@cloudflare/workers-auth 0.5.0 → 0.5.2

package/dist/cf/index.d.mts

@@ -1,6 +1,6 @@
-import { a as ConfigStorage, A as AuthConfigStorage, U as UserAuthConfig, b as OAuthFlowContext, k as ProfileStore } from '../file-format-CWtMNfzC.mjs';
-import { C as CliDescriptor, U as UserPreferences, A as AuthContext, a as CloudflareAuth, K as KeyringPreferenceContext, S as SetKeyringPreferenceResult } from '../keyring-preference-DMsAtawt.mjs';
-export { b as CloudflareLoginProps } from '../keyring-preference-DMsAtawt.mjs';
+import { a as ConfigStorage, A as AuthConfigStorage, U as UserAuthConfig, b as OAuthFlowContext, k as ProfileStore } from '../file-format-B1KgHuUR.mjs';
+import { C as CliDescriptor, U as UserPreferences, A as AuthContext, a as CloudflareAuth, K as KeyringPreferenceContext, S as SetKeyringPreferenceResult } from '../keyring-preference-BgjU5DM9.mjs';
+export { b as CloudflareLoginProps } from '../keyring-preference-BgjU5DM9.mjs';
 import '@cloudflare/workers-utils';
 
 /**

package/dist/cf/index.mjs

@@ -1,5 +1,5 @@
-import { createAuthConfigFileHelpers, createPreferences, createKeyringPreference, createFileStorage, createCloudflareAuth, createCloudflareProfileStore } from '../chunk-WJE5I5WS.mjs';
-import '../chunk-FX4KV7FS.mjs';
+import { createAuthConfigFileHelpers, createPreferences, createKeyringPreference, createFileStorage, createCloudflareAuth, createCloudflareProfileStore } from '../chunk-7PS36DJW.mjs';
+import '../chunk-5WRJ2ZUV.mjs';
 import { __name } from '../chunk-O6YSETKJ.mjs';
 import { getEnvironmentVariableFactory, getGlobalConfigPath, getCloudflareApiEnvironmentFromEnv } from '@cloudflare/workers-utils';
 import path from 'node:path';
@@ -160,7 +160,8 @@ var CF_CLI = {
   cliName: CF_CLI_NAME,
   commands: {
     login: "cf auth login",
-    whoami: "cf auth whoami"
+    whoami: "cf auth whoami",
+    createProfile: "cf auth create"
   },
   keyringServiceName: CF_KEYRING_SERVICE_NAME,
   clientId: getClientIdFromEnv,

package/dist/{chunk-FX4KV7FS.mjs → chunk-5WRJ2ZUV.mjs}

@@ -1,5 +1,5 @@
 import { __name } from './chunk-O6YSETKJ.mjs';
-import { getEnvironmentVariableFactory, getCloudflareApiEnvironmentFromEnv, getBooleanEnvironmentVariableFactory, UserError, readFileSync, getCloudflareApiBaseUrl, COMPLIANCE_REGION_CONFIG_PUBLIC, FatalError, getCloudflareComplianceRegion, parseTOML } from '@cloudflare/workers-utils';
+import { getEnvironmentVariableFactory, getCloudflareApiEnvironmentFromEnv, getBooleanEnvironmentVariableFactory, UserError, readFileSync, isNonInteractiveOrCI, getCloudflareApiBaseUrl, COMPLIANCE_REGION_CONFIG_PUBLIC, FatalError, getCloudflareComplianceRegion, parseTOML } from '@cloudflare/workers-utils';
 import { spawnSync } from 'node:child_process';
 import { fetch } from 'undici';
 import { webcrypto, createHash, randomBytes, createCipheriv, createDecipheriv } from 'node:crypto';
@@ -173,7 +173,6 @@ async function domainUsesAccess(domain, logger) {
 __name(domainUsesAccess, "domainUsesAccess");
 async function getAccessHeaders(domain, options) {
   const logger = options.logger;
-  const isNonInteractiveOrCI = options.isNonInteractiveOrCI;
   const clientId = getAccessClientIdFromEnv();
   const clientSecret = getAccessClientSecretFromEnv();
   if (clientId && clientSecret) {
@@ -198,7 +197,7 @@ async function getAccessHeaders(domain, options) {
     logger.debug("Using cached Access headers for domain:", domain);
     return headersCache[domain];
   }
-  if (isNonInteractiveOrCI()) {
+  if ((options.isNonInteractiveOrCI ?? isNonInteractiveOrCI)()) {
     throw new UserError(
       `The domain "${domain}" is behind Cloudflare Access, but no Access Service Token credentials were found and the current environment is non-interactive.
 Set the CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET environment variables to authenticate with an Access Service Token.
@@ -798,7 +797,7 @@ async function getAuthURL(scopes, clientId, redirectUri, state, generators) {
   });
 }
 __name(getAuthURL, "getAuthURL");
-async function exchangeRefreshTokenForAccessToken(logger, isNonInteractiveOrCI, clientId, storage) {
+async function exchangeRefreshTokenForAccessToken(logger, isNonInteractiveOrCI2, clientId, storage) {
   const storedRefreshToken = readStoredAuthState({
     warningLogger: logger,
     storage
@@ -811,7 +810,7 @@ async function exchangeRefreshTokenForAccessToken(logger, isNonInteractiveOrCI,
     refresh_token: storedRefreshToken?.value ?? "",
     client_id: clientId
   });
-  const response = await fetchAuthToken(params, logger, isNonInteractiveOrCI);
+  const response = await fetchAuthToken(params, logger, isNonInteractiveOrCI2);
   if (response.status >= 400) {
     let tokenExchangeResErr = void 0;
     try {
@@ -858,7 +857,7 @@ async function exchangeRefreshTokenForAccessToken(logger, isNonInteractiveOrCI,
   }
 }
 __name(exchangeRefreshTokenForAccessToken, "exchangeRefreshTokenForAccessToken");
-async function exchangeAuthCodeForAccessToken(state, logger, isNonInteractiveOrCI, clientId, redirectUri) {
+async function exchangeAuthCodeForAccessToken(state, logger, isNonInteractiveOrCI2, clientId, redirectUri) {
   const { authorizationCode, codeVerifier = "" } = state;
   if (!codeVerifier) {
     logger.warn("No code verifier is being sent.");
@@ -872,7 +871,7 @@ async function exchangeAuthCodeForAccessToken(state, logger, isNonInteractiveOrC
     client_id: clientId,
     code_verifier: codeVerifier
   });
-  const response = await fetchAuthToken(params, logger, isNonInteractiveOrCI);
+  const response = await fetchAuthToken(params, logger, isNonInteractiveOrCI2);
   if (!response.ok) {
     const { error } = await getJSONFromResponse(response, logger);
     if (error === "invalid_grant") {
@@ -900,7 +899,7 @@ async function exchangeAuthCodeForAccessToken(state, logger, isNonInteractiveOrC
   return accessContext;
 }
 __name(exchangeAuthCodeForAccessToken, "exchangeAuthCodeForAccessToken");
-async function fetchAuthToken(body, logger, isNonInteractiveOrCI) {
+async function fetchAuthToken(body, logger, isNonInteractiveOrCI2) {
   const headers = {
     "Content-Type": "application/x-www-form-urlencoded"
   };
@@ -914,7 +913,7 @@ async function fetchAuthToken(body, logger, isNonInteractiveOrCI) {
     );
     const accessHeaders = await getCloudflareAccessHeaders({
       logger,
-      isNonInteractiveOrCI
+      isNonInteractiveOrCI: isNonInteractiveOrCI2
     });
     Object.assign(headers, accessHeaders);
   }
@@ -1471,7 +1470,7 @@ function createProfileStore(args) {
           throw new UserError(
             `No profile is directly bound to "${formatDirectoryForUserError(normalizedDir)}". The active profile "${parentBinding.profile}" is bound at "${formatDirectoryForUserError(
               parentBinding.dir
-            )}". Run \`wrangler auth deactivate\` from that directory instead.`,
+            )}". Run the deactivate command from that directory instead.`,
             { telemetryMessage: "auth deactivate wrong directory" }
           );
         }
@@ -1550,7 +1549,7 @@ __name(createProfileStore, "createProfileStore");
 function validateProfileName(name) {
   if (RESERVED_PROFILE_NAMES.includes(name.toLowerCase())) {
     throw new UserError(
-      `"${name}" is a reserved profile name. Use \`wrangler login\` and \`wrangler logout\` to manage the default profile, which applies as a global fallback.`,
+      `"${name}" is a reserved profile name. Use the login and logout commands to manage the default profile, which applies as a global fallback.`,
       { telemetryMessage: "auth profile reserved name" }
     );
   }
@@ -2888,7 +2887,6 @@ function setKeyringEntryFactory(factory) {
   entryFactoryOverride = factory;
 }
 __name(setKeyringEntryFactory, "setKeyringEntryFactory");
-var dynamicRequire = createRequire(__filename);
 function resolveKeyringEntryFactory(installDir) {
   if (entryFactoryOverride !== void 0) {
     return entryFactoryOverride;
@@ -2899,7 +2897,7 @@ function resolveKeyringEntryFactory(installDir) {
       "`@napi-rs/keyring` binding not found. Call `installKeyringBindingSync()` first."
     );
   }
-  const mod = dynamicRequire(bindingPath);
+  const mod = createRequire(bindingPath)(bindingPath);
   return (service, account) => new mod.Entry(service, account);
 }
 __name(resolveKeyringEntryFactory, "resolveKeyringEntryFactory");

package/dist/{chunk-WJE5I5WS.mjs → chunk-7PS36DJW.mjs}

@@ -1,4 +1,4 @@
-import { stringifyFile, parseFile, dedent, createCredentialStorageContext, createOAuthFlow, getAuthFromEnv, createProfileStore, getCloudflareAccountIdFromEnv, getAuthConfigFilePath, getEncryptedAuthConfigFilePath, scrubEncryptedCredentials, validateProfileName, getCloudflareAuthUseKeyringFromEnv } from './chunk-FX4KV7FS.mjs';
+import { stringifyFile, parseFile, dedent, createCredentialStorageContext, createOAuthFlow, getAuthFromEnv, createProfileStore, getCloudflareAccountIdFromEnv, getAuthConfigFilePath, getEncryptedAuthConfigFilePath, scrubEncryptedCredentials, validateProfileName, getCloudflareAuthUseKeyringFromEnv } from './chunk-5WRJ2ZUV.mjs';
 import { __name } from './chunk-O6YSETKJ.mjs';
 import { existsSync, rmSync, mkdirSync, writeFileSync, chmodSync, readFileSync as readFileSync$1, readdirSync } from 'node:fs';
 import path3 from 'node:path';

package/dist/{file-format-CWtMNfzC.d.mts → file-format-B1KgHuUR.d.mts}

@@ -1,4 +1,4 @@
-import { ComplianceConfig, ApiCredentials } from '@cloudflare/workers-utils';
+import { Logger, ComplianceConfig, ApiCredentials } from '@cloudflare/workers-utils';
 
 /**
  * Pluggable persistence for a typed config blob.
@@ -126,13 +126,7 @@ interface OAuthConsentPages {
  * Subset of the wrangler `logger` singleton used by the OAuth flow.
  * Consumers pass in an implementation that maps to their own logging surface.
  */
-interface OAuthFlowLogger {
-    debug(...args: unknown[]): void;
-    info(...args: unknown[]): void;
-    log(...args: unknown[]): void;
-    warn(...args: unknown[]): void;
-    error(...args: unknown[]): void;
-}
+type OAuthFlowLogger = Logger;
 /**
  * Dependency-injection surface for {@link createOAuthFlow}.
  *

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { O as OAuthFlowLogger, U as UserAuthConfig, A as AuthConfigStorage, C as CredentialStore, F as FileFormat } from './file-format-CWtMNfzC.mjs';
-export { a as ConfigStorage, D as DeactivateDirectoryResult, i as DirectoryBindingOperations, j as DirectoryBindingsStorage, L as LoginOrRefreshFailureReason, d as LoginOrRefreshResult, e as LoginProps, b as OAuthFlowContext, P as ProfileConfigOperations, k as ProfileStore, T as TemporaryPreviewAccount, c as createOAuthFlow, h as createProfileStore, g as generateAuthUrl, f as generateRandomState, v as validateProfileName } from './file-format-CWtMNfzC.mjs';
+import { O as OAuthFlowLogger, U as UserAuthConfig, A as AuthConfigStorage, C as CredentialStore, F as FileFormat } from './file-format-B1KgHuUR.mjs';
+export { a as ConfigStorage, D as DeactivateDirectoryResult, i as DirectoryBindingOperations, j as DirectoryBindingsStorage, L as LoginOrRefreshFailureReason, d as LoginOrRefreshResult, e as LoginProps, b as OAuthFlowContext, P as ProfileConfigOperations, k as ProfileStore, T as TemporaryPreviewAccount, c as createOAuthFlow, h as createProfileStore, g as generateAuthUrl, f as generateRandomState, v as validateProfileName } from './file-format-B1KgHuUR.mjs';
 import { ApiCredentials } from '@cloudflare/workers-utils';
 import { SpawnSyncReturns } from 'node:child_process';
 
@@ -61,7 +61,7 @@ declare function domainUsesAccess(domain: string, logger: OAuthFlowLogger): Prom
  */
 declare function getAccessHeaders(domain: string, options: {
     logger: OAuthFlowLogger;
-    isNonInteractiveOrCI: () => boolean;
+    isNonInteractiveOrCI?: () => boolean;
 }): Promise<Record<string, string>>;
 
 /**

package/dist/index.mjs

@@ -1,2 +1,2 @@
-export { EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, validateProfileName } from './chunk-FX4KV7FS.mjs';
+export { EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, validateProfileName } from './chunk-5WRJ2ZUV.mjs';
 import './chunk-O6YSETKJ.mjs';

package/dist/{keyring-preference-DMsAtawt.d.mts → keyring-preference-BgjU5DM9.d.mts}

@@ -1,4 +1,4 @@
-import { l as OAuthConsentPages, F as FileFormat, b as OAuthFlowContext, C as CredentialStore, d as LoginOrRefreshResult, U as UserAuthConfig } from './file-format-CWtMNfzC.mjs';
+import { l as OAuthConsentPages, F as FileFormat, b as OAuthFlowContext, C as CredentialStore, d as LoginOrRefreshResult, U as UserAuthConfig } from './file-format-B1KgHuUR.mjs';
 import { ApiCredentials, ComplianceConfig } from '@cloudflare/workers-utils';
 
 /** Minimal shape of the interactive `select` prompt's options for account selection. */
@@ -48,7 +48,7 @@ interface CliDescriptor {
     commands: {
         login: string;
         whoami: string;
-        createProfile?: string;
+        createProfile: string;
     };
     /**
      * OS-keyring service identifier. Becomes the `-s` arg to macOS `security`,