@lvce-editor/auth-worker 3.19.0 → 3.21.0

package/README.md

@@ -1,3 +1,7 @@
 # Auth Worker
 
 WebWorker for the Auth functionality in Lvce Editor.
+
+## Cloudflare account connections
+
+`Auth.getCloudflareConnectionsUrl` returns `/cloudflare` on the configured authentication backend. `Auth.getCloudflareStatus`, `Auth.getCloudflareZones`, and `Auth.approveCloudflareMachine(id, code, zoneId)` use the current LVCE access token. Cloudflare OAuth credentials stay in backend-2. Signed-out requests fail locally. The backend needs a separately registered Cloudflare OAuth client; see [deployment setup](https://github.com/lvce-editor/backend-2/blob/main/docs/cloudflare.md).

package/dist/authWorkerMain.js

@@ -3055,7 +3055,7 @@ const getEffectiveRedirectUri = async (platform, uid, redirectUri) => {
 
 const nativeOidcClientId = 'lvce-editor-native';
 const webOidcClientId = 'lvce-editor-web';
-const oidcScope = 'openid offline_access profile email';
+const oidcScope = 'openid offline_access profile email user remote';
 const getOidcClientId = platform => {
   return platform === Electron ? nativeOidcClientId : webOidcClientId;
 };
@@ -3523,6 +3523,42 @@ const syncBackendAuth = async backendUrl => initialize({
   backendUrl
 });
 
+const identifier = /^[a-f0-9]{32}$/;
+const confirmationCode = /^[A-F0-9]{8}$/;
+const getCloudflareConnectionsUrl = () => new URL('/cloudflare', getAuthBackendUrl()).href;
+const request = async (pathname, method = 'GET', body) => {
+  const backendUrl = getAuthBackendUrl();
+  const accessToken = await getAccessToken({
+    refresh: 'if-needed'
+  });
+  if (backendUrl !== getAuthBackendUrl()) throw new Error('Account backend changed. Retry Cloudflare setup.');
+  if (!accessToken) throw new Error('Sign in to LVCE to manage Cloudflare connections.');
+  const response = await fetch(new URL(pathname, backendUrl), {
+    headers: {
+      Accept: 'application/json',
+      Authorization: `Bearer ${accessToken}`,
+      'Content-Type': 'application/json'
+    },
+    method,
+    redirect: 'error',
+    signal: AbortSignal.timeout(30_000),
+    ...(body !== undefined && {
+      body: JSON.stringify(body)
+    })
+  });
+  if (!response.ok) throw new Error(`Cloudflare connection request failed (${response.status}). Open account connections to check authorization and domains.`);
+  return response.json();
+};
+const getCloudflareStatus = () => request('/cloudflare/status');
+const getCloudflareZones = () => request('/cloudflare/zones');
+const approveCloudflareMachine = (id, code, zoneId) => {
+  if (!identifier.test(id) || !identifier.test(zoneId) || !confirmationCode.test(code)) throw new Error('Invalid Cloudflare setup code or domain.');
+  return request(`/cloudflare/setup/${id}/approve`, 'POST', {
+    code,
+    zoneId
+  });
+};
+
 const sendMessagePortToAuthProcess = async port => {
   await invokeAndTransfer('SendMessagePortToExtensionHostWorker.sendMessagePortToSharedProcess', port, 'HandleMessagePortForAuthProcess.handleMessagePortForAuthProcess');
 };
@@ -3568,6 +3604,7 @@ const handleMessagePort = async (port, rpcId) => {
 };
 
 const commandMap = {
+  'Auth.approveCloudflareMachine': approveCloudflareMachine,
   'Auth.clearMocks': clear,
   'Auth.configure': configure,
   'Auth.consumeNextLoginResponse': consumeNextLoginResponse,
@@ -3575,6 +3612,10 @@ const commandMap = {
   'Auth.disconnectConnectedAccount': disconnectConnectedAccount,
   'Auth.getAccessToken': getAccessToken,
   'Auth.getAccounts': getAccounts,
+  'Auth.getBackendUrl': getAuthBackendUrl,
+  'Auth.getCloudflareConnectionsUrl': getCloudflareConnectionsUrl,
+  'Auth.getCloudflareStatus': getCloudflareStatus,
+  'Auth.getCloudflareZones': getCloudflareZones,
   'Auth.getConnectedAccounts': getConnectedAccounts,
   'Auth.hasPendingMockLoginResponse': hasPendingMockLoginResponse,
   'Auth.hasPendingMockRefreshResponse': hasPendingMockRefreshResponse,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lvce-editor/auth-worker",
-  "version": "3.19.0",
+  "version": "3.21.0",
   "description": "Auth Worker",
   "repository": {
     "type": "git",