@nodeart/cloudflare-provisioning 1.0.4 → 1.0.6

package/.github/workflows/test-on-pr.yaml

@@ -0,0 +1,18 @@
+name: run test on PR
+'on': pull_request
+
+# cancel in-progress runs on new commits to same PR (gitub.event.number)
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.number || github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16
+      - run: npm ci
+      - run: npm test

package/cloudflare.js

@@ -1,5 +1,6 @@
 'use strict'
 
+const fs = require('node:fs/promises')
 const { request } = require('undici')
 
 const CLOUDFLARE_API_URL = 'https://api.cloudflare.com/client/v4/'
@@ -191,7 +192,7 @@ class CloudFlare {
   }
 
   async getFirewallRules () {
-    const url = CLOUDFLARE_API_URL + `zones/${this.zoneId}/firewall/rules`
+    const url = CLOUDFLARE_API_URL + `zones/${this.zoneId}/rulesets/phases/http_request_firewall_custom/entrypoint`
 
     const { statusCode, body } = await request(url, {
       method: 'GET',
@@ -207,11 +208,20 @@ class CloudFlare {
       throw new Error(`Could not get firewall rules: ${statusCode}, error: ${JSON.stringify(response)}`)
     }
 
-    return response
+    const { id, rules } = response?.result ?? {}
+    if (!id) {
+      throw new Error(`Could not get firewall rules ruleset ID: got ${id}, received value: ${JSON.stringify(response)}`)
+    }
+
+    return { id, rules }
   }
 
-  async createFirewallRule (firewallRule) {
-    const url = CLOUDFLARE_API_URL + `zones/${this.zoneId}/firewall/rules`
+  async createFirewallRule (rulesetId, firewallRule) {
+    const url = CLOUDFLARE_API_URL + `zones/${this.zoneId}/rulesets/${rulesetId}/rules`
+    // Spread "filter" property from deprecated rule API
+    const filter = firewallRule?.filter ?? {}
+    const rule = { ...firewallRule, ...filter }
+    delete rule.filter
 
     const { statusCode, body } = await request(url, {
       method: 'POST',
@@ -219,7 +229,7 @@ class CloudFlare {
         ...this.authorizationHeaders,
         'Content-Type': 'application/json'
       },
-      body: JSON.stringify([firewallRule])
+      body: JSON.stringify(rule)
     })
 
     const response = await body.json()
@@ -231,8 +241,12 @@ class CloudFlare {
     return response
   }
 
-  async updateFirewallRule (id, firewallRule) {
-    const url = CLOUDFLARE_API_URL + `zones/${this.zoneId}/firewall/rules/${id}`
+  async updateFirewallRule (rulesetId, ruleId, firewallRule) {
+    const url = CLOUDFLARE_API_URL + `zones/${this.zoneId}/rulesets/${rulesetId}/rules/${ruleId}`
+    // Spread "filter" property from deprecated rule API
+    const filter = firewallRule?.filter ?? {}
+    const rule = { ...firewallRule, ...filter }
+    delete rule.filter
 
     const { statusCode, body } = await request(url, {
       method: 'PATCH',
@@ -240,7 +254,7 @@ class CloudFlare {
         ...this.authorizationHeaders,
         'Content-Type': 'application/json'
       },
-      body: JSON.stringify(firewallRule)
+      body: JSON.stringify(rule)
     })
 
     const response = await body.json()
@@ -253,18 +267,18 @@ class CloudFlare {
   }
 
   async rewriteFirewallRules (firewallRules) {
-    const currentFirewallRules = await this.getFirewallRules()
+    const { id: rulesetId, rules: currentFirewallRules } = await this.getFirewallRules()
 
     for (const firewallRule of firewallRules) {
-      const currentFirewallRule = currentFirewallRules.result.find(
+      const currentFirewallRule = currentFirewallRules.find(
         rule => rule.description === firewallRule.description
       )
 
       try {
         if (currentFirewallRule) {
-          await this.updateFirewallRule(currentFirewallRule.id, firewallRule)
+          await this.updateFirewallRule(rulesetId, currentFirewallRule.id, firewallRule)
         } else {
-          await this.createFirewallRule(firewallRule)
+          await this.createFirewallRule(rulesetId, firewallRule)
         }
       } catch (error) {
         console.error(`Could not update firewall rule for domain ${this.domain}: ${JSON.stringify(firewallRule)}, error: ${error}`)
@@ -272,6 +286,127 @@ class CloudFlare {
     }
   }
 
+  async getRedirectRules () {
+    const url = CLOUDFLARE_API_URL + `zones/${this.zoneId}/rulesets/phases/http_request_dynamic_redirect/entrypoint`
+
+    const { statusCode, body } = await request(url, {
+      method: 'GET',
+      headers: {
+        ...this.authorizationHeaders,
+        'Content-Type': 'application/json'
+      }
+    })
+
+    const response = await body.json()
+
+    if (statusCode === 404) {
+      // Create http_request_dynamic_redirect ruleset if one doesn't exist
+      console.log('Ruleset was not found. Initializing redirect ruleset creation...')
+      const createRulesetUrl = CLOUDFLARE_API_URL + `zones/${this.zoneId}/rulesets`
+      const payload = {
+        name: 'Redirect rules ruleset',
+        kind: 'zone',
+        phase: 'http_request_dynamic_redirect',
+        rules: []
+      }
+
+      const { statusCode: createStatusCode, body: createBody } = await request(createRulesetUrl, {
+        method: 'POST',
+        headers: {
+          ...this.authorizationHeaders,
+          'Content-Type': 'application/json'
+        },
+        body: JSON.stringify(payload)
+      })
+
+      const createResponse = await createBody.json()
+
+      if (createStatusCode !== 200) {
+        throw new Error(`Could not create redirect ruleset: ${statusCode}, error: ${JSON.stringify(createResponse)}`)
+      }
+
+      const { id, rules } = createResponse?.result ?? {}
+      if (!id) {
+        throw new Error(`Could not get redirect rules ruleset ID: got ${id}, received value: ${JSON.stringify(response)}`)
+      }
+
+      return { id, rules: rules ?? [] }
+    } else {
+      if (statusCode !== 200) {
+        throw new Error(`Could not get redirect rules: ${statusCode}, error: ${JSON.stringify(response)}`)
+      }
+
+      const { id, rules } = response?.result ?? {}
+      if (!id) {
+        throw new Error(`Could not get redirect rules ruleset ID: got ${id}, received value: ${JSON.stringify(response)}`)
+      }
+
+      return { id, rules: rules ?? [] }
+    }
+  }
+
+  async createRedirectRule (rulesetId, redirectRule) {
+    const url = CLOUDFLARE_API_URL + `zones/${this.zoneId}/rulesets/${rulesetId}/rules`
+
+    const { statusCode, body } = await request(url, {
+      method: 'POST',
+      headers: {
+        ...this.authorizationHeaders,
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify(redirectRule)
+    })
+
+    const response = await body.json()
+
+    if (statusCode !== 200) {
+      throw new Error(`Could not create a redirect rule: ${statusCode}, error: ${JSON.stringify(response)}`)
+    }
+
+    return response
+  }
+
+  async updateRedirectRule (rulesetId, ruleId, redirectRule) {
+    const url = CLOUDFLARE_API_URL + `zones/${this.zoneId}/rulesets/${rulesetId}/rules/${ruleId}`
+
+    const { statusCode, body } = await request(url, {
+      method: 'PATCH',
+      headers: {
+        ...this.authorizationHeaders,
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify(redirectRule)
+    })
+
+    const response = await body.json()
+
+    if (statusCode !== 200) {
+      throw new Error(`Could not update a redirect rule: ${statusCode}, error: ${JSON.stringify(response)}`)
+    }
+
+    return response
+  }
+
+  async rewriteRedirectRules (redirectRules) {
+    const { id: rulesetId, rules: currentRedirectRules } = await this.getRedirectRules()
+
+    for (const redirectRule of redirectRules) {
+      const currentRedirectRule = currentRedirectRules.find(
+        rule => rule.description === redirectRule.description
+      )
+
+      try {
+        if (currentRedirectRule) {
+          await this.updateRedirectRule(rulesetId, currentRedirectRule.id, redirectRule)
+        } else {
+          await this.createRedirectRule(rulesetId, redirectRule)
+        }
+      } catch (error) {
+        console.error(`Could not update redirect rule for domain ${this.domain}: ${JSON.stringify(redirectRule)}, error: ${error}`)
+      }
+    }
+  }
+
   async setPolish (value) {
     const url = CLOUDFLARE_API_URL + `zones/${this.zoneId}/settings/polish`
 
@@ -668,6 +803,97 @@ class CloudFlare {
 
     return response
   }
+
+  async uploadTlsClientAuth ({ clientKey, clientCert, caCert }) {
+    try {
+      await fs.access(clientKey, fs.constants.R_OK)
+      await fs.access(clientCert, fs.constants.R_OK)
+      await fs.access(caCert, fs.constants.R_OK)
+    } catch (e) {
+      throw new Error(`Cancelling cert upload for domain ${this.domain}. Cannot access file: ${e?.message}`)
+    }
+
+    const clientKeyContents = await fs.readFile(clientKey, 'utf8')
+    const clientCertContents = await fs.readFile(clientCert, 'utf8')
+    const caCertContents = await fs.readFile(caCert, 'utf8')
+
+    await this.uploadCertAndKey(clientCertContents, clientKeyContents)
+    await this.uploadCaCert(caCertContents)
+    await this.enableTLSClientAuth()
+  }
+
+  async uploadCertAndKey (clientCert, clientKey) {
+    const url = CLOUDFLARE_API_URL + `zones/${this.zoneId}/origin_tls_client_auth`
+    const payload = {
+      certificate: clientCert.replace(/\r?\n/g, '\n'),
+      private_key: clientKey.replace(/\r?\n/g, '\n')
+    }
+
+    const { statusCode, body } = await request(url, {
+      method: 'POST',
+      headers: {
+        ...this.authorizationHeaders,
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify(payload)
+    })
+
+    const response = await body.json()
+
+    if (statusCode !== 200 && statusCode !== 201) {
+      const errors = response?.errors ?? []
+      if (errors.find((error) => error.code === 1406 && error.message === 'This certificate already exists for this zone.')) {
+        console.log(`This certificate already exists for domain ${this.domain}. Continuing...`)
+      } else {
+        throw new Error(`Could not upload certificate and private key: ${statusCode}, error: ${JSON.stringify(response)}`)
+      }
+    }
+  }
+
+  async uploadCaCert (caCert) {
+    const url = CLOUDFLARE_API_URL + `zones/${this.zoneId}/acm/custom_trust_store`
+    const payload = {
+      certificate: caCert.replace(/\r?\n/g, '\n')
+    }
+
+    const { statusCode, body } = await request(url, {
+      method: 'POST',
+      headers: {
+        ...this.authorizationHeaders,
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify(payload)
+    })
+
+    const response = await body.json()
+
+    if (statusCode !== 200 && statusCode !== 201) {
+      const errors = response?.errors ?? []
+      if (errors.find((error) => error.code === 1406 && error.message === 'This certificate already exists for this zone.')) {
+        console.log(`This CA certificate already exists for domain ${this.domain}. Continuing...`)
+      } else {
+        throw new Error(`Could not upload CA certificate: ${statusCode}, error: ${JSON.stringify(response)}`)
+      }
+    }
+  }
+
+  async enableTLSClientAuth () {
+    const url = CLOUDFLARE_API_URL + `zones/${this.zoneId}/settings/tls_client_auth`
+    const { statusCode, body } = await request(url, {
+      method: 'PATCH',
+      headers: {
+        ...this.authorizationHeaders,
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({ value: 'on' })
+    })
+
+    const response = await body.json()
+
+    if (statusCode !== 200) {
+      throw new Error(`Could not enable TSL Client Auth setting: ${statusCode}, error: ${JSON.stringify(response)}`)
+    }
+  }
 }
 
 module.exports = CloudFlare

package/index.js

@@ -10,6 +10,7 @@ const cloudflareSettingsHandlers = {
   brotli: CloudFlare.prototype.setBrotli,
   dnsRecords: CloudFlare.prototype.rewriteDNSRecords,
   firewallRules: CloudFlare.prototype.rewriteFirewallRules,
+  redirectRules: CloudFlare.prototype.rewriteRedirectRules,
   polish: CloudFlare.prototype.setPolish,
   minify: CloudFlare.prototype.setMinify,
   http2Prioritization: CloudFlare.prototype.setHTTP2Prioritization,
@@ -20,7 +21,8 @@ const cloudflareSettingsHandlers = {
   argoSmartRouting: CloudFlare.prototype.setArgoSmartRouting,
   workers: CloudFlare.prototype.rewriteWorkerRoutes,
   pageRules: CloudFlare.prototype.rewritePageRules,
-  hotlinkProtection: CloudFlare.prototype.setHotlinkProtection
+  hotlinkProtection: CloudFlare.prototype.setHotlinkProtection,
+  tlsClientAuth: CloudFlare.prototype.uploadTlsClientAuth
 }
 
 function substituteDomainName (settings, domainName) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodeart/cloudflare-provisioning",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "description": "",
   "main": "index.js",
   "scripts": {
@@ -15,6 +15,6 @@
     "standard": "^17.0.0"
   },
   "dependencies": {
-    "undici": "^5.10.0"
+    "undici": "^7.3.0"
   }
 }