@impeccable/reviews 0.1.32 → 0.1.34

package/dist/host-questions.js

@@ -292,9 +292,15 @@ export function vercelBypassConsent(project, app) {
         return screen;
     return { ...screen, hint: bypassHint(app ? `${app}'s previews, built by the Vercel project ${project},` : `the previews of the Vercel project ${project}`, `${project}'s`) };
 }
-/** The consent to a service token, asked once the Access application in front of the preview was found (#357): that application, its Cloudflare account, and whose previews at which host it keeps. */
-export function cloudflareAccessConsent(found, host, app) {
-    return { ...HOST_SCREENS['cloudflare-access'], hint: accessHint(`the Access application "${found.application}", in the Cloudflare account ${found.account}, keeps ${app ? `${app}'s previews` : 'yours'} (${host})`, `"${found.application}"'s`) };
+/**
+ * The consent to a service token, naming, once it was found (#357), the Access application in front of the preview, its
+ * Cloudflare account, and whose previews at which host it keeps; `why` first, where it replaces a token saved for those
+ * previews that stopped opening them (REN-1194).
+ */
+export function cloudflareAccessConsent(found, host, app, why) {
+    const screen = HOST_SCREENS['cloudflare-access'];
+    const hint = found ? accessHint(`the Access application "${found.application}", in the Cloudflare account ${found.account}, keeps ${app ? `${app}'s previews` : 'yours'} (${host})`, `"${found.application}"'s`) : screen.hint;
+    return { ...screen, hint: why ? `${why}\n\n${hint}` : hint };
 }
 /** The one consent to making the Access application's own policies reusable, which the run's way through cf needs to add the token's policy (#327): the application named. */
 export function cloudflareAccessReusable(application) {

package/dist/playbook.js

@@ -34,7 +34,7 @@ Set the repository up with whatever the host's CLI can do (Netlify's, Vercel's,
 1. **Read the state.** The setup API's instructions and state came with the first message, trimmed to this setup; impeccable_state reads the state again. Done when you know the preview item's status, \`file\`, \`workflowStanding\` and \`hosting\` (each app's host, live address and the previews GitHub recorded, as Impeccable already holds them: a start, which the host tools take and the proofs still prove; absent from an older setup API), whether there is a \`signin\` item, whether there is an \`apps\` item (the monorepo case comes first then), and the titles in \`notPartOfThisSetup\`.
 2. **Read the repository**: manifests, the lockfile, scripts, framework config, CI workflows, env examples, the routes, the auth code and the seed. Done when you can name the package manager, the install, build and start commands, whether the pages need a server, how people sign in, and which pages a visitor opens without signing in.
 3. **Set up the preview**, starting with the host \`hosting\` names for the app (its case and its tool first; GitHub's record decides, so a named host whose tool lists nothing sends you on to the next): as the vercel-previews case says when impeccable_hosted_previews lists Vercel's previews of the pull requests, as the netlify-previews case says when impeccable_netlify_previews lists Netlify's, or a site of this repository with Deploy Previews on (and as preview-protection says when the host's login or password stands in front of either), as the cloudflare-previews case says when impeccable_cloudflare_previews lists Cloudflare's (a Pages project's, or a Worker's), as the render-previews case says when impeccable_render_previews answers a Render site, as the vercel-setup case says when the checkout is set up for Vercel and Vercel has never deployed it, as the netlify-setup case says when the checkout is set up for Netlify and it lists none, else as the server-previews case says; then the live app's address as the live-app-address case says, in the method's write where it can be. Done when those cases' steps are done.
-4. **Set up the sign-in** as the sign-in case says, when the app has its own. Done when that case's steps are done.
+4. **Set up the sign-in** as the sign-in case says, when the app has its own. When step 2 found no sign-in of any kind in the app (no form, OAuth, magic link or single sign-on) and the state's \`signin\` item, or its \`perApp\` entry for the app, reads \`sign-in-unknown\`, choose No sign-in yourself: impeccable_write to \`preview\` with \`{"auth": {"method": "none"}}\`, and the app's \`appKey\` in a monorepo. It never goes in \`left\`. Done when that case's steps are done, or No sign-in is saved.
 5. **Run impeccable_checkup**, do what \`next\` says, and run it again. Done when \`status\` is complete, or all that is left is in \`forPerson\` or \`waitingFor\`.
 6. **Open the pull requests** as the pull-requests case says. What waits on the person holds neither back. Done when that case's steps are done.
 7. **Report**: impeccable_progress with every task's final status, then impeccable_report as the report section says. Done when impeccable_report answered. The web page follows Impeccable's review, so never wait for it.

package/dist/tools.js

@@ -16,7 +16,7 @@ import { checkoutNames, liveShaped, netlifySiteOf, previewHostName, provePreview
 import { closedPulls, deploymentsOf, hostingApp, hostingRead, liveHostOf, renderSitesOf } from './hosting.js';
 import { enableRenderPreviews, parseRenderDeployment, readRenderService, RENDER_DASHBOARD, renderSitesNamed } from './render.js';
 import { cloudflareFromHosting, cfRunner, cfStatus, CLOUDFLARE_APP_PAGE, connectCloudflareProject, enableCloudflarePreviews, pagesProject, pagesProjectName, readCloudflarePreviews } from './cloudflare.js';
-import { passCloudflareAccess } from './cloudflare-access.js';
+import { passCloudflareAccess, TOKEN_NAME } from './cloudflare-access.js';
 import { netlifyFromHosting, commandRunner, connectNetlifySite, liveSite, netlifyStatus, netlifyTeams, readNetlifyPreviews, waitForNetlifyAccess } from './netlify.js';
 import { netlifyToken, passNetlifyLock, setSitePassword } from './netlify-password.js';
 import { connectVercelProject, lockedDeploymentHosts, prepareFirstDeployment, projectMadeDeployment, readLinkedProject, readOwnProject, vercelDashboardScope, vercelPreviewsFact, vercelProjectFor, vercelProjectPage, vercelRepoProject, vercelStatus, vercelTeams, waitForVercelAccess, waitForVercelLock } from './vercel.js';
@@ -213,6 +213,8 @@ function plainReason(text) {
 }
 /** Names as a reader lists them: "a", "a and b", "a, b and c". */
 const andList = (names) => (names.length > 1 ? `${names.slice(0, -1).join(', ')} and ${names.at(-1)}` : names.join(''));
+/** The end screen's line for a Cloudflare service token the run created: what it made, on which Access application, and where it is revoked (REN-1187). */
+const accessNote = (application) => `Impeccable created the Cloudflare service token "${TOKEN_NAME}" and its policy on the Access application "${application}". Revoke it in Zero Trust → Access controls → Service credentials; reviews stop until a new one is saved.`;
 /** The end screen's one line for the Netlify sites whose password the run set and saved, set but did not save, or saved as it was: every site in one line (#419). */
 const PASSWORD_NOTES = {
     set: (sites) => sites.length === 1
@@ -1831,15 +1833,15 @@ export function createTools(ctx) {
     const passwordReplaceConsented = new Set();
     /** The address impeccable_prove_preview met Cloudflare Access's login at, of a Pages preview impeccable_cloudflare_previews listed, and the words it looked for there. */
     let accessGated;
-    /** The service token that opened a preview in this run, what the tool said of it, the Pages projects it opened and whether the store holds it: once it does, the proofs of those projects' previews send it; never the model. */
-    let accessToken;
-    let accessMade = {};
-    const accessProjects = new Set();
-    let accessStored = false;
+    /**
+     * The service token that opened each Pages project's (or Worker's) previews in this run, by project: the token, what the
+     * tool said of it and whether the store holds it. Once it does, the proofs of that project's previews send it; never the
+     * model. A monorepo's apps, each a project behind an Access application of its own, keep theirs side by side, so one
+     * app's token never takes the place of another's (REN-1194).
+     */
+    const accessTokens = new Map();
     /** What impeccable_cloudflare_access answered, less the token: a skip is asked once, so that answer stands. */
     let accessOutcome;
-    /** The Access applications, by id, the person said yes to a token for. */
-    const accessConsented = new Set();
     /** What each host's settings last said of its pull-request previews, as the evidence tools read them: the one fact impeccable_enable_previews acts on. */
     const previewFacts = new Map();
     /** On a repository with several apps, the project or site each app's own read named (`<host>/<appKey>`): a no on that project ends the setup of the apps on it alone (#413). */
@@ -2840,10 +2842,12 @@ export function createTools(ctx) {
             }
             if (testAccounts && response.ok)
                 retry.signedIn?.saved.add(appsRepo ? String(object(p.body)?.appKey) : '');
-            // The accounts the save signed in with, said on screen: the tasks show no status line (#417).
+            // The accounts the save signed in with, said on screen: the tasks show no status line (#417). The web page moves on with it, not at the model's next status (REN-1183).
             const signedIn = testAccounts && response.ok ? signedInLine(response.data, appsRepo ? appName(String(object(p.body)?.appKey)) : undefined) : undefined;
-            if (signedIn)
+            if (signedIn) {
                 reportDone(signedIn);
+                ctx.sync.update({ status: signedIn });
+            }
             // A check that answered, a preview not running yet included, ran for its app; one still turned away did not.
             if (check && (response.ok || response.status === 409))
                 checkedApps.add(typeof object(p.body)?.appKey === 'string' ? String(object(p.body)?.appKey) : '');
@@ -3441,7 +3445,8 @@ export function createTools(ctx) {
             const site = netlifySiteOf(url) ?? known?.site;
             // A saved service token opens its Pages project's previews, or its Worker's: Access admits it wherever the application's policy covers.
             const project = pagesProject(origin) ?? workerPatterns.get(origin);
-            const token = accessToken && accessStored && project && accessProjects.has(project) ? accessToken : undefined;
+            const accessHeld = project ? accessTokens.get(project) : undefined;
+            const token = accessHeld?.stored ? accessHeld.value : undefined;
             const prove = () => provePreview(url, p.expect, pi.cwd, {
                 fetch: ctx.previewFetch, signal, live: live ? (known?.host ?? true) : false,
                 // The project's bypass secret opens the project's own addresses: the previews it proved, and the production address read from the same project.
@@ -4160,25 +4165,23 @@ export function createTools(ctx) {
             };
             let answer;
             const project = pagesProject(new URL(at.url).origin) ?? workerPatterns.get(new URL(at.url).origin);
-            // The token in hand goes only to a project it opened already, as the proofs send it: any other address is read for an application of the person's first.
-            if (accessToken && project && accessProjects.has(project) && (await prove(accessToken)).proven) {
+            // The project's own token in hand goes only to that project, as the proofs send it: any other address is read for an application of the person's first.
+            const held = project ? accessTokens.get(project) : undefined;
+            if (held && (await prove(held.value)).proven) {
                 // The token in hand opens this address too: stored already, or stored now.
-                const failed = accessStored ? null : await save(accessToken);
-                answer = { status: failed ? 'save-failed' : 'saved', ...accessMade, ...(failed ? { reason: failed } : {}), value: accessToken };
+                const failed = held.stored ? null : await save(held.value);
+                answer = { status: failed ? 'save-failed' : 'saved', ...held.made, ...(failed ? { reason: failed } : {}), value: held.value };
             }
             else {
+                // A token saved for this project that no longer opens its preview is replaced only on a new yes, which the screen asks saying why (REN-1194).
+                const why = held && `The service token saved for ${at.app ? appName(at.app.appKey) : new URL(at.url).host} no longer opens ${new URL(at.url).host}: ${proof?.reason ?? 'Cloudflare Access did not let it in.'} A new one takes its place.`;
                 answer = await passCloudflareAccess({
                     url: at.url,
-                    // Named once the Access application was found (#357), and asked once per application: a yes stands for another app's previews it covers.
+                    // Named once the Access application was found (#357). Every token made is asked for: a yes makes one token, for this app's previews.
                     consent: async (found) => {
-                        if (found && accessConsented.has(found.id))
-                            return true;
                         // The account by the name the last screen gives it, where a read found it; else its id (#390).
                         const named = found && { ...found, account: accountOf.get(`cloudflare account ${found.account}`) ?? found.account };
-                        const yes = !(await ask(sentTo(named ? cloudflareAccessConsent(named, new URL(at.url).host, at.app && appName(at.app.appKey)) : HOST_SCREENS['cloudflare-access'], at.url))).skipped;
-                        if (yes && found)
-                            accessConsented.add(found.id);
-                        return yes;
+                        return !(await ask(sentTo(cloudflareAccessConsent(named, new URL(at.url).host, at.app && appName(at.app.appKey), why), at.url))).skipped;
                     },
                     cf: cfRunner({ checkout: pi.cwd }, hostRunner),
                     login: cfRunner({ browser: true, timeoutMs: 300_000, checkout: pi.cwd }, hostRunner),
@@ -4202,15 +4205,14 @@ export function createTools(ctx) {
                 });
             }
             const { value, ...told } = answer;
+            // A token the run made stays in the person's Cloudflare account, saved or not: the end screen says so, and where it is revoked (REN-1187).
+            if (value && told.token === 'created' && told.application)
+                ctx.onKeyCreated?.(accessNote(told.application), `cloudflare-access:${told.application}`);
             if (value) {
-                // What is in hand follows the store, which holds one token: a new one is the one saved now, and the projects the last one opened no longer stand.
-                if (value !== accessToken)
-                    accessProjects.clear();
-                accessToken = value;
-                accessStored = told.status === 'saved';
-                accessMade = { ...(told.token ? { token: told.token } : {}), ...(told.application ? { application: told.application } : {}), ...(told.expires ? { expires: told.expires } : {}), ...(told.apiToken ? { apiToken: told.apiToken } : {}) };
+                // What is in hand follows the store, which holds each app's own: the token saved now is this project's, beside every other project's.
+                const made = { ...(told.token ? { token: told.token } : {}), ...(told.application ? { application: told.application } : {}), ...(told.expires ? { expires: told.expires } : {}), ...(told.apiToken ? { apiToken: told.apiToken } : {}) };
                 if (project)
-                    accessProjects.add(project);
+                    accessTokens.set(project, { value, made, stored: told.status === 'saved' });
             }
             const pattern = told.status === 'saved' ? (proof?.pattern ?? workerPatterns.get(new URL(at.url).origin)) : undefined;
             accessOutcome = { ...told, ...(told.status === 'saved' ? { proven: true, ...(pattern ? { pattern } : {}) } : {}) };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@impeccable/reviews",
-  "version": "0.1.32",
+  "version": "0.1.34",
   "description": "Set up a repository for Impeccable for PRs from your terminal.",
   "license": "SEE LICENSE IN LICENSE",
   "private": false,