@enderrealmmc/cf-static-guard 0.1.0

package/dist/commands/init.js

@@ -0,0 +1,257 @@
+import { confirm, input, password, select } from '@inquirer/prompts';
+import { randomBytes } from 'node:crypto';
+import { defaultProfile, getProfile, upsertProfile, } from '../lib/store.js';
+import { box, error, step, success, warn } from '../lib/log.js';
+import { createKvNamespace, putSecret, whoami } from '../lib/cf.js';
+import { pushAuthConfig, pushUiConfig } from '../lib/kv.js';
+export function registerInit(program) {
+    program
+        .command('init')
+        .description('Create/update a global profile and push first-time secrets (writes only to ~/.config/csg and Cloudflare)')
+        .option('-n, --name <worker>', 'Cloudflare worker name')
+        .option('-m, --mode <mode>', 'normal | strict', 'normal')
+        .option('--github-client-id <id>', 'GitHub OAuth client id')
+        .option('--github-client-secret <secret>', 'GitHub OAuth client secret')
+        .option('--session-secret <secret>', 'JWT session secret (auto-generated if omitted)')
+        .option('--admin-password <pwd>', 'Admin panel password (auto-generated if omitted)')
+        .option('--kv-id <id>', 'Existing KV namespace id')
+        .option('--create-kv', 'Create a new KV namespace named RULES')
+        .option('--spa', 'Enable SPA index fallback')
+        .option('--redirect-base <url>', 'OAuth redirect base origin')
+        .option('--custom-domain <host>', 'Attach custom domain to worker (e.g. docs.example.com)')
+        .option('--push', 'Push auth/ui config to KV after setup')
+        .option('--non-interactive', 'Fail instead of prompting when required values are missing')
+        .action(async (opts) => {
+        const interactive = !opts.nonInteractive;
+        const auth = await whoami();
+        if (!auth.ok) {
+            warn('Wrangler may not be logged in. Run `csg auth` if deploy fails.');
+        }
+        let name = opts.name;
+        if (!name && interactive) {
+            name = await input({
+                message: 'Worker name (subdomain on workers.dev)',
+                default: 'cf-static-guard',
+                validate: (v) => /^[a-z0-9-]+$/i.test(v) || 'Use letters, numbers, dashes',
+            });
+        }
+        if (!name) {
+            error('--name is required in non-interactive mode');
+            process.exitCode = 1;
+            return;
+        }
+        let mode = opts.mode === 'strict' ? 'strict' : 'normal';
+        if (interactive && !opts.nonInteractive) {
+            mode = await select({
+                message: 'Default access mode',
+                choices: [
+                    { name: 'normal — OAuth success is enough (blocklist still applies)', value: 'normal' },
+                    { name: 'strict — evaluate configured rules per provider', value: 'strict' },
+                ],
+                default: mode,
+            });
+        }
+        const existing = getProfile(name);
+        const profile = existing
+            ? { ...existing, updatedAt: new Date().toISOString() }
+            : defaultProfile(name, mode);
+        profile.mode = mode;
+        if (opts.spa)
+            profile.spaFallback = true;
+        if (opts.redirectBase)
+            profile.oauthRedirectBase = opts.redirectBase;
+        if (opts.customDomain)
+            profile.customDomain = opts.customDomain;
+        // GitHub
+        let clientId = opts.githubClientId || profile.providers.github?.clientId || process.env.CSG_GITHUB_CLIENT_ID;
+        let clientSecret = opts.githubClientSecret || process.env.CSG_GITHUB_CLIENT_SECRET;
+        if (interactive && !opts.nonInteractive) {
+            const enableGh = await confirm({
+                message: 'Enable GitHub OAuth?',
+                default: true,
+            });
+            profile.providers.github = {
+                enabled: enableGh,
+                mode: undefined,
+                rules: profile.providers.github?.rules || {},
+            };
+            if (enableGh) {
+                if (!clientId) {
+                    clientId = await input({
+                        message: 'GitHub OAuth Client ID',
+                        validate: (v) => v.trim().length > 0 || 'required',
+                    });
+                }
+                if (!clientSecret) {
+                    clientSecret = await password({
+                        message: 'GitHub OAuth Client Secret',
+                        validate: (v) => v.trim().length > 0 || 'required',
+                    });
+                }
+                if (mode === 'strict') {
+                    profile.providers.github.rules = await promptStrictRules(profile.providers.github.rules || {});
+                }
+            }
+        }
+        else if (profile.providers.github?.enabled !== false) {
+            profile.providers.github = {
+                ...profile.providers.github,
+                enabled: true,
+            };
+        }
+        if (clientId)
+            profile.providers.github = { ...profile.providers.github, enabled: profile.providers.github?.enabled !== false, clientId };
+        // KV
+        let kvId = opts.kvId || profile.kvNamespaceId;
+        if (!kvId && interactive) {
+            const doKv = await confirm({
+                message: 'Create KV namespace RULES now? (needed for admin/config rules)',
+                default: true,
+            });
+            if (doKv) {
+                step('Creating KV namespace…');
+                try {
+                    kvId = await createKvNamespace(name);
+                    success(`KV created: ${kvId}`);
+                }
+                catch (e) {
+                    error(e instanceof Error ? e.message : String(e));
+                    const manual = await input({ message: 'Paste KV namespace id (or empty to skip)' });
+                    kvId = manual.trim() || undefined;
+                }
+            }
+        }
+        else if (opts.createKv && !kvId) {
+            step('Creating KV namespace…');
+            kvId = await createKvNamespace(name);
+            success(`KV created: ${kvId}`);
+        }
+        if (kvId)
+            profile.kvNamespaceId = kvId;
+        // Secrets
+        let sessionSecret = opts.sessionSecret || process.env.CSG_SESSION_SECRET;
+        let adminPassword = opts.adminPassword || process.env.CSG_ADMIN_PASSWORD;
+        if (interactive && !opts.nonInteractive) {
+            if (!sessionSecret) {
+                const gen = await confirm({
+                    message: 'Generate SESSION_SECRET automatically?',
+                    default: true,
+                });
+                sessionSecret = gen
+                    ? randomBytes(32).toString('base64url')
+                    : await password({ message: 'SESSION_SECRET' });
+            }
+            if (!adminPassword) {
+                const gen = await confirm({
+                    message: 'Generate ADMIN_PASSWORD automatically?',
+                    default: true,
+                });
+                adminPassword = gen
+                    ? randomBytes(18).toString('base64url')
+                    : await password({ message: 'ADMIN_PASSWORD (for /admin)' });
+            }
+        }
+        else {
+            sessionSecret = sessionSecret || randomBytes(32).toString('base64url');
+            adminPassword = adminPassword || randomBytes(18).toString('base64url');
+        }
+        profile.updatedAt = new Date().toISOString();
+        upsertProfile(profile, true);
+        success(`Profile saved globally: ${profile.name}`);
+        // Push secrets to CF (requires existing worker after first deploy, or wrangler will still accept)
+        const secrets = [
+            ['SESSION_SECRET', sessionSecret],
+            ['ADMIN_PASSWORD', adminPassword],
+            ['GITHUB_CLIENT_ID', clientId],
+            ['GITHUB_CLIENT_SECRET', clientSecret],
+        ];
+        const doSecrets = opts.nonInteractive ||
+            (await confirm({
+                message: `Write secrets to Cloudflare worker "${profile.name}" now?`,
+                default: true,
+            }));
+        if (doSecrets) {
+            for (const [key, value] of secrets) {
+                if (!value)
+                    continue;
+                step(`secret put ${key}…`);
+                try {
+                    await putSecret(profile.name, key, value);
+                    success(`${key} set`);
+                }
+                catch (e) {
+                    error(`${key}: ${e instanceof Error ? e.message : e}`);
+                    warn('If the worker does not exist yet, deploy once then re-run secrets.');
+                }
+            }
+        }
+        const doPush = opts.push ||
+            (profile.kvNamespaceId &&
+                (opts.nonInteractive ||
+                    (await confirm({
+                        message: 'Push initial auth/ui config to KV?',
+                        default: true,
+                    }))));
+        if (doPush && profile.kvNamespaceId) {
+            try {
+                await pushAuthConfig(profile);
+                await pushUiConfig(profile);
+                success('KV auth:config + ui:config written');
+            }
+            catch (e) {
+                error(e instanceof Error ? e.message : String(e));
+            }
+        }
+        else if (!profile.kvNamespaceId) {
+            warn('No KV id — rules/config commands and admin save will not work until you add one.');
+        }
+        box([
+            'Next:',
+            `  csg deploy --site <your-dist>`,
+            `  csg open admin   # password = ADMIN_PASSWORD`,
+            '',
+            'Nothing was written into your site project directory.',
+        ]);
+    });
+}
+async function promptStrictRules(initial) {
+    const rules = { ...initial };
+    const allow = await input({
+        message: 'Allowlist (comma-separated logins, empty to skip)',
+        default: (rules.allowlist || []).join(','),
+    });
+    rules.allowlist = allow
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+    const orgs = await input({
+        message: 'Required GitHub orgs (comma-separated, empty to skip)',
+        default: (rules.requiredOrgs || []).join(','),
+    });
+    rules.requiredOrgs = orgs
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+    const teams = await input({
+        message: 'Required teams org/team (comma-separated, empty to skip)',
+        default: (rules.requiredTeams || []).map((t) => `${t.org}/${t.team}`).join(','),
+    });
+    rules.requiredTeams = teams
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean)
+        .map((line) => {
+        const [org, team] = line.split('/');
+        return { org: org || '', team: team || '' };
+    })
+        .filter((t) => t.org && t.team);
+    const age = await input({
+        message: 'Min account age in days (empty to skip)',
+        default: rules.minAccountAgeDays != null ? String(rules.minAccountAgeDays) : '',
+    });
+    if (age.trim())
+        rules.minAccountAgeDays = Number(age.trim());
+    else
+        delete rules.minAccountAgeDays;
+    return rules;
+}

package/dist/commands/kv.js

@@ -0,0 +1,39 @@
+import { getProfile, loadStore, upsertProfile } from '../lib/store.js';
+import { error, step, success, warn } from '../lib/log.js';
+import { createKvNamespace } from '../lib/cf.js';
+import { pushAuthConfig, pushUiConfig } from '../lib/kv.js';
+export function registerKv(program) {
+    const kv = program.command('kv').description('KV namespace helpers for RULES');
+    kv
+        .command('create')
+        .description('Create KV namespace and store id on the profile')
+        .option('-p, --profile <name>')
+        .option('--title <title>', 'Namespace title')
+        .option('--push', 'Push default auth/ui config after create')
+        .action(async (opts) => {
+        const store = loadStore();
+        const profile = getProfile(opts.profile);
+        if (!profile) {
+            error('No profile. Run `csg init` first.');
+            process.exitCode = 1;
+            return;
+        }
+        step('Creating KV namespace RULES…');
+        const id = await createKvNamespace(opts.title || profile.name);
+        const next = {
+            ...profile,
+            kvNamespaceId: id,
+            updatedAt: new Date().toISOString(),
+        };
+        upsertProfile(next, store.defaultProfile === profile.name);
+        success(`KV id saved: ${id}`);
+        if (opts.push) {
+            await pushAuthConfig(next);
+            await pushUiConfig(next);
+            success('Pushed default auth/ui config');
+        }
+        else {
+            warn('Run `csg config push` later to write auth:config / ui:config');
+        }
+    });
+}

package/dist/commands/open.js

@@ -0,0 +1,54 @@
+import { execa } from 'execa';
+import { getProfile } from '../lib/store.js';
+import { error, info } from '../lib/log.js';
+function openUrl(url) {
+    if (process.platform === 'win32') {
+        void execa('cmd', ['/c', 'start', '', url]);
+        return;
+    }
+    if (process.platform === 'darwin') {
+        void execa('open', [url]);
+        return;
+    }
+    void execa('xdg-open', [url]);
+}
+export function registerOpen(program) {
+    program
+        .command('open <target>')
+        .description('Open site | admin | login | health in browser')
+        .option('-p, --profile <name>')
+        .option('--base <url>', 'Full origin, e.g. https://my-docs.xxx.workers.dev')
+        .action(async (target, opts) => {
+        const profile = getProfile(opts.profile);
+        let base = opts.base || process.env.CSG_BASE_URL;
+        if (!base) {
+            if (!profile) {
+                error('No profile and no --base. Pass --base https://<worker>.<subdomain>.workers.dev');
+                process.exitCode = 1;
+                return;
+            }
+            // users often have custom domains; default guess is name.workers.dev under unknown subdomain
+            error(`Pass --base https://your-worker-domain (profile ${profile.name} has no recorded public origin).`);
+            info('Example: csg open admin --base https://my-docs.acme.workers.dev');
+            process.exitCode = 1;
+            return;
+        }
+        base = base.replace(/\/$/, '');
+        const map = {
+            site: '/',
+            home: '/',
+            admin: '/admin',
+            login: '/auth/login',
+            health: '/health',
+        };
+        const path = map[target];
+        if (!path) {
+            error(`Unknown target ${target}. Use: site | admin | login | health`);
+            process.exitCode = 1;
+            return;
+        }
+        const url = base + path;
+        info(`Opening ${url}`);
+        openUrl(url);
+    });
+}

package/dist/commands/profile.js

@@ -0,0 +1,69 @@
+import { listProfileNames, loadStore, setDefaultProfile, upsertProfile, } from '../lib/store.js';
+import { error, info, success } from '../lib/log.js';
+export function registerProfile(program) {
+    const profile = program
+        .command('profile')
+        .description('Manage global deploy profiles (not stored in your site repo)');
+    profile
+        .command('list')
+        .description('List profiles')
+        .action(() => {
+        const store = loadStore();
+        const names = listProfileNames();
+        if (!names.length) {
+            info('No profiles. Run `csg init`.');
+            return;
+        }
+        for (const name of names) {
+            const p = store.profiles[name];
+            const mark = name === store.defaultProfile ? '*' : ' ';
+            console.log(`${mark} ${name}  worker=${p.name}  mode=${p.mode}  kv=${p.kvNamespaceId || '-'}`);
+        }
+    });
+    profile
+        .command('use <name>')
+        .description('Set default profile')
+        .action((name) => {
+        if (!setDefaultProfile(name)) {
+            error(`Profile not found: ${name}`);
+            process.exitCode = 1;
+            return;
+        }
+        success(`Default profile → ${name}`);
+    });
+    profile
+        .command('show [name]')
+        .description('Show one profile JSON')
+        .action((name) => {
+        const store = loadStore();
+        const key = name || store.defaultProfile;
+        const p = store.profiles[key];
+        if (!p) {
+            error(`Profile not found: ${key}`);
+            process.exitCode = 1;
+            return;
+        }
+        console.log(JSON.stringify(p, null, 2));
+    });
+    profile
+        .command('set-kv <id>')
+        .description('Set KV namespace id on current/default profile')
+        .option('-p, --profile <name>', 'profile name')
+        .action((id, opts) => {
+        const store = loadStore();
+        const key = opts.profile || store.defaultProfile;
+        const p = store.profiles[key];
+        if (!p) {
+            error(`Profile not found: ${key}`);
+            process.exitCode = 1;
+            return;
+        }
+        const next = {
+            ...p,
+            kvNamespaceId: id,
+            updatedAt: new Date().toISOString(),
+        };
+        upsertProfile(next, key === store.defaultProfile);
+        success(`KV namespace id saved on profile ${key}`);
+    });
+}

package/dist/commands/secrets.js

@@ -0,0 +1,72 @@
+import { password } from '@inquirer/prompts';
+import { randomBytes } from 'node:crypto';
+import { getProfile } from '../lib/store.js';
+import { error, step, success } from '../lib/log.js';
+import { putSecret } from '../lib/cf.js';
+const KEYS = [
+    'GITHUB_CLIENT_ID',
+    'GITHUB_CLIENT_SECRET',
+    'SESSION_SECRET',
+    'ADMIN_PASSWORD',
+];
+export function registerSecrets(program) {
+    const secrets = program
+        .command('secrets')
+        .description('Set Cloudflare Worker secrets (not stored in your project)');
+    secrets
+        .command('set [name]')
+        .description('Set one secret, or run without name for interactive multi-set')
+        .option('-p, --profile <name>', 'worker profile')
+        .option('--value <v>', 'Secret value (prefer prompt/env for sensitive data)')
+        .option('--generate', 'Generate a random value (SESSION_SECRET / ADMIN_PASSWORD)')
+        .action(async (name, opts) => {
+        const profile = getProfile(opts.profile);
+        if (!profile) {
+            error('No profile. Run `csg init` first.');
+            process.exitCode = 1;
+            return;
+        }
+        const targets = name ? [name] : [...KEYS];
+        if (name && !KEYS.includes(name)) {
+            error(`Unknown secret. Use: ${KEYS.join(', ')}`);
+            process.exitCode = 1;
+            return;
+        }
+        for (const key of targets) {
+            let value = opts.value;
+            if (!value && opts.generate && (key === 'SESSION_SECRET' || key === 'ADMIN_PASSWORD')) {
+                value = randomBytes(24).toString('base64url');
+            }
+            if (!value) {
+                value = await password({
+                    message: `${key} value for worker ${profile.name}`,
+                    mask: '*',
+                });
+            }
+            if (!value) {
+                error(`${key}: empty value`);
+                process.exitCode = 1;
+                return;
+            }
+            step(`secret put ${key}…`);
+            await putSecret(profile.name, key, value);
+            success(`${key} updated on ${profile.name}`);
+        }
+    });
+    secrets
+        .command('rotate-session')
+        .description('Generate and set a new SESSION_SECRET (invalidates all logins)')
+        .option('-p, --profile <name>')
+        .action(async (opts) => {
+        const profile = getProfile(opts.profile);
+        if (!profile) {
+            error('No profile. Run `csg init` first.');
+            process.exitCode = 1;
+            return;
+        }
+        const value = randomBytes(32).toString('base64url');
+        step('secret put SESSION_SECRET…');
+        await putSecret(profile.name, 'SESSION_SECRET', value);
+        success('SESSION_SECRET rotated — users must log in again');
+    });
+}

package/dist/index.js

@@ -0,0 +1,40 @@
+import { Command } from 'commander';
+import { cliVersion } from './lib/paths.js';
+import { registerAuth } from './commands/auth.js';
+import { registerInit } from './commands/init.js';
+import { registerDeploy } from './commands/deploy.js';
+import { registerConfig } from './commands/config.js';
+import { registerSecrets } from './commands/secrets.js';
+import { registerOpen } from './commands/open.js';
+import { registerDoctor } from './commands/doctor.js';
+import { registerProfile } from './commands/profile.js';
+import { registerKv } from './commands/kv.js';
+export async function run(argv) {
+    const program = new Command();
+    program
+        .name('csg')
+        .description('Cloudflare static-site guard CLI — deploy any static site behind OAuth without cloning the monorepo.')
+        .version(cliVersion());
+    registerAuth(program);
+    registerInit(program);
+    registerDeploy(program);
+    registerConfig(program);
+    registerSecrets(program);
+    registerOpen(program);
+    registerDoctor(program);
+    registerProfile(program);
+    registerKv(program);
+    program.addHelpText('after', `
+Examples:
+  $ csg auth
+  $ csg init --name my-docs --mode normal
+  $ csg deploy --site ./dist
+  $ csg config get
+  $ csg config set-mode strict
+  $ csg open admin
+
+Config lives in your global csg folder (~/.config/csg or %APPDATA%/csg).
+Secrets and rules live on Cloudflare. This CLI does not write into your site repo.
+`);
+    await program.parseAsync(argv);
+}

package/dist/lib/cf.js

@@ -0,0 +1,22 @@
+import { runWrangler } from './wrangler.js';
+export async function putSecret(workerName, name, value) {
+    const res = await runWrangler(['secret', 'put', name, '--name', workerName], { input: value });
+    if (res.exitCode !== 0) {
+        throw new Error(res.stderr || res.stdout || `secret put ${name} failed`);
+    }
+}
+export async function createKvNamespace(_title) {
+    const res = await runWrangler(['kv', 'namespace', 'create', 'RULES', '--preview=false']);
+    // wrangler prints: { binding = "RULES", id = "xxxx" }
+    const text = `${res.stdout}\n${res.stderr}`;
+    const match = text.match(/id\s*=\s*"([a-f0-9]{32})"/i) || text.match(/id['":\s]+([a-f0-9]{32})/i);
+    if (res.exitCode !== 0 || !match) {
+        throw new Error(`Failed to create KV namespace.\n${text}\nCreate it in the dashboard and set kvNamespaceId on the profile.`);
+    }
+    return match[1];
+}
+export async function whoami() {
+    const res = await runWrangler(['whoami']);
+    const text = `${res.stdout}\n${res.stderr}`.trim();
+    return { ok: res.exitCode === 0, text };
+}

package/dist/lib/deploy.js

@@ -0,0 +1,75 @@
+import { cpSync, existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { workerBundlePath } from './paths.js';
+export function buildWranglerToml(profile) {
+    const publicPaths = (profile.publicPaths?.length
+        ? profile.publicPaths
+        : ['/health'])
+        .map((p) => (p.startsWith('/') ? p : `/${p}`))
+        .join(',');
+    const kvBlock = profile.kvNamespaceId
+        ? `
+[[kv_namespaces]]
+binding = "RULES"
+id = "${profile.kvNamespaceId}"
+`
+        : `
+# KV not configured. Run: csg kv create
+# [[kv_namespaces]]
+# binding = "RULES"
+# id = "<id>"
+`;
+    const redirect = profile.oauthRedirectBase
+        ? `\nOAUTH_REDIRECT_BASE = "${profile.oauthRedirectBase}"`
+        : '';
+    const customDomain = profile.customDomain
+        ? `
+[[routes]]
+pattern = "${profile.customDomain}"
+custom_domain = true
+`
+        : '';
+    return `name = "${profile.name}"
+main = "worker.js"
+compatibility_date = "2025-03-01"
+compatibility_flags = ["nodejs_compat"]
+${customDomain}
+[assets]
+directory = "./assets/site"
+binding = "ASSETS"
+run_worker_first = true
+
+[vars]
+GUARD_MODE = "${profile.mode}"
+PUBLIC_PATHS = "${publicPaths}"
+SPA_FALLBACK = "${profile.spaFallback ? 'true' : 'false'}"
+SESSION_TTL_SECONDS = "${String(profile.sessionTtlSeconds || 604800)}"
+${redirect}
+${kvBlock}`;
+}
+export function prepareDeployDir(profile, siteDir) {
+    if (!existsSync(workerBundlePath())) {
+        throw new Error('Worker bundle missing. Run `npm run build` in the monorepo, or reinstall the CLI package.');
+    }
+    if (!existsSync(siteDir)) {
+        throw new Error(`Site directory not found: ${siteDir}`);
+    }
+    const root = mkdtempSync(join(tmpdir(), 'csg-deploy-'));
+    const assets = join(root, 'assets', 'site');
+    mkdirSync(assets, { recursive: true });
+    cpSync(workerBundlePath(), join(root, 'worker.js'));
+    cpSync(siteDir, assets, { recursive: true });
+    writeFileSync(join(root, 'wrangler.toml'), buildWranglerToml(profile), 'utf8');
+    return {
+        root,
+        cleanup: () => {
+            try {
+                rmSync(root, { recursive: true, force: true });
+            }
+            catch {
+                // ignore
+            }
+        },
+    };
+}