@lvce-editor/auth-worker 3.18.1 → 3.20.0

package/README.md

@@ -1,3 +1,7 @@
 # Auth Worker
 
 WebWorker for the Auth functionality in Lvce Editor.
+
+## Cloudflare account connections
+
+`Auth.getCloudflareConnectionsUrl` returns `/cloudflare` on the configured authentication backend. `Auth.getCloudflareStatus`, `Auth.getCloudflareZones`, and `Auth.approveCloudflareMachine(id, code, zoneId)` use the current LVCE access token. Cloudflare OAuth credentials stay in backend-2. Signed-out requests fail locally. The backend needs a separately registered Cloudflare OAuth client; see [deployment setup](https://github.com/lvce-editor/backend-2/blob/main/docs/cloudflare.md).

package/dist/authWorkerMain.js

@@ -1253,7 +1253,8 @@ const setAuthBackendUrl = backendUrl => {
 };
 
 const state$3 = {
-  platform: Web
+  platform: Web,
+  useNativeAuth: false
 };
 const getAuthPlatform = () => {
   return state$3.platform;
@@ -1262,6 +1263,12 @@ const setAuthPlatform = value => {
   state$3.platform = value;
 };
 
+// Native shells can use loopback OAuth without Electron's process or secret storage.
+const setUseNativeAuth = value => {
+  state$3.useNativeAuth = value;
+};
+const getUseNativeAuth = () => state$3.useNativeAuth;
+
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
   const NAME = 'oauth4webapi';
@@ -3048,7 +3055,7 @@ const getEffectiveRedirectUri = async (platform, uid, redirectUri) => {
 
 const nativeOidcClientId = 'lvce-editor-native';
 const webOidcClientId = 'lvce-editor-web';
-const oidcScope = 'openid offline_access profile email';
+const oidcScope = 'openid offline_access profile email user remote';
 const getOidcClientId = platform => {
   return platform === Electron ? nativeOidcClientId : webOidcClientId;
 };
@@ -3118,7 +3125,16 @@ const getElectronAuthorizationCode = async uid => {
 const waitForElectronBackendLogin = async (backendUrl, uid, redirectUri, codeVerifier, timeoutMs = 30_000, pollIntervalMs = 1000, getAuthorizationCode = getElectronAuthorizationCode, exchangeAuthorizationCode = exchangeElectronAuthorizationCode, getUserName = getOidcUserName) => {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
-    const authorizationCode = await getAuthorizationCode(uid);
+    let timer;
+    const timeout = new Promise(resolve => {
+      timer = setTimeout(resolve, Math.max(0, deadline - Date.now()));
+    });
+    let authorizationCode;
+    try {
+      authorizationCode = await Promise.race([getAuthorizationCode(uid), timeout]);
+    } finally {
+      clearTimeout(timer);
+    }
     if (hasAuthorizationCode(authorizationCode)) {
       const tokenResponse = await exchangeAuthorizationCode(backendUrl, authorizationCode, redirectUri, codeVerifier);
       const authAccessTokenExpiresAt = getAccessTokenExpiresAt(tokenResponse.expiresIn);
@@ -3159,37 +3175,45 @@ const getMockLoginResult = async (signingInState, persistResult) => {
   return persistResult(getLoggedInState(signingInState, response));
 };
 const getInteractiveLoginResult = async (backendUrl, platform, signingInState, persistResult, selectAccount) => {
-  const authUseRedirect = getAuthUseRedirect(platform);
-  const uid = 0;
-  const {
-    clientId,
-    codeVerifier,
-    loginUrl,
-    redirectUri,
-    state
-  } = await getBackendLoginRequest(backendUrl, platform, uid);
-  if (platform !== Electron) {
-    const returnUrl = await getCurrentHref();
-    await savePendingOidcAuthState({
+  const nativeAuth = getUseNativeAuth();
+  const transportPlatform = nativeAuth ? Electron : platform;
+  const authUseRedirect = getAuthUseRedirect(transportPlatform);
+  const uid = nativeAuth ? globalThis.crypto.randomUUID() : 0;
+  try {
+    const {
       clientId,
       codeVerifier,
+      loginUrl,
       redirectUri,
-      returnUrl,
       state
+    } = await getBackendLoginRequest(backendUrl, transportPlatform, uid);
+    if (transportPlatform !== Electron) {
+      const returnUrl = await getCurrentHref();
+      await savePendingOidcAuthState({
+        clientId,
+        codeVerifier,
+        redirectUri,
+        returnUrl,
+        state
+      });
+    }
+    await invoke$1('Open.openUrl', selectAccount ? getAccountLoginUrl(backendUrl, loginUrl) : loginUrl, platform, authUseRedirect);
+    if (transportPlatform !== Electron && authUseRedirect) {
+      return signingInState;
+    }
+    const authState = transportPlatform === Electron ? await waitForElectronBackendLogin(backendUrl, uid, redirectUri, codeVerifier) : await waitForBackendLogin(backendUrl);
+    if (transportPlatform !== Electron) {
+      await clearPendingOidcAuthState();
+    }
+    return persistResult({
+      ...authState,
+      authClientId: clientId
     });
+  } finally {
+    if (nativeAuth) {
+      await invoke$3('OAuthServer.dispose', String(uid));
+    }
   }
-  await invoke$1('Open.openUrl', selectAccount ? getAccountLoginUrl(backendUrl, loginUrl) : loginUrl, platform, authUseRedirect);
-  if (platform !== Electron && authUseRedirect) {
-    return signingInState;
-  }
-  const authState = platform === Electron ? await waitForElectronBackendLogin(backendUrl, uid, redirectUri, codeVerifier) : await waitForBackendLogin(backendUrl);
-  if (platform !== Electron) {
-    await clearPendingOidcAuthState();
-  }
-  return persistResult({
-    ...authState,
-    authClientId: clientId
-  });
 };
 const handleClickLogin = async (options, persistResult = persistLoginResult) => {
   const {
@@ -3212,7 +3236,7 @@ const handleClickLogin = async (options, persistResult = persistLoginResult) =>
     if (mockLoginResult) {
       return mockLoginResult;
     }
-    return getInteractiveLoginResult(backendUrl, platform, signingInState, persistResult, options.selectAccount === true);
+    return await getInteractiveLoginResult(backendUrl, platform, signingInState, persistResult, options.selectAccount === true);
   } catch (error) {
     await clearPendingOidcAuthState();
     const errorMessage = error instanceof Error && error.message ? error.message : 'Backend authentication failed.';
@@ -3499,6 +3523,42 @@ const syncBackendAuth = async backendUrl => initialize({
   backendUrl
 });
 
+const identifier = /^[a-f0-9]{32}$/;
+const confirmationCode = /^[A-F0-9]{8}$/;
+const getCloudflareConnectionsUrl = () => new URL('/cloudflare', getAuthBackendUrl()).href;
+const request = async (pathname, method = 'GET', body) => {
+  const backendUrl = getAuthBackendUrl();
+  const accessToken = await getAccessToken({
+    refresh: 'if-needed'
+  });
+  if (backendUrl !== getAuthBackendUrl()) throw new Error('Account backend changed. Retry Cloudflare setup.');
+  if (!accessToken) throw new Error('Sign in to LVCE to manage Cloudflare connections.');
+  const response = await fetch(new URL(pathname, backendUrl), {
+    headers: {
+      Accept: 'application/json',
+      Authorization: `Bearer ${accessToken}`,
+      'Content-Type': 'application/json'
+    },
+    method,
+    redirect: 'error',
+    signal: AbortSignal.timeout(30_000),
+    ...(body !== undefined && {
+      body: JSON.stringify(body)
+    })
+  });
+  if (!response.ok) throw new Error(`Cloudflare connection request failed (${response.status}). Open account connections to check authorization and domains.`);
+  return response.json();
+};
+const getCloudflareStatus = () => request('/cloudflare/status');
+const getCloudflareZones = () => request('/cloudflare/zones');
+const approveCloudflareMachine = (id, code, zoneId) => {
+  if (!identifier.test(id) || !identifier.test(zoneId) || !confirmationCode.test(code)) throw new Error('Invalid Cloudflare setup code or domain.');
+  return request(`/cloudflare/setup/${id}/approve`, 'POST', {
+    code,
+    zoneId
+  });
+};
+
 const sendMessagePortToAuthProcess = async port => {
   await invokeAndTransfer('SendMessagePortToExtensionHostWorker.sendMessagePortToSharedProcess', port, 'HandleMessagePortForAuthProcess.handleMessagePortForAuthProcess');
 };
@@ -3524,8 +3584,11 @@ const initializeMainProcess = async () => {
 const configure = async options => {
   setAuthBackendUrl(options.backendUrl);
   setAuthPlatform(options.platform);
+  setUseNativeAuth(options.useNativeAuth === true);
   if (options.platform === Electron) {
     await Promise.all([initializeAuthProcess(), initializeMainProcess()]);
+  } else if (options.useNativeAuth) {
+    await initializeAuthProcess();
   }
 };
 
@@ -3541,6 +3604,7 @@ const handleMessagePort = async (port, rpcId) => {
 };
 
 const commandMap = {
+  'Auth.approveCloudflareMachine': approveCloudflareMachine,
   'Auth.clearMocks': clear,
   'Auth.configure': configure,
   'Auth.consumeNextLoginResponse': consumeNextLoginResponse,
@@ -3548,6 +3612,9 @@ const commandMap = {
   'Auth.disconnectConnectedAccount': disconnectConnectedAccount,
   'Auth.getAccessToken': getAccessToken,
   'Auth.getAccounts': getAccounts,
+  'Auth.getCloudflareConnectionsUrl': getCloudflareConnectionsUrl,
+  'Auth.getCloudflareStatus': getCloudflareStatus,
+  'Auth.getCloudflareZones': getCloudflareZones,
   'Auth.getConnectedAccounts': getConnectedAccounts,
   'Auth.hasPendingMockLoginResponse': hasPendingMockLoginResponse,
   'Auth.hasPendingMockRefreshResponse': hasPendingMockRefreshResponse,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lvce-editor/auth-worker",
-  "version": "3.18.1",
+  "version": "3.20.0",
   "description": "Auth Worker",
   "repository": {
     "type": "git",