@impeccable/reviews 0.1.32 → 0.1.33

package/dist/tools.js

@@ -16,7 +16,7 @@ import { checkoutNames, liveShaped, netlifySiteOf, previewHostName, provePreview
 import { closedPulls, deploymentsOf, hostingApp, hostingRead, liveHostOf, renderSitesOf } from './hosting.js';
 import { enableRenderPreviews, parseRenderDeployment, readRenderService, RENDER_DASHBOARD, renderSitesNamed } from './render.js';
 import { cloudflareFromHosting, cfRunner, cfStatus, CLOUDFLARE_APP_PAGE, connectCloudflareProject, enableCloudflarePreviews, pagesProject, pagesProjectName, readCloudflarePreviews } from './cloudflare.js';
-import { passCloudflareAccess } from './cloudflare-access.js';
+import { passCloudflareAccess, TOKEN_NAME } from './cloudflare-access.js';
 import { netlifyFromHosting, commandRunner, connectNetlifySite, liveSite, netlifyStatus, netlifyTeams, readNetlifyPreviews, waitForNetlifyAccess } from './netlify.js';
 import { netlifyToken, passNetlifyLock, setSitePassword } from './netlify-password.js';
 import { connectVercelProject, lockedDeploymentHosts, prepareFirstDeployment, projectMadeDeployment, readLinkedProject, readOwnProject, vercelDashboardScope, vercelPreviewsFact, vercelProjectFor, vercelProjectPage, vercelRepoProject, vercelStatus, vercelTeams, waitForVercelAccess, waitForVercelLock } from './vercel.js';
@@ -213,6 +213,8 @@ function plainReason(text) {
 }
 /** Names as a reader lists them: "a", "a and b", "a, b and c". */
 const andList = (names) => (names.length > 1 ? `${names.slice(0, -1).join(', ')} and ${names.at(-1)}` : names.join(''));
+/** The end screen's line for a Cloudflare service token the run created: what it made, on which Access application, and where it is revoked (REN-1187). */
+const accessNote = (application) => `Impeccable created the Cloudflare service token "${TOKEN_NAME}" and its policy on the Access application "${application}". Revoke it in Zero Trust → Access controls → Service credentials; reviews stop until a new one is saved.`;
 /** The end screen's one line for the Netlify sites whose password the run set and saved, set but did not save, or saved as it was: every site in one line (#419). */
 const PASSWORD_NOTES = {
     set: (sites) => sites.length === 1
@@ -2840,10 +2842,12 @@ export function createTools(ctx) {
             }
             if (testAccounts && response.ok)
                 retry.signedIn?.saved.add(appsRepo ? String(object(p.body)?.appKey) : '');
-            // The accounts the save signed in with, said on screen: the tasks show no status line (#417).
+            // The accounts the save signed in with, said on screen: the tasks show no status line (#417). The web page moves on with it, not at the model's next status (REN-1183).
             const signedIn = testAccounts && response.ok ? signedInLine(response.data, appsRepo ? appName(String(object(p.body)?.appKey)) : undefined) : undefined;
-            if (signedIn)
+            if (signedIn) {
                 reportDone(signedIn);
+                ctx.sync.update({ status: signedIn });
+            }
             // A check that answered, a preview not running yet included, ran for its app; one still turned away did not.
             if (check && (response.ok || response.status === 409))
                 checkedApps.add(typeof object(p.body)?.appKey === 'string' ? String(object(p.body)?.appKey) : '');
@@ -4202,6 +4206,9 @@ export function createTools(ctx) {
                 });
             }
             const { value, ...told } = answer;
+            // A token the run made stays in the person's Cloudflare account, saved or not: the end screen says so, and where it is revoked (REN-1187).
+            if (value && told.token === 'created' && told.application)
+                ctx.onKeyCreated?.(accessNote(told.application), `cloudflare-access:${told.application}`);
             if (value) {
                 // What is in hand follows the store, which holds one token: a new one is the one saved now, and the projects the last one opened no longer stand.
                 if (value !== accessToken)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@impeccable/reviews",
-  "version": "0.1.32",
+  "version": "0.1.33",
   "description": "Set up a repository for Impeccable for PRs from your terminal.",
   "license": "SEE LICENSE IN LICENSE",
   "private": false,