@cloudflare/workers-auth 0.9.0 → 0.9.1

package/dist/cf/index.d.mts

@@ -1,6 +1,6 @@
-import { a as ConfigStorage, A as AuthConfigStorage, U as UserAuthConfig, f as OAuthFlowContext, g as ProfileStore } from '../file-format-Bpmgm2Po.mjs';
-import { C as CliDescriptor, A as AuthContext, a as CloudflareAuth, U as UserPreferences, K as KeyringPreferenceContext, S as SetKeyringPreferenceResult } from '../keyring-preference-CWjI7ct9.mjs';
-export { b as CloudflareLoginProps } from '../keyring-preference-CWjI7ct9.mjs';
+import { a as ConfigStorage, A as AuthConfigStorage, U as UserAuthConfig, f as OAuthFlowContext, g as ProfileStore } from '../file-format-Dlt3H3sW.mjs';
+import { C as CliDescriptor, A as AuthContext, a as CloudflareAuth, U as UserPreferences, K as KeyringPreferenceContext, S as SetKeyringPreferenceResult } from '../keyring-preference-B8dU564W.mjs';
+export { b as CloudflareLoginProps } from '../keyring-preference-B8dU564W.mjs';
 import '@cloudflare/workers-utils';
 
 /**

package/dist/cf/index.mjs

@@ -1,5 +1,5 @@
-import { createAuthConfigFileHelpers, createPreferences, createKeyringPreference, createFileStorage, createCloudflareAuth, createCloudflareProfileStore } from '../chunk-A6F4WXCF.mjs';
-import '../chunk-4CJO23DA.mjs';
+import { createAuthConfigFileHelpers, createPreferences, createKeyringPreference, createFileStorage, createCloudflareAuth, createCloudflareProfileStore } from '../chunk-3U6VZT7T.mjs';
+import '../chunk-XLADBZ7F.mjs';
 import { __name } from '../chunk-O6YSETKJ.mjs';
 import { getEnvironmentVariableFactory, getGlobalConfigPath, getCloudflareApiEnvironmentFromEnv } from '@cloudflare/workers-utils';
 import path from 'node:path';

package/dist/{chunk-A6F4WXCF.mjs → chunk-3U6VZT7T.mjs}

@@ -1,4 +1,4 @@
-import { stringifyFile, parseFile, dedent, createCredentialStorageContext, createOAuthFlow, getAuthFromEnv, createProfileStore, validateAccountId, getCloudflareAccountIdFromEnv, getAuthConfigFilePath, getEncryptedAuthConfigFilePath, scrubEncryptedCredentials, validateProfileName, getCloudflareAuthUseKeyringFromEnv } from './chunk-4CJO23DA.mjs';
+import { stringifyFile, parseFile, dedent, createCredentialStorageContext, createOAuthFlow, getAuthFromEnv, createProfileStore, validateAccountId, getCloudflareAccountIdFromEnv, getAuthConfigFilePath, getEncryptedAuthConfigFilePath, scrubEncryptedCredentials, validateProfileName, getCloudflareAuthUseKeyringFromEnv } from './chunk-XLADBZ7F.mjs';
 import { __name } from './chunk-O6YSETKJ.mjs';
 import { existsSync, rmSync, mkdirSync, writeFileSync, chmodSync, readFileSync as readFileSync$1, readdirSync } from 'node:fs';
 import path3 from 'node:path';
@@ -838,8 +838,8 @@ Run \`${descriptor.commands.whoami}\` to check your current authentication statu
     return credentialStorage.getActiveStore(oauthFlow.getActiveProfile());
   }
   __name(getCredentialStore, "getCredentialStore");
-  function setTemporaryAllowed(allowed) {
-    oauthFlow.setTemporaryAllowed(allowed);
+  function setTemporaryAllowed(allowed, request) {
+    oauthFlow.setTemporaryAllowed(allowed, request);
   }
   __name(setTemporaryAllowed, "setTemporaryAllowed");
   function getAPIToken() {

package/dist/{chunk-4CJO23DA.mjs → chunk-XLADBZ7F.mjs}

@@ -1,5 +1,5 @@
 import { __name } from './chunk-O6YSETKJ.mjs';
-import { getEnvironmentVariableFactory, getCloudflareApiEnvironmentFromEnv, getBooleanEnvironmentVariableFactory, UserError, readFileSync, isNonInteractiveOrCI, getCloudflareApiBaseUrl, COMPLIANCE_REGION_CONFIG_PUBLIC, FatalError, getCloudflareComplianceRegion, parseTOML } from '@cloudflare/workers-utils';
+import { getEnvironmentVariableFactory, getCloudflareApiEnvironmentFromEnv, getBooleanEnvironmentVariableFactory, UserError, readFileSync, isNonInteractiveOrCI, FatalError, getCloudflareApiBaseUrl, COMPLIANCE_REGION_CONFIG_PUBLIC, getCloudflareComplianceRegion, parseTOML } from '@cloudflare/workers-utils';
 import { spawn, spawnSync } from 'node:child_process';
 import { fetch } from 'undici';
 import { webcrypto, createHash, randomBytes, createCipheriv, createDecipheriv } from 'node:crypto';
@@ -410,6 +410,95 @@ var TEMPORARY_TERMS_URLS = {
 var TEMPORARY_TERMS_PROMPT = `You must accept Cloudflare's Terms of Service (${TEMPORARY_TERMS_URLS.termsOfService}) and Privacy Policy (${TEMPORARY_TERMS_URLS.privacyPolicy}) in order to continue. By typing "yes", you agree to these terms. Type "yes" to continue.`;
 var TEMPORARY_TERMS_NOTICE = `Continuing means you accept Cloudflare's Terms of Service (${TEMPORARY_TERMS_URLS.termsOfService}) and Privacy Policy (${TEMPORARY_TERMS_URLS.privacyPolicy}).`;
 var TEMPORARY_TERMS_ERROR = `You must accept Cloudflare's Terms of Service (${TEMPORARY_TERMS_URLS.termsOfService}) and Privacy Policy (${TEMPORARY_TERMS_URLS.privacyPolicy}) to use --temporary.`;
+var EVENT_ACCOUNT_ERRORS = /* @__PURE__ */ new Map([
+  [
+    1035,
+    {
+      message: "The event code is malformed. Check it and try again.",
+      telemetryMessage: "deploy temporary event code invalid"
+    }
+  ],
+  [
+    1036,
+    {
+      message: "The event code was not found. Check it and try again.",
+      telemetryMessage: "deploy temporary event not found"
+    }
+  ],
+  [
+    1037,
+    {
+      message: "This event has not started yet.",
+      telemetryMessage: "deploy temporary event not started"
+    }
+  ],
+  [
+    1038,
+    {
+      message: "This event has ended.",
+      telemetryMessage: "deploy temporary event expired"
+    }
+  ],
+  [
+    1039,
+    {
+      message: "This event is disabled. Contact the event organizer.",
+      telemetryMessage: "deploy temporary event disabled"
+    }
+  ],
+  [
+    1040,
+    {
+      message: "This event has no temporary accounts remaining.",
+      telemetryMessage: "deploy temporary event exhausted"
+    }
+  ],
+  [
+    1041,
+    {
+      message: "The event account could not be prepared. Try again later or contact the event organizer.",
+      telemetryMessage: "deploy temporary event provisioning unavailable",
+      fatal: true
+    }
+  ]
+]);
+function getResponseErrorCode(body) {
+  if (typeof body !== "object" || body === null || !("errors" in body)) {
+    return void 0;
+  }
+  const { errors } = body;
+  if (!Array.isArray(errors) || errors.length === 0) {
+    return void 0;
+  }
+  const [error] = errors;
+  if (typeof error !== "object" || error === null || !("code" in error)) {
+    return void 0;
+  }
+  return typeof error.code === "number" ? error.code : void 0;
+}
+__name(getResponseErrorCode, "getResponseErrorCode");
+async function getEventAccountError(response) {
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    return void 0;
+  }
+  const errorCode = getResponseErrorCode(body);
+  if (errorCode === void 0) {
+    return void 0;
+  }
+  const eventError = EVENT_ACCOUNT_ERRORS.get(errorCode);
+  if (!eventError) {
+    return void 0;
+  }
+  const options = { telemetryMessage: eventError.telemetryMessage };
+  if (eventError.fatal) {
+    return new FatalError(eventError.message, options);
+  }
+  return new UserError(eventError.message, options);
+}
+__name(getEventAccountError, "getEventAccountError");
 function getTemporaryPreviewUrl() {
   return `${getCloudflareApiBaseUrl(COMPLIANCE_REGION_CONFIG_PUBLIC)}/provisioning/previews`;
 }
@@ -476,7 +565,7 @@ async function requestPowSolution(logger) {
   return solveChallenge({ challengeToken, seed, k, g });
 }
 __name(requestPowSolution, "requestPowSolution");
-async function createTemporaryPreviewAccount(logger) {
+async function createTemporaryPreviewAccount(logger, request) {
   const pow = await requestPowSolution(logger);
   const response = await fetch(getTemporaryPreviewUrl(), {
     method: "POST",
@@ -486,10 +575,17 @@ async function createTemporaryPreviewAccount(logger) {
       privacyPolicy: TEMPORARY_TERMS_URLS.privacyPolicy,
       acceptTermsOfService: "yes",
       challengeToken: pow.challengeToken,
-      solution: pow.solution
+      solution: pow.solution,
+      ...request?.eventCode ? { eventCode: request.eventCode } : {}
     })
   });
   if (!response.ok) {
+    if (request?.eventCode) {
+      const eventError = await getEventAccountError(response);
+      if (eventError) {
+        throw eventError;
+      }
+    }
     throw new FatalError(
       `Failed to create a temporary preview account (${response.status} ${response.statusText}).`,
       { telemetryMessage: "deploy temporary account create failed" }
@@ -511,12 +607,21 @@ async function createTemporaryPreviewAccount(logger) {
   const accountExpiresAt = previewAccount?.account?.expiresAt;
   const claimUrl = previewAccount?.claim?.url;
   const claimExpiresAt = previewAccount?.claim?.expiresAt;
+  const eventCodeAccepted = previewAccount?.eventCodeAccepted;
   if (accountId === void 0 || accountName === void 0 || apiToken === void 0 || accountExpiresAt === void 0 || claimUrl === void 0 || claimExpiresAt === void 0) {
     throw new FatalError(
       "Failed to create a temporary preview account because the response was missing required fields.",
       { telemetryMessage: "deploy temporary account response incomplete" }
     );
   }
+  if (request?.eventCode && eventCodeAccepted !== true) {
+    throw new FatalError(
+      "Failed to create a temporary preview account because the response did not acknowledge the event code.",
+      {
+        telemetryMessage: "deploy temporary event acknowledgement missing"
+      }
+    );
+  }
   return {
     account: {
       id: accountId,
@@ -536,6 +641,14 @@ async function getOrCreateTemporaryPreviewAccount(options) {
     options.storage
   );
   if (cachedPreviewAccount) {
+    if (options.request?.eventCode) {
+      throw new UserError(
+        "A temporary account is already cached. Rerun without --event-code to reuse it, or run `wrangler logout` and retry to create an account for this event.",
+        {
+          telemetryMessage: "deploy temporary event cache conflict"
+        }
+      );
+    }
     return { account: cachedPreviewAccount, cached: true };
   }
   const termsAccepted = await options.prompt(
@@ -548,7 +661,8 @@ async function getOrCreateTemporaryPreviewAccount(options) {
     });
   }
   const temporaryPreviewAccount = await createTemporaryPreviewAccount(
-    options.logger
+    options.logger,
+    options.request
   );
   options.storage.write(temporaryPreviewAccount);
   return { account: temporaryPreviewAccount, cached: false };
@@ -1561,7 +1675,7 @@ function createOAuthFlow(ctx) {
   __name(getStorage, "getStorage");
   const getClientId = /* @__PURE__ */ __name(() => typeof ctx.clientId === "function" ? ctx.clientId() : ctx.clientId, "getClientId");
   const consent = ctx.consent;
-  let temporaryAllowed = false;
+  let temporaryRequest;
   let activeTemporaryAccount;
   const redirectUrl = new URL(ctx.redirectUri);
   const defaultCallbackHost = redirectUrl.hostname;
@@ -1788,13 +1902,13 @@ function createOAuthFlow(ctx) {
     });
   }
   __name(requireApiTokenInternal, "requireApiTokenInternal");
-  function setTemporaryAllowed(allowed) {
-    temporaryAllowed = allowed && ctx.temporary !== void 0;
+  function setTemporaryAllowed(allowed, request) {
+    temporaryRequest = allowed && ctx.temporary !== void 0 ? request ?? {} : void 0;
     activeTemporaryAccount = void 0;
   }
   __name(setTemporaryAllowed, "setTemporaryAllowed");
   function isTemporaryAllowed() {
-    return temporaryAllowed;
+    return temporaryRequest !== void 0;
   }
   __name(isTemporaryAllowed, "isTemporaryAllowed");
   function getActiveTemporaryAccount() {
@@ -1810,7 +1924,8 @@ function createOAuthFlow(ctx) {
     }
     const result = await getOrCreateTemporaryPreviewAccount({
       ...ctx.temporary,
-      logger: ctx.logger
+      logger: ctx.logger,
+      ...temporaryRequest ? { request: temporaryRequest } : {}
     });
     activeTemporaryAccount = result.account;
     return result;

package/dist/{file-format-Bpmgm2Po.d.mts → file-format-Dlt3H3sW.d.mts}

@@ -106,6 +106,10 @@ interface OAuthFlowTemporaryContext {
      */
     prompt: (question: string, notice: string) => Promise<boolean>;
 }
+/** Optional provisioning inputs for a newly-created temporary account. */
+interface TemporaryAccountRequest {
+    eventCode?: string;
+}
 /**
  * The branded OAuth consent pages the provider redirects the browser to after
  * the user grants or denies consent.
@@ -379,7 +383,7 @@ interface OAuthFlowAPI {
      * process (e.g. in tests) — each invocation starts a fresh temporary session.
      * No-op when the flow was created without a `temporary` context.
      */
-    setTemporaryAllowed(allowed: boolean): void;
+    setTemporaryAllowed(allowed: boolean, request?: TemporaryAccountRequest): void;
     /**
      * Whether `--temporary` is permitted for this invocation (see
      * {@link setTemporaryAllowed}). Always `false` without a `temporary` context.
@@ -491,4 +495,4 @@ interface CredentialStore extends AuthConfigStorage {
  */
 type FileFormat = "toml" | "json";
 
-export { type AuthConfigStorage as A, type CredentialStore as C, type DeactivateDirectoryResult as D, type FileFormat as F, type LoginOrRefreshFailureReason as L, type OAuthFlowLogger as O, type ProfileConfigOperations as P, type TemporaryPreviewAccount as T, type UserAuthConfig as U, type ConfigStorage as a, type DirectoryBindingOperations as b, type DirectoryBindingsStorage as c, type LoginOrRefreshResult as d, type LoginProps as e, type OAuthFlowContext as f, type ProfileStore as g, createOAuthFlow as h, createProfileStore as i, generateAuthUrl as j, generateRandomState as k, type OAuthConsentPages as l, validateProfileName as v };
+export { type AuthConfigStorage as A, type CredentialStore as C, type DeactivateDirectoryResult as D, type FileFormat as F, type LoginOrRefreshFailureReason as L, type OAuthFlowLogger as O, type ProfileConfigOperations as P, type TemporaryAccountRequest as T, type UserAuthConfig as U, type ConfigStorage as a, type DirectoryBindingOperations as b, type DirectoryBindingsStorage as c, type LoginOrRefreshResult as d, type LoginProps as e, type OAuthFlowContext as f, type ProfileStore as g, type TemporaryPreviewAccount as h, createOAuthFlow as i, createProfileStore as j, generateAuthUrl as k, generateRandomState as l, type OAuthConsentPages as m, validateProfileName as v };

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { O as OAuthFlowLogger, U as UserAuthConfig, A as AuthConfigStorage, C as CredentialStore, F as FileFormat } from './file-format-Bpmgm2Po.mjs';
-export { a as ConfigStorage, D as DeactivateDirectoryResult, b as DirectoryBindingOperations, c as DirectoryBindingsStorage, L as LoginOrRefreshFailureReason, d as LoginOrRefreshResult, e as LoginProps, f as OAuthFlowContext, P as ProfileConfigOperations, g as ProfileStore, T as TemporaryPreviewAccount, h as createOAuthFlow, i as createProfileStore, j as generateAuthUrl, k as generateRandomState, v as validateProfileName } from './file-format-Bpmgm2Po.mjs';
+import { O as OAuthFlowLogger, U as UserAuthConfig, A as AuthConfigStorage, C as CredentialStore, F as FileFormat } from './file-format-Dlt3H3sW.mjs';
+export { a as ConfigStorage, D as DeactivateDirectoryResult, b as DirectoryBindingOperations, c as DirectoryBindingsStorage, L as LoginOrRefreshFailureReason, d as LoginOrRefreshResult, e as LoginProps, f as OAuthFlowContext, P as ProfileConfigOperations, g as ProfileStore, T as TemporaryAccountRequest, h as TemporaryPreviewAccount, i as createOAuthFlow, j as createProfileStore, k as generateAuthUrl, l as generateRandomState, v as validateProfileName } from './file-format-Dlt3H3sW.mjs';
 import { ApiCredentials } from '@cloudflare/workers-utils';
 import { SpawnSyncReturns } from 'node:child_process';
 

package/dist/index.mjs

@@ -1,2 +1,2 @@
-export { EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, generateVerificationUrl, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, validateProfileName } from './chunk-4CJO23DA.mjs';
+export { EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, generateVerificationUrl, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, validateProfileName } from './chunk-XLADBZ7F.mjs';
 import './chunk-O6YSETKJ.mjs';

package/dist/{keyring-preference-CWjI7ct9.d.mts → keyring-preference-B8dU564W.d.mts}

@@ -1,4 +1,4 @@
-import { f as OAuthFlowContext, l as OAuthConsentPages, F as FileFormat, C as CredentialStore, d as LoginOrRefreshResult, U as UserAuthConfig } from './file-format-Bpmgm2Po.mjs';
+import { f as OAuthFlowContext, m as OAuthConsentPages, F as FileFormat, C as CredentialStore, T as TemporaryAccountRequest, d as LoginOrRefreshResult, U as UserAuthConfig } from './file-format-Dlt3H3sW.mjs';
 import { ApiCredentials, ComplianceConfig } from '@cloudflare/workers-utils';
 
 /** Minimal shape of the interactive `select` prompt's options for account selection. */
@@ -148,7 +148,7 @@ interface CloudflareAuth {
     /** The currently-active credential store for the active profile. */
     getCredentialStore: () => CredentialStore;
     /** Mark whether `--temporary` is permitted for the current invocation. */
-    setTemporaryAllowed: (allowed: boolean) => void;
+    setTemporaryAllowed: (allowed: boolean, request?: TemporaryAccountRequest) => void;
     /** Resolve API credentials (env / temporary account / stored OAuth token). */
     getAPIToken: () => ApiCredentials | undefined;
     /** Throw an error if there is no API token available. */