@inneranimalmedia/agentsam-sdk 2.6.4 → 2.6.7

package/packages/connectors/cloudflare/src/index.js

@@ -10,222 +10,94 @@ export const CLOUDFLARE_FIXTURE_CLIENT_ID = 'sillynotreal';
 
 export const CLOUDFLARE_OAUTH_REVOKE_URL = 'https://dash.cloudflare.com/oauth2/revoke';
 
-/** Smallest useful scopes mapped to Cloudflare API token permission names. */
-export const CLOUDFLARE_CAPABILITY_SCOPES = Object.freeze({
-  workers_deploy: {
-    scopes: ['workers-scripts.write'],
-    why: 'Deploy Workers for the connected account (Workers Scripts Edit).',
-  },
-  d1_inspect: {
-    scopes: ['d1.read'],
-    why: 'Inspect D1 databases bound to the deployable.',
-  },
-  r2_inspect: {
-    scopes: ['workers-r2.read'],
-    why: 'Inspect R2 buckets bound to the deployable.',
-  },
-  worker_logs: {
-    scopes: ['workers-scripts.read'],
-    why: 'Read Worker script metadata/logs for postdeploy health.',
-  },
-});
+export {
+  CLOUDFLARE_BASELINE_SCOPES,
+  CLOUDFLARE_CAPABILITIES,
+  CLOUDFLARE_CAPABILITY_SCOPES,
+  CLOUDFLARE_FEATURE_PACKS,
+  CLOUDFLARE_PERMISSION_CATEGORY_LABELS,
+  CLOUDFLARE_PERMISSION_PRODUCTS,
+  listCloudflareCapabilities,
+  listCloudflareFeaturePacks,
+  listCloudflarePermissionProducts,
+  listCloudflarePermissionOptionsByCategory,
+  assertPermissionCatalogCoversAllScopes,
+  getCloudflareCapability,
+  getCloudflareFeaturePack,
+  scopesForCapabilities,
+  scopesForFeaturePacks,
+  assessCapabilityAuthorization,
+  capabilityAuthorizationMatrix,
+  cloudflarePermissionRemediation,
+} from './capabilities.js';
 
-// Full scope catalog for the AgentSam Local Studio OAuth client (182 total,
-// pasted directly from the Cloudflare dashboard's own scope picker). This is
-// what gets requested at mint time -- one authorize covers everything the
-// client is provisioned for, rather than a hand-curated subset that has to
-// be edited in code every time a new capability is used. CLOUDFLARE_CAPABILITY_SCOPES
-// above stays as documentation of which specific scopes each feature
-// actually touches -- it no longer restricts what's requested.
-export const CLOUDFLARE_ALL_SCOPES = Object.freeze([
-  'agent-memory.write',
-  'browser-rendering.read',
-  'browser-rendering.write',
-  'cf-agents.read',
-  'cf-agents.write',
-  'cloud-connector.read',
-  'cloud-connector.write',
-  'cloudchamber.read',
-  'cloudchamber.write',
-  'constellation.read',
-  'constellation.write',
-  'd1.read',
-  'd1.write',
-  'flagship.evaluate',
-  'flagship.read',
-  'flagship.write',
-  'query-cache.read',
-  'query-cache.write',
-  'k2.read',
-  'k2.write',
-  'k2.consume',
-  'k2.produce',
-  'mcp-portals.read',
-  'mcp-portals.write',
-  'messaging.edit',
-  'messaging.read',
-  'cfspeed.read',
-  'cfspeed.write',
-  'page.read',
-  'page.write',
-  'pipelines.read',
-  'pipelines.send',
-  'pipelines.write',
-  'pubsub.read',
-  'pubsub.write',
-  'queues.read',
-  'queues.write',
-  'realtime.write',
-  'realtime.admin',
-  'realtime.read',
-  'secrets-store.read',
-  'secrets-store.write',
-  'vectorize.read',
-  'vectorize.write',
-  'workers-ci.read',
-  'workers-ci.write',
-  'containers.read',
-  'containers.write',
-  'workers-kv-storage.read',
-  'workers-kv-storage.write',
-  'workers-observability.read',
-  'workers-observability-telemetry.write',
-  'workers-observability.write',
-  'r2-catalog.read',
-  'r2-catalog.write',
-  'r2-catalog-sql.read',
-  'workers-r2-bucket-item.read',
-  'workers-r2-bucket-item.write',
-  'workers-r2.read',
-  'workers-r2.write',
-  'workers-routes.read',
-  'workers-routes.write',
-  'workers-scripts.read',
-  'workers-scripts.write',
-  'workers-tail.read',
-  'aiaudit.read',
-  'aiaudit.write',
-  'aig.read',
-  'aig.run',
-  'aig.write',
-  'ai-search.index',
-  'ai-search.read',
-  'ai-search.run',
-  'ai-search.write',
-  'agw.read',
-  'agw.run',
-  'agw.write',
-  'rag.read',
-  'rag.write',
-  'rag.run',
-  'firewall-for-ai.read',
-  'firewall-for-ai.write',
-  'websearch.read',
-  'websearch.run',
-  'websearch.write',
-  'ai-model.read',
-  'ai-model.write',
-  'ai.read',
-  'ai.write',
-  'account-dns-settings.read',
-  'account-dns-settings.write',
-  'dns-firewall.read',
-  'dns-firewall.write',
-  'dns.read',
-  'dns-view.read',
-  'dns-view.write',
-  'dns.write',
-  'registrar-domains.admin',
-  'registrar-domains.read',
-  'registrar-sandbox-domains.admin',
-  'registrar-sandbox-domains.read',
-  'zone-custom-asset.read',
-  'zone-custom-asset.write',
-  'zone-dns-settings.read',
-  'zone-dns-settings.write',
-  'zone.read',
-  'zone-settings.read',
-  'zone-settings.write',
-  'zone-versioning.read',
-  'zone-versioning.write',
-  'zone.write',
-  'fraud-detection-pii.read',
-  'account-firewall-access-rules.read',
-  'account-firewall-access-rules.write',
-  'account-security-center-insights.read',
-  'account-security-center-insights.write',
-  'account-waf.read',
-  'account-waf.write',
-  'request-tracer.read',
-  'reports-application-security-report.read',
-  'bot-management-feedback.read',
-  'bot-management-feedback.write',
-  'bot-management.read',
-  'bot-management.write',
-  'http-applications.read',
-  'http-applications.write',
-  'http-ddos-managed-ruleset.read',
-  'http-ddos-managed-ruleset.write',
-  'tag.read',
-  'tag.write',
-  'url-scanner.read',
-  'url-scanner.write',
-  'zone-security-center-insights.read',
-  'zone-security-center-insights.write',
-  'zone-waf.read',
-  'zone-waf.write',
-  'account-custom-error-rules.read',
-  'account-custom-error-rules.write',
-  'account-custom-pages.read',
-  'account-custom-pages.write',
-  'account-rule-lists.read',
-  'account-rule-lists.write',
-  'account-rulesets.read',
-  'account-rulesets.write',
-  'config-settings.read',
-  'config-settings.write',
-  'custom-errors.read',
-  'custom-errors.write',
-  'custom-pages.read',
-  'custom-pages.write',
-  'dynamic-redirect.read',
-  'dynamic-redirect.write',
-  'managed-headers.read',
-  'managed-headers.write',
-  'mass-url-redirects.read',
-  'mass-url-redirects.write',
-  'origin.read',
-  'origin.write',
-  'payments-gateway.read',
-  'payments-gateway.write',
-  'account-ssl-and-certificates.read',
-  'account-ssl-and-certificates.write',
-  'cache.purge',
-  'cache-settings.read',
-  'cache-settings.write',
-  'ssl-and-certificates.read',
-  'ssl-and-certificates.write',
-  'account-api-gateway.write',
-  'account-api-gateway.read',
-  'account-custom-asset.read',
-  'account-custom-asset.write',
-  'account-settings.read',
-  'account-settings.write',
-  'apps.write',
-  'integration.write',
-  'memberships.read',
-  'memberships.write',
-  'notifications.read',
-  'notifications.write',
-  'scim-provisioning.write',
-  'user-details.read',
-  'offline_access'
-]);
+export {
+  upsertCloudflareUserOauthToken,
+  revokeCloudflareUserOauthTokens,
+  resolveCloudflareAccountId,
+  unionScopes,
+} from './oauth-persist.js';
 
-export function requestedCloudflareScopes() {
-  return [...CLOUDFLARE_ALL_SCOPES];
+export {
+  CloudflareApiClient,
+  CloudflareApiError,
+  resolveCloudflareApiAuth,
+  createCloudflareApiClient,
+  receipt as cloudflareReceipt,
+} from './api-client.js';
+
+export {
+  resolveCloudflareCredential,
+  credentialSafeMeta,
+  loadCloudflareFromUserOauthTokens,
+  loadCloudflareFromLegacyConnections,
+  loadCloudflareConnectionRecord,
+  mapCloudflareOauthRowToConnection,
+} from './credential.js';
+
+export * as workflows from './families/workflows.js';
+export * as scanner from './families/scanner.js';
+export * as tags from './families/tags.js';
+export * as tagGateway from './families/tag-gateway.js';
+export * as brandProtection from './families/brand-protection.js';
+export * as keyless from './families/keyless.js';
+export * as tokenValidation from './families/token-validation.js';
+export * as pages from './families/pages.js';
+export * as snippets from './families/snippets.js';
+export * as vectorize from './families/vectorize.js';
+
+import { scopesForCapabilities as _scopesForCapabilities, scopesForFeaturePacks as _scopesForFeaturePacks } from './capabilities.js';
+import { CLOUDFLARE_ALL_SCOPES as _CLOUDFLARE_ALL_SCOPES, isKnownCloudflareScope } from './scope-catalog.js';
+
+// Full Local Studio scope catalog — offerable via packs/products; pack `all` opts in wholesale.
+export const CLOUDFLARE_ALL_SCOPES = _CLOUDFLARE_ALL_SCOPES;
+export { isKnownCloudflareScope };
+
+/**
+ * Scopes requested at OAuth mint / re-authorize.
+ * Default: baseline only. Pass `capabilities` and/or `packs` to upgrade deliberately.
+ * Host apps supply their own default capability list — this package does not.
+ * Pass `{ all: true }` or pack `all` when the user explicitly wants every offerable scope.
+ * @param {{ capabilities?: string[], packs?: string[], all?: boolean }} [opts]
+ */
+export function requestedCloudflareScopes(opts = {}) {
+  if (opts && opts.all === true) return [...CLOUDFLARE_ALL_SCOPES];
+  const capabilities = Array.isArray(opts?.capabilities) ? opts.capabilities.filter(Boolean) : [];
+  const packs = Array.isArray(opts?.packs) ? opts.packs.filter(Boolean) : [];
+  if (packs.map((p) => String(p).toLowerCase()).includes('all')) {
+    return [...CLOUDFLARE_ALL_SCOPES];
+  }
+  if (packs.length) {
+    return _scopesForFeaturePacks(packs, capabilities);
+  }
+  return _scopesForCapabilities({
+    capabilities,
+    includeBaseline: true,
+    generallyAvailableOnly: true,
+  });
 }
 
+
 function clean(value) {
   return value == null ? '' : String(value).trim();
 }
@@ -303,61 +175,27 @@ export function assertConnectionOwner(connection, ownerId) {
   return connection;
 }
 
+/**
+ * LEGACY dual-read wrapper — now SSOT-only via user_oauth_tokens.
+ * Prefer resolveCloudflareCredential / createCloudflareApiClient.
+ */
 export async function loadCloudflareAccessToken(env, ownerId, options = {}) {
-  if (!env?.DB || !ownerId) return null;
-  const row = await env.DB.prepare(`
-    SELECT connection_id, owner_id, cloudflare_account_id, scopes, status,
-           access_token_encrypted, refresh_token_encrypted, expires_at
-    FROM agentsam_cloudflare_connections
-    WHERE owner_id = ? AND status = 'connected'
-    ORDER BY updated_at DESC LIMIT 1
-  `).bind(ownerId).first();
-  if (!row?.access_token_encrypted || row.owner_id !== ownerId) return null;
-  const { decryptSecret, sealToken } = await import('./vault.js');
-  const aad = `cloudflare-connection:${ownerId}`;
-  let accessToken = await decryptSecret(env, row.access_token_encrypted, aad);
-  let refreshToken = row.refresh_token_encrypted
-    ? await decryptSecret(env, row.refresh_token_encrypted, aad)
-    : '';
-  let expiresAt = Number(row.expires_at || 0) || null;
-  let scopes = row.scopes ? String(row.scopes).split(' ').filter(Boolean) : [];
-  const now = Math.floor(Date.now() / 1000);
-  if (expiresAt && expiresAt <= now + 60) {
-    if (!refreshToken) throw new Error('cloudflare_refresh_token_missing');
-    const refreshParams = new URLSearchParams({
-      grant_type: 'refresh_token',
-      refresh_token: refreshToken,
-      client_id: String(env.CLOUDFLARE_OAUTH_CLIENT_ID || ''),
-    });
-    const refreshResponse = await (options.fetchImpl || fetch)(CLOUDFLARE_OAUTH_TOKEN_URL, {
-      method: 'POST',
-      headers: { 'content-type': 'application/x-www-form-urlencoded' },
-      body: refreshParams,
-    });
-    if (!refreshResponse.ok) throw new Error(`cloudflare_token_refresh_failed:${refreshResponse.status}`);
-    const refreshed = await refreshResponse.json();
-    if (!refreshed?.access_token) throw new Error('cloudflare_token_refresh_missing_access_token');
-    accessToken = refreshed.access_token;
-    refreshToken = refreshed.refresh_token || refreshToken;
-    scopes = String(refreshed.scope || row.scopes || '').split(' ').filter(Boolean);
-    expiresAt = refreshed.expires_in ? now + Number(refreshed.expires_in) : null;
-    const [accessEncrypted, refreshEncrypted] = await Promise.all([
-      sealToken(env, accessToken, aad),
-      sealToken(env, refreshToken, aad),
-    ]);
-    await env.DB.prepare(`
-      UPDATE agentsam_cloudflare_connections
-      SET access_token_encrypted = ?, refresh_token_encrypted = ?, scopes = ?,
-          expires_at = ?, status = 'connected', updated_at = unixepoch()
-      WHERE connection_id = ? AND owner_id = ?
-    `).bind(accessEncrypted, refreshEncrypted, scopes.join(' '), expiresAt, row.connection_id, ownerId).run();
-  }
+  const { resolveCloudflareCredential } = await import('./credential.js');
+  const cred = await resolveCloudflareCredential({
+    env,
+    ownerId,
+    authMode: 'oauth',
+    decryptUserOauthToken: options.decryptUserOauthToken,
+    ...options,
+  });
+  if (!cred?.bearerToken) return null;
   return {
-    accessToken,
-    connectionId: row.connection_id,
-    accountId: row.cloudflare_account_id || null,
-    scopes,
-    expiresAt,
+    accessToken: cred.bearerToken,
+    connectionId: cred.connectionId,
+    accountId: cred.accountId,
+    scopes: cred.grantedScopes || [],
+    expiresAt: cred.expiresAt,
+    source: cred.source,
   };
 }