@cloudflare/workers-auth 0.5.4 → 0.5.6

package/dist/cf/index.mjs

@@ -1,5 +1,5 @@
-import { createAuthConfigFileHelpers, createPreferences, createKeyringPreference, createFileStorage, createCloudflareAuth, createCloudflareProfileStore } from '../chunk-RTFTHYPD.mjs';
-import '../chunk-PBW6773T.mjs';
+import { createAuthConfigFileHelpers, createPreferences, createKeyringPreference, createFileStorage, createCloudflareAuth, createCloudflareProfileStore } from '../chunk-CEH7NWR7.mjs';
+import '../chunk-7ZPLVMOI.mjs';
 import { __name } from '../chunk-O6YSETKJ.mjs';
 import { getEnvironmentVariableFactory, getGlobalConfigPath, getCloudflareApiEnvironmentFromEnv } from '@cloudflare/workers-utils';
 import path from 'node:path';

package/dist/{chunk-PBW6773T.mjs → chunk-7ZPLVMOI.mjs}

@@ -99,6 +99,19 @@ function requireApiToken(options) {
   return credentials;
 }
 __name(requireApiToken, "requireApiToken");
+var ACCOUNT_ID_PATTERN = /^[A-Za-z0-9_-]+$/;
+function validateAccountId(accountId, source) {
+  if (!ACCOUNT_ID_PATTERN.test(accountId)) {
+    throw new UserError(
+      `Invalid account ID "${accountId}" ${source}. Account IDs may only contain alphanumeric characters, hyphens, and underscores.`,
+      { telemetryMessage: "user account id invalid characters" }
+    );
+  }
+  return accountId;
+}
+__name(validateAccountId, "validateAccountId");
+
+// src/env-vars.ts
 var getAuthDomainFromEnv = getEnvironmentVariableFactory({
   variableName: "WRANGLER_AUTH_DOMAIN",
   defaultValue: /* @__PURE__ */ __name(() => getCloudflareApiEnvironmentFromEnv() === "staging" ? "dash.staging.cloudflare.com" : "dash.cloudflare.com", "defaultValue")
@@ -115,10 +128,21 @@ var getRevokeUrlFromEnv = getEnvironmentVariableFactory({
   variableName: "WRANGLER_REVOKE_URL",
   defaultValue: /* @__PURE__ */ __name(() => `https://${getAuthDomainFromEnv()}/oauth2/revoke`, "defaultValue")
 });
-var getCloudflareAccountIdFromEnv = getEnvironmentVariableFactory({
+var readCloudflareAccountIdFromEnv = getEnvironmentVariableFactory({
   variableName: "CLOUDFLARE_ACCOUNT_ID",
   deprecatedName: "CF_ACCOUNT_ID"
 });
+function getCloudflareAccountIdFromEnv() {
+  const accountId = readCloudflareAccountIdFromEnv();
+  if (!accountId) {
+    return void 0;
+  }
+  return validateAccountId(
+    accountId,
+    "set in the `CLOUDFLARE_ACCOUNT_ID` environment variable"
+  );
+}
+__name(getCloudflareAccountIdFromEnv, "getCloudflareAccountIdFromEnv");
 var getAccessClientIdFromEnv = getEnvironmentVariableFactory({
   variableName: "CLOUDFLARE_ACCESS_CLIENT_ID"
 });
@@ -3724,4 +3748,4 @@ smol-toml/dist/index.js:
    *)
 */
 
-export { EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, dedent, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, parseFile, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, stringifyFile, validateProfileName };
+export { EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, dedent, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, parseFile, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, stringifyFile, validateAccountId, validateProfileName };

package/dist/{chunk-RTFTHYPD.mjs → chunk-CEH7NWR7.mjs}

@@ -1,4 +1,4 @@
-import { stringifyFile, parseFile, dedent, createCredentialStorageContext, createOAuthFlow, getAuthFromEnv, createProfileStore, getCloudflareAccountIdFromEnv, getAuthConfigFilePath, getEncryptedAuthConfigFilePath, scrubEncryptedCredentials, validateProfileName, getCloudflareAuthUseKeyringFromEnv } from './chunk-PBW6773T.mjs';
+import { stringifyFile, parseFile, dedent, createCredentialStorageContext, createOAuthFlow, getAuthFromEnv, createProfileStore, validateAccountId, getCloudflareAccountIdFromEnv, getAuthConfigFilePath, getEncryptedAuthConfigFilePath, scrubEncryptedCredentials, validateProfileName, getCloudflareAuthUseKeyringFromEnv } from './chunk-7ZPLVMOI.mjs';
 import { __name } from './chunk-O6YSETKJ.mjs';
 import { existsSync, rmSync, mkdirSync, writeFileSync, chmodSync, readFileSync as readFileSync$1, readdirSync } from 'node:fs';
 import path3 from 'node:path';
@@ -1012,7 +1012,10 @@ Alternatively, try running \`${descriptor.commands.login}\` to re-authenticate.`
       return temporaryAccount.account.id;
     }
     if (config.account_id) {
-      return config.account_id;
+      return validateAccountId(
+        config.account_id,
+        `set as \`account_id\` in your ${descriptor.getConfigFileLabel()} file`
+      );
     }
     const envAccountId = getCloudflareAccountIdFromEnv();
     if (envAccountId) {

package/dist/index.d.mts

@@ -81,8 +81,13 @@ declare const getAuthUrlFromEnv: () => string;
  * This is a Cloudflare-wide variable (not wrangler-specific), so it lives in the
  * shared core rather than a consumer layer. `CF_ACCOUNT_ID` is the deprecated
  * spelling.
+ *
+ * Every caller feeds the result into a Cloudflare API URL path, so the value is
+ * validated here rather than at each call site. An empty string is treated as
+ * unset so callers keep falling back to the cached / interactively selected
+ * account.
  */
-declare const getCloudflareAccountIdFromEnv: () => string | undefined;
+declare function getCloudflareAccountIdFromEnv(): string | undefined;
 /**
  * `CLOUDFLARE_AUTH_USE_KEYRING` overrides where OAuth credentials are stored.
  *

package/dist/index.mjs

@@ -1,2 +1,2 @@
-export { EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, validateProfileName } from './chunk-PBW6773T.mjs';
+export { EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, validateProfileName } from './chunk-7ZPLVMOI.mjs';
 import './chunk-O6YSETKJ.mjs';