-41aa-b438-e81b8fa78ee7", "defaultValue")
+});
+function getTemporaryAccountConfigFile() {
+  const environment = getCloudflareApiEnvironmentFromEnv();
+  return environment === "production" ? "wrangler-temporary-account.toml" : `wrangler-temporary-account.${environment}.toml`;
+}
+__name(getTemporaryAccountConfigFile, "getTemporaryAccountConfigFile");
+function getTemporaryPreviewAccountConfigPath() {
+  return path.join(getGlobalConfigPath(), getTemporaryAccountConfigFile());
+}
+__name(getTemporaryPreviewAccountConfigPath, "getTemporaryPreviewAccountConfigPath");
+function createTomlFileStorage(getPath) {
+  return createFileStorage("toml", getPath);
+}
+__name(createTomlFileStorage, "createTomlFileStorage");
+var {
+  getAuthConfigFilePath,
+  getEncryptedAuthConfigFilePath,
+  defaultAuthConfigStorage,
+  readAuthConfigFile,
+  writeAuthConfigFile
+} = createAuthConfigFileHelpers({
+  getConfigPath: getGlobalConfigPath,
+  format: "toml"
+});
+
+// src/wrangler/index.ts
+var WRANGLER_CLI = {
+  cliName: WRANGLER_CLI_NAME,
+  commands: {
+    login: "wrangler login",
+    whoami: "wrangler whoami",
+    createProfile: "wrangler auth create"
+  },
+  keyringServiceName: WRANGLER_KEYRING_SERVICE_NAME,
+  clientId: getClientIdFromEnv,
+  consent: WRANGLER_CONSENT_PAGES,
+  redirectUri: OAUTH_CALLBACK_URL,
+  allowGlobalAuthKey: true,
+  getConfigPath: getGlobalConfigPath,
+  getTemporaryAccountConfigPath: getTemporaryPreviewAccountConfigPath,
+  fileFormat: "toml",
+  accountCachePrefix: "wrangler-account",
+  getConfigFileLabel: /* @__PURE__ */ __name(() => configFileName(void 0), "getConfigFileLabel"),
+  // A getter so any reassignment of the live `DefaultScopeKeys` binding is
+  // observed rather than captured at wiring time.
+  getDefaultScopeKeys: /* @__PURE__ */ __name(() => DefaultScopeKeys, "getDefaultScopeKeys")
+};
+var wranglerPreferences = createPreferences(getGlobalConfigPath);
+var { readUserPreferences, updateUserPreferences } = wranglerPreferences;
+function createWranglerAuth(ctx) {
+  return createCloudflareAuth(WRANGLER_CLI, ctx);
+}
+__name(createWranglerAuth, "createWranglerAuth");
+function createWranglerProfileStore(ctx) {
+  return createCloudflareProfileStore({
+    logger: ctx.logger,
+    getConfigPath: getGlobalConfigPath,
+    keyringServiceName: WRANGLER_KEYRING_SERVICE_NAME,
+    format: "toml"
+  });
+}
+__name(createWranglerProfileStore, "createWranglerProfileStore");
+var wranglerKeyringPreference = createKeyringPreference({
+  loginCommand: WRANGLER_CLI.commands.login,
+  createProfileCommand: WRANGLER_CLI.commands.createProfile,
+  keyringServiceName: WRANGLER_KEYRING_SERVICE_NAME,
+  getConfigPath: getGlobalConfigPath,
+  format: "toml",
+  preferences: wranglerPreferences
+});
+function setKeyringPreference(enabled, ctx) {
+  return wranglerKeyringPreference.setKeyringPreference(enabled, ctx);
+}
+__name(setKeyringPreference, "setKeyringPreference");
+
+export { DefaultScopeKeys, DefaultScopes, OAUTH_CALLBACK_URL, WRANGLER_CLI, WRANGLER_KEYRING_SERVICE_NAME, createTomlFileStorage, createWranglerAuth, createWranglerProfileStore, defaultAuthConfigStorage, getAuthConfigFilePath, getClientIdFromEnv, getEncryptedAuthConfigFilePath, readAuthConfigFile, readUserPreferences, setKeyringPreference, setLoginScopeKeys, updateUserPreferences, validateScopeKeys, writeAuthConfigFile };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cloudflare/workers-auth",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "description": "Internal OAuth 2.0 + PKCE flow for Cloudflare CLIs. Not intended for external use — APIs may change without notice.",
   "homepage": "https://github.com/cloudflare/workers-sdk/tree/main/packages/workers-auth#readme",
   "bugs": {
@@ -22,6 +22,14 @@
       "import": "./dist/index.mjs",
       "types": "./dist/index.d.mts"
     },
+    "./wrangler": {
+      "import": "./dist/wrangler/index.mjs",
+      "types": "./dist/wrangler/index.d.mts"
+    },
+    "./cf": {
+      "import": "./dist/cf/index.mjs",
+      "types": "./dist/cf/index.d.mts"
+    },
     "./test-helpers": {
       "import": "./dist/test-helpers/index.mjs",
       "types": "./dist/test-helpers/index.d.mts"
@@ -29,12 +37,13 @@
   },
   "dependencies": {
     "undici": "7.28.0",
-    "@cloudflare/workers-utils": "0.26.0"
+    "@cloudflare/workers-utils": "0.27.0"
   },
   "devDependencies": {
     "@types/node": "22.15.17",
     "@vitest/ui": "4.1.0",
     "concurrently": "^8.2.2",
+    "date-fns": "^4.1.0",
     "msw": "2.12.4",
     "smol-toml": "1.5.2",
     "ts-dedent": "^2.2.0",