@lifeaitools/clauth 1.18.1 → 1.19.0

package/cli/commands/serve.js

@@ -3337,6 +3337,80 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
     });
   }
 
+  // Self-heal: mint a connector run-token from the Cloudflare API using the
+  // vault's `cloudflare` token, so `cloudflared tunnel run --token` can start
+  // the tunnel with ZERO local files (~/.cloudflared/config.yml + creds JSON).
+  // This survives a home-dir wipe — clauth has the keys, so it rebuilds the
+  // connector itself. Returns null on any failure so startTunnel() can fall
+  // back to the legacy file-based `tunnel run`.
+  async function getTunnelRunToken() {
+    try {
+      if (!password) return null;
+      const sbUrl = (api.getBaseUrl() || "").replace("/functions/v1/auth-vault", "");
+      const sbKey = api.getAnonKey();
+
+      // Resolve tunnelId: clauth_config.tunnel_id, else config.yml `tunnel:` line
+      let tid = null;
+      if (sbUrl && sbKey) {
+        try {
+          const r = await fetch(`${sbUrl}/rest/v1/clauth_config?key=eq.tunnel_id&select=value`,
+            { headers: { apikey: sbKey, Authorization: `Bearer ${sbKey}` }, signal: AbortSignal.timeout(5000) });
+          if (r.ok) {
+            const rows = await r.json();
+            if (rows.length && rows[0].value && rows[0].value !== "null") {
+              tid = typeof rows[0].value === "string" ? JSON.parse(rows[0].value) : rows[0].value;
+            }
+          }
+        } catch {}
+      }
+      if (!tid) {
+        try {
+          const yml = fs.readFileSync(path.join(os.homedir(), ".cloudflared", "config.yml"), "utf8");
+          const m = yml.match(/^\s*tunnel:\s*(\S+)/m);
+          if (m) tid = m[1];
+        } catch {}
+      }
+      if (!tid) return null;
+
+      // CF API token from the vault
+      const { token, timestamp } = deriveToken(password, machineHash);
+      const cr = await api.retrieve(password, machineHash, token, timestamp, "cloudflare");
+      const cfToken = cr?.value;
+      if (!cfToken) return null;
+
+      // accountId: clauth_config.cf_account_id, else first account on the token
+      let accountId = null;
+      if (sbUrl && sbKey) {
+        try {
+          const r = await fetch(`${sbUrl}/rest/v1/clauth_config?key=eq.cf_account_id&select=value`,
+            { headers: { apikey: sbKey, Authorization: `Bearer ${sbKey}` }, signal: AbortSignal.timeout(5000) });
+          if (r.ok) {
+            const rows = await r.json();
+            if (rows.length && rows[0].value && rows[0].value !== "null") {
+              accountId = typeof rows[0].value === "string" ? JSON.parse(rows[0].value) : rows[0].value;
+            }
+          }
+        } catch {}
+      }
+      if (!accountId) {
+        const ar = await fetch("https://api.cloudflare.com/client/v4/accounts",
+          { headers: { Authorization: `Bearer ${cfToken}` }, signal: AbortSignal.timeout(8000) });
+        const ad = await ar.json();
+        accountId = ad?.result?.[0]?.id || null;
+      }
+      if (!accountId) return null;
+
+      // Mint the connector run-token
+      const tr = await fetch(`https://api.cloudflare.com/client/v4/accounts/${accountId}/cfd_tunnel/${tid}/token`,
+        { headers: { Authorization: `Bearer ${cfToken}` }, signal: AbortSignal.timeout(8000) });
+      const td = await tr.json();
+      if (td?.success && td.result) return td.result;
+      return null;
+    } catch {
+      return null;
+    }
+  }
+
   async function startTunnel() {
     if (tunnelProc) {
       // Already running — ensure status reflects reality (caller may have reset it to "starting")
@@ -3387,9 +3461,15 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
       // Named tunnel (fixed subdomain) or quick tunnel (random URL)
       let args;
       if (tunnelHostname) {
-        // Named tunnel: cloudflared tunnel run (uses ~/.cloudflared/config.yml)
-        // Config maps hostname → local service, so no --url needed
-        args = ["tunnel", "run"];
+        // Self-heal first: mint a connector token from the CF API (clauth has
+        // the keys) and run `--token` — no local config.yml/creds needed.
+        // Fall back to the legacy file-based `tunnel run` only if minting fails.
+        const runToken = await getTunnelRunToken();
+        if (runToken) {
+          args = ["tunnel", "run", "--token", runToken];
+        } else {
+          args = ["tunnel", "run"];
+        }
         tunnelUrl = `https://${tunnelHostname}`;
       } else {
         // Quick tunnel — random URL each session
@@ -6220,6 +6300,16 @@ function createServer(initPassword, whitelist, port, tunnelHostnameInit = null,
           body: JSON.stringify({ key: "tunnel_hostname", value: JSON.stringify(hostname) }),
         });
 
+        // Persist tunnel_id too — required for token-based self-heal after a
+        // daemon restart or a ~/.cloudflared wipe (getTunnelRunToken reads it).
+        if (tunnelId) {
+          await fetch(`${sbUrl}/rest/v1/clauth_config`, {
+            method: "POST",
+            headers: { apikey: sbKey, Authorization: `Bearer ${sbKey}`, "Content-Type": "application/json", Prefer: "resolution=merge-duplicates" },
+            body: JSON.stringify({ key: "tunnel_id", value: JSON.stringify(tunnelId) }),
+          });
+        }
+
         tunnelHostname = hostname;
         tunnelUrl = `https://${hostname}`;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifeaitools/clauth",
-  "version": "1.18.1",
+  "version": "1.19.0",
   "description": "Hardware-bound credential vault for the LIFEAI infrastructure stack",
   "type": "module",
   "bin": {