@cloudflare/workers-auth 0.9.3 → 0.9.5

package/dist/cf/index.d.mts

@@ -1,6 +1,6 @@
-import { a as ConfigStorage, A as AuthConfigStorage, U as UserAuthConfig, f as OAuthFlowContext, g as ProfileStore } from '../file-format-Dlt3H3sW.mjs';
-import { C as CliDescriptor, A as AuthContext, a as CloudflareAuth, U as UserPreferences, K as KeyringPreferenceContext, S as SetKeyringPreferenceResult } from '../keyring-preference-B8dU564W.mjs';
-export { b as CloudflareLoginProps } from '../keyring-preference-B8dU564W.mjs';
+import { a as ConfigStorage, A as AuthConfigStorage, U as UserAuthConfig, f as OAuthFlowContext, g as ProfileStore } from '../file-format-hS8cJZA7.mjs';
+import { C as CliDescriptor, A as AuthContext, a as CloudflareAuth, U as UserPreferences, K as KeyringPreferenceContext, S as SetKeyringPreferenceResult } from '../keyring-preference-dD49DWOI.mjs';
+export { b as CloudflareLoginProps } from '../keyring-preference-dD49DWOI.mjs';
 import '@cloudflare/workers-utils';
 
 /**

package/dist/cf/index.mjs

@@ -1,9 +1,12 @@
-import { createAuthConfigFileHelpers, createPreferences, createKeyringPreference, createFileStorage, createCloudflareAuth, createCloudflareProfileStore } from '../chunk-V6MEAFHI.mjs';
-import '../chunk-WMSASLDV.mjs';
-import { __name } from '../chunk-O6YSETKJ.mjs';
+import { createRequire } from 'node:module';
+import { createAuthConfigFileHelpers, createPreferences, createKeyringPreference, createFileStorage, createCloudflareAuth, createCloudflareProfileStore } from '../chunk-VVLCNASF.mjs';
+import '../chunk-FT2NMTJB.mjs';
+import { __name } from '../chunk-VAZEJK55.mjs';
 import { getEnvironmentVariableFactory, getGlobalConfigPath, getCloudflareApiEnvironmentFromEnv } from '@cloudflare/workers-utils';
 import path from 'node:path';
 
+createRequire(import.meta.url || (typeof __filename === "string" ? __filename : "/"));
+
 // src/cf/constants.ts
 var CF_KEYRING_SERVICE_NAME = "cloudflare";
 var CF_CLI_NAME = "cf";

package/dist/{chunk-WMSASLDV.mjs → chunk-FT2NMTJB.mjs}

@@ -1,4 +1,5 @@
-import { __name } from './chunk-O6YSETKJ.mjs';
+import { createRequire } from 'node:module';
+import { __name } from './chunk-VAZEJK55.mjs';
 import { getEnvironmentVariableFactory, getCloudflareApiEnvironmentFromEnv, getBooleanEnvironmentVariableFactory, UserError, readFileSync, isNonInteractiveOrCI, FatalError, getCloudflareApiBaseUrl, COMPLIANCE_REGION_CONFIG_PUBLIC, getCloudflareComplianceRegion, parseTOML } from '@cloudflare/workers-utils';
 import { spawn, spawnSync } from 'node:child_process';
 import { fetch } from 'undici';
@@ -9,7 +10,8 @@ import http from 'node:http';
 import url from 'node:url';
 import path4 from 'node:path';
 import { existsSync, mkdirSync, writeFileSync, chmodSync, rmSync } from 'node:fs';
-import { createRequire } from 'node:module';
+
+createRequire(import.meta.url || (typeof __filename === "string" ? __filename : "/"));
 
 // src/state.ts
 var hasWarnedAboutDeprecatedV1ApiToken = false;
@@ -162,6 +164,14 @@ var getCloudflareAuthUseKeyringFromEnv = getBooleanEnvironmentVariableFactory({
 });
 var headersCache = {};
 var usesAccessCache = /* @__PURE__ */ new Map();
+function buildProbeUrl(domain, previewToken) {
+  const url2 = new URL(`https://${domain}`);
+  if (previewToken) {
+    url2.searchParams.set("cf_workers_preview_token", previewToken);
+  }
+  return url2.toString();
+}
+__name(buildProbeUrl, "buildProbeUrl");
 function clearAccessCaches() {
   for (const key of Object.keys(headersCache)) {
     delete headersCache[key];
@@ -169,15 +179,16 @@ function clearAccessCaches() {
   usesAccessCache.clear();
 }
 __name(clearAccessCaches, "clearAccessCaches");
-async function domainUsesAccess(domain, logger) {
+async function domainUsesAccess(domain, logger, previewToken) {
   logger.debug("Checking if domain has Access enabled:", domain);
-  if (usesAccessCache.has(domain)) {
+  const cacheKey = JSON.stringify([domain, Boolean(previewToken)]);
+  if (usesAccessCache.has(cacheKey)) {
     logger.debug(
       "Using cached Access switch for:",
       domain,
-      usesAccessCache.get(domain)
+      usesAccessCache.get(cacheKey)
     );
-    return usesAccessCache.get(domain) ?? false;
+    return usesAccessCache.get(cacheKey) ?? false;
   }
   logger.debug("Access switch not cached for:", domain);
   try {
@@ -185,17 +196,19 @@ async function domainUsesAccess(domain, logger) {
     const cancel = setTimeout(() => {
       controller.abort();
     }, 1e3);
-    const output = await fetch(`https://${domain}`, {
+    const output = await fetch(buildProbeUrl(domain, previewToken), {
       redirect: "manual",
       signal: controller.signal
     });
     clearTimeout(cancel);
     const usesAccess = !!(output.status === 302 && output.headers.get("location")?.includes("cloudflareaccess.com"));
-    logger.debug("Caching access switch for:", domain);
-    usesAccessCache.set(domain, usesAccess);
+    if (usesAccess || !previewToken) {
+      logger.debug("Caching access switch for:", domain);
+      usesAccessCache.set(cacheKey, usesAccess);
+    }
     return usesAccess;
   } catch {
-    usesAccessCache.set(domain, false);
+    logger.debug("Access probe failed for:", domain);
     return false;
   }
 }
@@ -216,7 +229,7 @@ async function getAccessHeaders(domain, options) {
       `Both CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET must be set to use Access Service Token authentication. Only ${clientId !== void 0 ? "CLOUDFLARE_ACCESS_CLIENT_ID" : "CLOUDFLARE_ACCESS_CLIENT_SECRET"} was found.`
     );
   }
-  if (!await domainUsesAccess(domain, logger)) {
+  if (!await domainUsesAccess(domain, logger, options.previewToken)) {
     return {};
   }
   logger.debug("Getting Access headers for domain:", domain);
@@ -235,7 +248,10 @@ See https://developers.cloudflare.com/cloudflare-one/access-controls/service-cre
     );
   }
   logger.debug("Spawning cloudflared to get Access token for domain:");
-  const output = await spawnCloudflaredAccessLogin(domain, options.signal);
+  const output = await spawnCloudflaredAccessLogin(
+    buildProbeUrl(domain, options.previewToken),
+    options.signal
+  );
   if (output.error) {
     throw new UserError(
       "To use Wrangler with Cloudflare Access, please install `cloudflared` from https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/installation",
@@ -254,9 +270,11 @@ See https://developers.cloudflare.com/cloudflare-one/access-controls/service-cre
   throw new Error("Failed to authenticate with Cloudflare Access");
 }
 __name(getAccessHeaders, "getAccessHeaders");
-function spawnCloudflaredAccessLogin(domain, signal) {
+function spawnCloudflaredAccessLogin(loginTarget, signal) {
   return new Promise((resolve, reject) => {
-    const child = spawn("cloudflared", ["access", "login", domain], { signal });
+    const child = spawn("cloudflared", ["access", "login", loginTarget], {
+      signal
+    });
     const stdoutChunks = [];
     child.stdout.on("data", (chunk) => stdoutChunks.push(chunk));
     child.stderr.resume();
@@ -732,6 +750,14 @@ var ErrorUnknown = class extends ErrorOAuth2 {
     return "ErrorUnknown";
   }
 };
+var ErrorAuthServerUnreachable = class extends ErrorOAuth2 {
+  static {
+    __name(this, "ErrorAuthServerUnreachable");
+  }
+  toString() {
+    return "ErrorAuthServerUnreachable";
+  }
+};
 var ErrorNoAuthCode = class extends ErrorOAuth2 {
   static {
     __name(this, "ErrorNoAuthCode");
@@ -1132,7 +1158,12 @@ async function fetchAuthToken(body, logger, isNonInteractiveOrCI2) {
     return response;
   } catch (e) {
     logger.debug("Failed to fetch auth token:", e);
-    throw e;
+    const cause = e?.cause;
+    const code = typeof cause?.code === "string" ? ` (${cause.code})` : "";
+    throw new ErrorAuthServerUnreachable(
+      `Could not reach the Cloudflare auth server at ${getTokenUrlFromEnv()}${code}.`,
+      { cause: e, telemetryMessage: "user oauth token endpoint unreachable" }
+    );
   }
 }
 __name(fetchAuthToken, "fetchAuthToken");
@@ -1778,12 +1809,12 @@ function createOAuthFlow(ctx) {
         refresh_token,
         scopes
       });
-      return true;
+      return "refreshed";
     } catch (e) {
       ctx.logger.debug(
         `Token refresh failed: ${e instanceof Error ? e.message : String(e)}`
       );
-      return false;
+      return e instanceof ErrorAuthServerUnreachable ? "unreachable" : "rejected";
     }
   }
   __name(refreshToken, "refreshToken");
@@ -1807,10 +1838,13 @@ function createOAuthFlow(ctx) {
       }
       return { loggedIn: false, reason: "no-credentials-login-failed" };
     } else if (isRefreshNeeded(props.profile)) {
-      const didRefresh = await refreshToken(props.profile);
-      if (didRefresh) {
+      const refreshed = await refreshToken(props.profile);
+      if (refreshed === "refreshed") {
         return { loggedIn: true };
       }
+      if (refreshed === "unreachable") {
+        return { loggedIn: false, reason: "token-refresh-unreachable" };
+      }
       if (ctx.isNonInteractiveOrCI()) {
         return {
           loggedIn: false,
@@ -1868,8 +1902,7 @@ function createOAuthFlow(ctx) {
     }
     const expired = stored.accessToken && /* @__PURE__ */ new Date() >= new Date(stored.accessToken.expiry);
     if (expired) {
-      const didRefresh = await refreshToken();
-      if (!didRefresh) {
+      if (await refreshToken() !== "refreshed") {
         return void 0;
       }
       stored = readStoredAuthState({

package/dist/{chunk-O6YSETKJ.mjs → chunk-VAZEJK55.mjs}

@@ -1,3 +1,6 @@
+import { createRequire } from 'node:module';
+
+createRequire(import.meta.url || (typeof __filename === "string" ? __filename : "/"));
 var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 

package/dist/{chunk-V6MEAFHI.mjs → chunk-VVLCNASF.mjs}

@@ -1,10 +1,12 @@
-import { stringifyFile, parseFile, dedent, createCredentialStorageContext, createOAuthFlow, getAuthFromEnv, createProfileStore, validateAccountId, getCloudflareAccountIdFromEnv, getAuthConfigFilePath, getEncryptedAuthConfigFilePath, scrubEncryptedCredentials, validateProfileName, getCloudflareAuthUseKeyringFromEnv } from './chunk-WMSASLDV.mjs';
-import { __name } from './chunk-O6YSETKJ.mjs';
+import { createRequire } from 'node:module';
+import { stringifyFile, parseFile, dedent, createCredentialStorageContext, createOAuthFlow, getAuthFromEnv, createProfileStore, validateAccountId, getCloudflareAccountIdFromEnv, getAuthConfigFilePath, getEncryptedAuthConfigFilePath, scrubEncryptedCredentials, validateProfileName, getCloudflareAuthUseKeyringFromEnv } from './chunk-FT2NMTJB.mjs';
+import { __name } from './chunk-VAZEJK55.mjs';
 import { existsSync, rmSync, mkdirSync, writeFileSync, chmodSync, readFileSync as readFileSync$1, readdirSync } from 'node:fs';
 import path3 from 'node:path';
 import { URLSearchParams } from 'node:url';
 import { readFileSync, isNonInteractiveOrCI, createConfigCache, openInBrowser, fetchInternalBase, hasMorePages, throwFetchError, UserError, isCI, getCloudflareComplianceRegion } from '@cloudflare/workers-utils';
 
+createRequire(import.meta.url || (typeof __filename === "string" ? __filename : "/"));
 function createPreferences(getConfigPath) {
   function getUserPreferencesPath() {
     return path3.resolve(getConfigPath(), "preferences.json");
@@ -763,7 +765,8 @@ function notLoggedInErrorBodies(loginCommand) {
     "no-credentials-non-interactive": `Could not authenticate because no credentials were found and the environment is non-interactive. Set a CLOUDFLARE_API_TOKEN environment variable or run \`${loginCommand}\` in an interactive terminal first.`,
     "no-credentials-login-failed": `No credentials were found and the login attempt was unsuccessful. Run \`${loginCommand}\` to try again.`,
     "token-expired-non-interactive": `Your auth token has expired and could not be refreshed, and the environment is non-interactive. Run \`${loginCommand}\` in an interactive terminal or set a CLOUDFLARE_API_TOKEN.`,
-    "token-expired-login-failed": `Your auth token has expired and could not be refreshed, and the login attempt was unsuccessful. Run \`${loginCommand}\` to try again.`
+    "token-expired-login-failed": `Your auth token has expired and could not be refreshed, and the login attempt was unsuccessful. Run \`${loginCommand}\` to try again.`,
+    "token-refresh-unreachable": `Your auth token has expired and could not be refreshed because the Cloudflare auth server could not be reached. This is usually a network problem (connectivity, proxy, or IPv6), not an invalid login: your stored credentials were left unchanged. Check your connection and try again.`
   };
 }
 __name(notLoggedInErrorBodies, "notLoggedInErrorBodies");
@@ -1101,6 +1104,10 @@ ${accounts.map(
           `In a non-interactive environment, it's necessary to set a CLOUDFLARE_API_TOKEN environment variable for ${cliName} to work. Please go to https://developers.cloudflare.com/fundamentals/api/get-started/create-token/ for instructions on how to create an api token, and assign its value to CLOUDFLARE_API_TOKEN.`,
           { telemetryMessage: "user auth missing api token non interactive" }
         );
+      } else if (result.reason === "token-refresh-unreachable") {
+        throw new UserError(NOT_LOGGED_IN_ERROR_BODIES[result.reason], {
+          telemetryMessage: "user auth token refresh unreachable"
+        });
       } else {
         throw new UserError("Did not login, quitting...", {
           telemetryMessage: "user login cancelled"

package/dist/{file-format-Dlt3H3sW.d.mts → file-format-hS8cJZA7.d.mts}

@@ -248,7 +248,9 @@ type LoginOrRefreshFailureReason =
 /** the stored token has expired, refresh failed, and the environment is non-interactive so a browser login cannot be started. */
  | "token-expired-non-interactive"
 /** the stored token has expired, refresh failed, and the interactive login attempt was unsuccessful. */
- | "token-expired-login-failed";
+ | "token-expired-login-failed"
+/** the stored token has expired and the auth server could not be reached to refresh it; the stored credentials were left untouched and no login was attempted. */
+ | "token-refresh-unreachable";
 /**
  * Discriminated union returned by {@link OAuthFlowAPI.loginOrRefreshIfRequired}.
  *

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { O as OAuthFlowLogger, U as UserAuthConfig, A as AuthConfigStorage, C as CredentialStore, F as FileFormat } from './file-format-Dlt3H3sW.mjs';
-export { a as ConfigStorage, D as DeactivateDirectoryResult, b as DirectoryBindingOperations, c as DirectoryBindingsStorage, L as LoginOrRefreshFailureReason, d as LoginOrRefreshResult, e as LoginProps, f as OAuthFlowContext, P as ProfileConfigOperations, g as ProfileStore, T as TemporaryAccountRequest, h as TemporaryPreviewAccount, i as createOAuthFlow, j as createProfileStore, k as generateAuthUrl, l as generateRandomState, v as validateProfileName } from './file-format-Dlt3H3sW.mjs';
+import { O as OAuthFlowLogger, U as UserAuthConfig, A as AuthConfigStorage, C as CredentialStore, F as FileFormat } from './file-format-hS8cJZA7.mjs';
+export { a as ConfigStorage, D as DeactivateDirectoryResult, b as DirectoryBindingOperations, c as DirectoryBindingsStorage, L as LoginOrRefreshFailureReason, d as LoginOrRefreshResult, e as LoginProps, f as OAuthFlowContext, P as ProfileConfigOperations, g as ProfileStore, T as TemporaryAccountRequest, h as TemporaryPreviewAccount, i as createOAuthFlow, j as createProfileStore, k as generateAuthUrl, l as generateRandomState, v as validateProfileName } from './file-format-hS8cJZA7.mjs';
 import { ApiCredentials } from '@cloudflare/workers-utils';
 import { SpawnSyncReturns } from 'node:child_process';
 
@@ -42,14 +42,23 @@ declare function clearAccessCaches(): void;
  * A 302 to `cloudflareaccess.com` is the canonical signal. Service-auth-only
  * Access applications return a hard 403 instead and are therefore not detected
  * here — see {@link getAccessHeaders} for how this is handled.
+ *
+ * When `previewToken` is supplied it is added as the `cf_workers_preview_token`
+ * query parameter so the probe activates an unpublished worker's edge-preview
+ * route (otherwise the anonymous probe 404s and Access is never triggered). The
+ * cache is keyed on whether a token was supplied so token-authenticated and
+ * anonymous probes of the same host don't poison each other.
  */
-declare function domainUsesAccess(domain: string, logger: OAuthFlowLogger): Promise<boolean>;
+declare function domainUsesAccess(domain: string, logger: OAuthFlowLogger, previewToken?: string): Promise<boolean>;
 /**
  * Get the headers needed to authenticate with an Access-protected domain.
  *
  * @param domain The hostname of the Access-protected domain (e.g. `"example.com"`).
  * @param options logger + an `isNonInteractiveOrCI` predicate used to
- *   produce an actionable error in CI; both default to no-op / `false`.
+ *   produce an actionable error in CI (both default to no-op / `false`), plus an
+ *   optional `previewToken` that is added as the `cf_workers_preview_token`
+ *   query parameter when probing for Access and when invoking `cloudflared
+ *   access login`, so detection works on unpublished `<name>.workers.dev` hosts.
  * @returns
  * - Service token headers (`CF-Access-Client-Id` + `CF-Access-Client-Secret`) if env vars are set
  * - A `Cookie: CF_Authorization=...` header if obtained via `cloudflared` (interactive only)
@@ -64,6 +73,12 @@ declare function getAccessHeaders(domain: string, options: {
     isNonInteractiveOrCI?: () => boolean;
     /** Aborts a pending `cloudflared` authorization and kills its process. */
     signal?: AbortSignal;
+    /**
+     * Workers preview token forwarded to the Access probe and to
+     * `cloudflared access login` so detection works on unpublished
+     * `<name>.workers.dev` hosts.
+     */
+    previewToken?: string;
 }): Promise<Record<string, string>>;
 
 /**

package/dist/index.mjs

@@ -1,2 +1,5 @@
-export { EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, generateVerificationUrl, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, validateProfileName } from './chunk-WMSASLDV.mjs';
-import './chunk-O6YSETKJ.mjs';
+import { createRequire } from 'node:module';
+export { EncryptedFileCredentialStore, FileCredentialStore, LinuxSecretToolKeyProvider, MacSecurityKeyProvider, NapiKeyringKeyProvider, PINNED_KEYRING_VERSION, PKCE_CHARSET, TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT, clearAccessCaches, clearCredentialStorageState, createCredentialStorageContext, createOAuthFlow, createProfileStore, decryptString, domainUsesAccess, encryptString, findKeyringBinding, generateAuthUrl, generateKey, generateRandomState, generateVerificationUrl, getAccessHeaders, getAuthConfigFilePath, getAuthFromEnv, getAuthUrlFromEnv, getCloudflareAPITokenFromEnv, getCloudflareAccountIdFromEnv, getCloudflareAuthUseKeyringFromEnv, getCloudflareGlobalAuthEmailFromEnv, getCloudflareGlobalAuthKeyFromEnv, getEncryptedAuthConfigFilePath, getKeyringAccountName, getKeyringInstallDir, installKeyringBindingSync, parseEncryptedEnvelope, probeSecretTool, readStoredAuthState, resetCredentialStorageState, resolveKeyProvider, scrubEncryptedCredentials, setKeyProviderFactoryForTesting, setKeyringEntryFactory, setLinuxSecretToolRunner, setMacSecurityCommandRunner, setNpmRunner, validateProfileName } from './chunk-FT2NMTJB.mjs';
+import './chunk-VAZEJK55.mjs';
+
+createRequire(import.meta.url || (typeof __filename === "string" ? __filename : "/"));

package/dist/{keyring-preference-B8dU564W.d.mts → keyring-preference-dD49DWOI.d.mts}

@@ -1,4 +1,4 @@
-import { f as OAuthFlowContext, m as OAuthConsentPages, F as FileFormat, C as CredentialStore, T as TemporaryAccountRequest, d as LoginOrRefreshResult, U as UserAuthConfig } from './file-format-Dlt3H3sW.mjs';
+import { f as OAuthFlowContext, m as OAuthConsentPages, F as FileFormat, C as CredentialStore, T as TemporaryAccountRequest, d as LoginOrRefreshResult, U as UserAuthConfig } from './file-format-hS8cJZA7.mjs';
 import { ApiCredentials, ComplianceConfig } from '@cloudflare/workers-utils';
 
 /** Minimal shape of the interactive `select` prompt's options for account selection. */