@package-broker/cli 2.0.0-rc.3 → 2.0.0-rc.4

package/dist/commands/cloudflare/deploy.js

@@ -15,11 +15,14 @@ import { DbError } from '@package-broker/core/db/errors';
 import { createD1HttpExecutor, isLostResponse } from '../../cloudflare/d1-http-executor.js';
 import { assertPrebuiltConfiguration, materializePrebuilt, prebuiltEnvelope, removePrebuilt, } from '../../prebuilt.js';
 import { builtRouteProblems, loadBuiltMigrations } from '../built-manifest.js';
+import { snapshotLocalAuthCapability } from '../../manifest.js';
 import { validateProvidersDocument } from './providers-file.js';
 import { normalizeQueueConsumer } from './queue-consumer.js';
 import { assertMigrationsApplied } from './migrations-check.js';
 import { d1BindingId, workerSettingsDifferences } from './worker-settings.js';
 import { CloudflareApi, CloudflareError, cloudflareCredentials, commandEnvelope, failCommand, object, wasNotSent, } from './api.js';
+import { inputMessages } from './input-messages.js';
+import { resolveLocalAuth, verifiedDeployment, frozenLocalAuthAttempt, readLocalAuthSources, liveLocalAuthModes, } from './local-auth.js';
 import { resolveZone } from './zone.js';
 import { routeConflict } from './routes.js';
 import { InventoryStore, InventoryTransaction, digest, installIdentity, recordDeploymentHistory, DeploymentHistoryCapacityError, safeBuildInfo, } from './inventory.js';
@@ -44,7 +47,6 @@ const PREVIEW_BINDING_FIELDS = {
 const uuid = (v) => typeof v === 'string' &&
     /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(v);
 const safeId = (v) => typeof v === 'string' && /^[a-zA-Z0-9_-]{1,128}$/.test(v);
-const inputMessages = new WeakMap();
 const invalid = (message) => {
     const error = new CloudflareError('invalid_input', 2, false, 'deploy');
     if (message)
@@ -60,6 +62,12 @@ const conflict = (field, ...fields) => {
 const unknown = () => {
     throw new CloudflareError('outcome_unknown', 6, false, 'deploy');
 };
+export function assertLocalAuthAccepted(mode, capability) {
+    if (mode === 'enabled')
+        return;
+    if (mode !== 'disabled' || snapshotLocalAuthCapability(capability) === null)
+        invalid('Cannot disable local sign-in on an artifact without local-auth support');
+}
 export function assertProvidersAccepted(option, identity) {
     if (option?.kind !== 'set' || identity?.runtimeProviders)
         return;
@@ -96,12 +104,18 @@ function desiredProviders(option, identity, live) {
         return invalid('live PB_IDP_PROVIDERS is not valid; pass --providers <file> or --providers none');
     }
 }
-function planned({ id, kind, anchor }) {
+function planned({ id, kind, anchor, policy, }) {
     const value = anchor.slice(anchor.indexOf(':') + 1);
     const slash = value.indexOf('/');
     return kind === 'oidc'
-        ? { id, kind, issuer: value }
-        : { id, kind, teamDomain: value.slice(0, slash), audience: value.slice(slash + 1) };
+        ? { id, kind, issuer: value, ...(policy === undefined ? {} : { policy }) }
+        : {
+            id,
+            kind,
+            teamDomain: value.slice(0, slash),
+            audience: value.slice(slash + 1),
+            ...(policy === undefined ? {} : { policy }),
+        };
 }
 function identityDigest(descriptor, providers) {
     return descriptor === null && providers === null
@@ -120,6 +134,60 @@ function providerPlan(descriptor, providersText) {
     const plan = planProviders(descriptor.compiled.map(planned), runtime);
     return { runtime, plan };
 }
+export async function resolveProviderText(descriptor, option, sources, frozen, checkManaged) {
+    if (frozen) {
+        const text = frozenProviders(frozen);
+        if (option?.kind === 'set' || option?.kind === 'remove') {
+            const requested = desiredProviders(option, descriptor, null);
+            if (requested !== text &&
+                !(option.kind === 'set' &&
+                    text !== null &&
+                    validateProvidersDocument(text).value === requested))
+                return conflict('settings_sha256');
+        }
+        return text;
+    }
+    if (option?.kind === 'set' || option?.kind === 'remove')
+        return desiredProviders(option, descriptor, null);
+    if (sources.some((source) => source.bindings.map(object).some((b) => b.name === 'PB_IDP_PROVIDERS')))
+        await checkManaged();
+    const values = sources.map((source) => desiredProviders(option, descriptor, source));
+    if (new Set(values).size > 1)
+        return conflict('providers');
+    return values[0] ?? null;
+}
+export function setupProviderCandidate(descriptor, text) {
+    return descriptor === null ? [] : providerPlan(descriptor, text).plan.effective;
+}
+export async function checkSetupManagedProviders(api, journal, routes, domain) {
+    const requested = routeInput(routes, journal.identity.script_name);
+    const deployment = journal.deployment;
+    const zones = [
+        ...new Set([
+            deployment?.attempt.prior_settings,
+            deployment?.attempt.intended_settings,
+            deployment?.last_verified?.intended_settings,
+        ].flatMap((settings) => settings?.routes.map((r) => r.zone_id) ?? [])),
+    ];
+    const base = `/workers/scripts/${journal.identity.script_name}`;
+    const live = await readSettings(api, base, journal, requested, domain, true, zones);
+    const current = await active(api, base);
+    checkManagedSettings(journal.deployment?.attempt, verifiedDeployment(deployment), live, current, requested);
+}
+function checkManagedSettings(priorAttempt, recordedVerified, live, current, requestedRoutes) {
+    let managed = priorAttempt?.intended_settings ?? recordedVerified?.intended_settings;
+    if (priorAttempt?.phase === 'failed' || priorAttempt?.phase === 'rolled_back')
+        managed =
+            restoredSnapshot(priorAttempt, priorAttempt.phase === 'failed' && equal(current, beforeCandidate(priorAttempt))
+                ? live
+                : undefined) ?? conflict('managed_settings');
+    if (live.routes.some((r) => !requestedRoutes.some((x) => x.zone_id === r.zone_id && x.pattern === r.pattern)))
+        return conflict('routes', 'routes:unmanaged_own');
+    // Never take over pre-existing attachments without a previous managed receipt.
+    if ((live.consumer || live.schedules.length || live.routes.length || live.domain) &&
+        (!managed || !matchesManaged(live, managed)))
+        return conflict('managed_settings');
+}
 function effectiveAnchors(descriptor, providersText) {
     if (descriptor === null)
         return [];
@@ -303,6 +371,10 @@ export async function validateDeploymentArtifact(out) {
         const identity = hasIdentity ? snapshotIdentityDescriptor(manifest.identity) : null;
         if (hasIdentity && identity === null)
             return invalid();
+        const hasLocalAuth = Object.hasOwn(manifest, 'localAuth');
+        const localAuth = hasLocalAuth ? snapshotLocalAuthCapability(manifest.localAuth) : null;
+        if (hasLocalAuth && localAuth === null)
+            return invalid();
         if (manifest.schemaVersion !== 1 ||
             manifest.platform !== 'cloudflare' ||
             !Array.isArray(manifest.plugins) ||
@@ -380,6 +452,7 @@ export async function validateDeploymentArtifact(out) {
             artifactHash,
             migrations,
             identity,
+            localAuth,
         };
     }
     catch {
@@ -521,8 +594,11 @@ function routeInput(raw, script) {
 }
 function secretNames(o) {
     const names = [...(o.secret ?? []), ...(o.secrets === undefined ? [] : o.secrets.split('\n'))];
+    if (names.includes('PB_AUTH_LOCAL'))
+        return invalid('Remove the secret first: wrangler secret delete PB_AUTH_LOCAL');
     if (new Set(names).size !== names.length ||
-        names.some((n) => !/^[A-Z][A-Z0-9_]{0,127}$/.test(n) || ['PB_TOKEN_PEPPER', 'PB_IDP_PROVIDERS'].includes(n)))
+        names.some((n) => !/^[A-Z][A-Z0-9_]{0,127}$/.test(n) ||
+            ['PB_TOKEN_PEPPER', 'PB_IDP_PROVIDERS', 'PB_AUTH_LOCAL'].includes(n)))
         return invalid();
     return names.sort();
 }
@@ -1242,6 +1318,9 @@ export async function deploy(o, operations = {}) {
     let uploadSent = false;
     let creatingWorker = false;
     try {
+        const cpuMs = o.cpuMs ?? 120000;
+        if (!Number.isSafeInteger(cpuMs) || cpuMs < 1)
+            return invalid();
         if (o.prebuilt)
             await assertPrebuiltConfiguration(resolve(o.project ?? dirname(resolve(o.configPath ?? 'broker.config.ts'))), o.configPath);
         const auth = cloudflareCredentials(o.env);
@@ -1288,6 +1367,7 @@ export async function deploy(o, operations = {}) {
             'DEPLOYMENT_ID',
             'PB_PUBLIC_URL',
             'PB_IDP_PROVIDERS',
+            'PB_AUTH_LOCAL',
             'ASSETS',
             ...(artifact.ports
                 ? [
@@ -1379,6 +1459,24 @@ export async function deploy(o, operations = {}) {
             return conflict('worker:identity');
         const exists = matches.length === 1;
         creatingWorker = !exists;
+        if (!exists) {
+            try {
+                await api.request(`${base}/settings`);
+                if (journal.deployment?.attempt.script_creation !== undefined ||
+                    journal.resources.worker?.name === identity.script_name) {
+                    const error = new CloudflareError('outcome_unknown', 6, false, 'deploy');
+                    inputMessages.set(error, 'The journal owns this Worker creation, but the Worker list is stale; retry deploy after the Worker becomes visible.');
+                    throw error;
+                }
+                return conflict('worker:identity');
+            }
+            catch (error) {
+                if (!(error instanceof CloudflareError) ||
+                    error.status !== 404 ||
+                    error.providerCode !== 10007)
+                    throw error;
+            }
+        }
         if (exists) {
             const tags = matches[0].tags;
             if (!Array.isArray(tags) ||
@@ -1402,6 +1500,23 @@ export async function deploy(o, operations = {}) {
             return conflict('preview_cleanup'); // Re-read the complete configuration on a fresh run after interrupted cleanup.
         }
         const workerSettings = exists ? await ownedWorkerSettings(api, base, journal) : null;
+        const interrupted = journal.deployment?.attempt;
+        if (exists &&
+            !o.dryRun &&
+            interrupted &&
+            [
+                'preparing_upload',
+                'upload_pending',
+                'uploaded',
+                'configuring',
+                'activation_pending',
+            ].includes(interrupted.phase)) {
+            const liveEndpoints = await endpoints(api, base);
+            await enforceEndpoints(api, store, journal, {
+                enabled: liveEndpoints.enabled && restrictivePolicy(interrupted).enabled,
+                previews_enabled: false,
+            });
+        }
         if (workerSettings) {
             for (const raw of workerSettings.bindings.map(object)) {
                 const b = normalizedBinding(raw);
@@ -1426,10 +1541,7 @@ export async function deploy(o, operations = {}) {
         }
         await liveResources(api, journal, artifact.ports);
         let current = exists ? await active(api, base) : { id: null, versions: [] };
-        const recordedVerified = journal.deployment?.attempt.phase === 'verified' &&
-            journal.deployment.attempt.smoke === 'passed'
-            ? journal.deployment.attempt
-            : journal.deployment?.last_verified;
+        const recordedVerified = verifiedDeployment(journal.deployment);
         if (current.versions.length > 1 &&
             journal.deployment?.attempt.phase !== 'activation_pending' &&
             !(recordedVerified && equal(current.versions, distribution(recordedVerified))))
@@ -1475,14 +1587,7 @@ export async function deploy(o, operations = {}) {
         if (installedNames.length && !contract.secretInheritance)
             throw new CloudflareError('capability_unknown');
         const priorAttempt = journal.deployment?.attempt;
-        const resuming = priorAttempt &&
-            [
-                'preparing_upload',
-                'upload_pending',
-                'uploaded',
-                'configuring',
-                'activation_pending',
-            ].includes(priorAttempt.phase);
+        const resuming = priorAttempt && frozenLocalAuthAttempt(priorAttempt, 'deploy') !== undefined;
         if (resuming) {
             if (priorAttempt.artifact_sha256 !== artifact.artifactHash)
                 return conflict('artifact_sha256');
@@ -1494,46 +1599,54 @@ export async function deploy(o, operations = {}) {
         const removeSecret = () => invalid('Remove the secret first: wrangler secret delete PB_IDP_PROVIDERS');
         if (installedNames.includes('PB_IDP_PROVIDERS'))
             return removeSecret();
-        const sources = [];
-        for (const version of current.versions) {
-            const result = prior ?? object((await api.request(`${base}/versions/${version.version_id}`)).result);
-            if (result.id !== version.version_id)
-                return conflict('version_id');
-            const resources = object(result.resources ?? {});
-            if (!Array.isArray(resources.bindings))
-                return conflict('providers');
-            if (resources.bindings
-                .map(object)
-                .some((b) => b.name === 'PB_IDP_PROVIDERS' && b.type === 'secret_text'))
-                return removeSecret();
-            sources.push(resources);
-        }
-        const frozen = resuming ? frozenProviders(priorAttempt) : null;
-        let providersText = frozen;
-        if (o.providers?.kind === 'set' || o.providers?.kind === 'remove') {
-            providersText = desiredProviders(o.providers, artifact.identity, null);
-            if (resuming) {
-                if (providersText !== frozen &&
-                    !(o.providers.kind === 'set' &&
-                        frozen !== null &&
-                        validateProvidersDocument(frozen).value === providersText))
-                    return conflict('settings_sha256');
-                providersText = frozen;
-            }
-        }
-        else if (!resuming) {
-            if (sources.some((r) => r.bindings.map(object).some((b) => b.name === 'PB_IDP_PROVIDERS')))
-                checkManaged();
-            const values = sources.map((r) => desiredProviders(o.providers, artifact.identity, r));
-            if (new Set(values).size > 1)
-                return conflict('providers');
-            providersText = values[0] ?? null;
-        }
+        const sources = exists
+            ? await readLocalAuthSources({
+                api,
+                base,
+                versions: current.versions,
+                settings: workerSettings,
+                prior,
+                stage: 'deploy',
+            })
+            : [];
+        const localAuth = resolveLocalAuth({
+            flag: o.localAuth,
+            verified: recordedVerified,
+            env: o.env.PB_AUTH_LOCAL,
+            sources: exists ? sources : null,
+            secretNames: [...selectedSecrets, ...installedNames],
+            ...(resuming ? { frozen: priorAttempt } : {}),
+        });
+        const liveModes = liveLocalAuthModes(sources, 'deploy');
+        if (liveModes.some((mode) => mode !== localAuth) ||
+            (recordedVerified && localAuth !== (recordedVerified.local_auth ?? 'enabled')))
+            output.checks.push({
+                name: 'local_auth_change',
+                status: 'notice',
+                source: `Local sign-in configuration changes to ${localAuth}.`,
+            });
+        assertLocalAuthAccepted(localAuth, artifact.localAuth);
+        output.checks.push({ name: 'local_auth', status: localAuth });
+        const providersText = await resolveProviderText(artifact.identity, o.providers, sources, resuming ? priorAttempt : undefined, checkManaged);
         const identityHash = identityDigest(artifact.identity, providersText);
+        if (recordedVerified &&
+            !resuming &&
+            identityHash !== (recordedVerified.identity_sha256 ?? null))
+            output.checks.push({
+                name: 'sso_artifact_upgrade',
+                status: 'notice',
+                source: 'The first deploy of a rebuilt artifact after upgrading counts as an SSO configuration change; one partial rollout will be refused. Deploy with --rollout 100 first.',
+            });
         const anchors = effectiveAnchors(artifact.identity, providersText);
         if (o.dryRun)
             output.identity = dryRunIdentity(artifact.identity, providersText, identityHash);
+        const effectiveProviders = artifact.identity === null
+            ? []
+            : providerPlan(artifact.identity, providersText).plan.effective;
+        if (localAuth === 'disabled' && effectiveProviders.length === 0)
+            return invalid('Cannot disable local sign-in without a usable SSO provider');
         const plainBindings = bindings(journal, artifact.ports, url);
+        plainBindings.push({ type: 'plain_text', name: 'PB_AUTH_LOCAL', text: localAuth });
         if (providersText !== null)
             plainBindings.push({ type: 'plain_text', name: 'PB_IDP_PROVIDERS', text: providersText });
         if (endpointEnv) {
@@ -1550,8 +1663,11 @@ export async function deploy(o, operations = {}) {
             ? pending.secret_names
             : [];
         const missingSecrets = [
-            ...new Set(parseRuntimeProviders(providersText ?? undefined)
-                .accepted.filter((p) => p.kind === 'oidc')
+            ...new Set([
+                ...parseRuntimeProviders(providersText ?? undefined).accepted,
+                ...(localAuth === 'disabled' ? effectiveProviders : []),
+            ]
+                .filter((p) => p.kind === 'oidc')
                 .map((p) => providerSecretName(p.id, 'CLIENT_SECRET'))),
         ].filter((name) => !installedNames.includes(name) &&
             !pendingNames.includes(name) &&
@@ -1627,9 +1743,7 @@ export async function deploy(o, operations = {}) {
             ledgerHash,
         }));
         const priorJournal = journal.deployment;
-        const verified = priorAttempt?.phase === 'verified' && priorAttempt.smoke === 'passed'
-            ? priorAttempt
-            : (priorJournal?.last_verified ?? null);
+        const verified = verifiedDeployment(priorJournal);
         const livePlain = workerSettings &&
             workerSettings.bindings
                 .map(object)
@@ -1642,6 +1756,12 @@ export async function deploy(o, operations = {}) {
         if (anchors.length &&
             (await anchorPreflight({ ...auth, ...(o.fetch ? { fetch: o.fetch } : {}) }, journal.resources.d1?.id, anchors, o.dryRun === true)) === 'skipped')
             output.identity?.skipped_checks.push('anchor_preflight');
+        if (rollout < 100 &&
+            !resuming &&
+            (localAuth !== (verified?.local_auth ?? 'enabled') ||
+                sources.some((source) => resolveLocalAuth({ sources: [source] }) !==
+                    localAuth)))
+            return invalid('partial rollout is not allowed when local sign-in configuration changes; deploy with --rollout 100 first');
         if (verified &&
             plainMatch &&
             verified.artifact_sha256 === artifact.artifactHash &&
@@ -1651,6 +1771,7 @@ export async function deploy(o, operations = {}) {
             equal(current.versions, distribution(verified)) &&
             equal(withoutIds(live), withoutIds(intended)) &&
             !updates.some((b) => b.name !== 'PB_MASTER_KEY' && b.name !== 'PB_MASTER_KEY_PREVIOUS')) {
+            await version(api, base, verified.version_id, verified, allNames, plainBindings);
             outputAttempt(output, verified);
             output.plan.push({ stage: 'deploy', action: 'unchanged' });
             output.checks.push({ name: 'endpoint_policy', status: 'verified', ...policy });
@@ -1673,30 +1794,37 @@ export async function deploy(o, operations = {}) {
             if (priorAttempt.settings_sha256 !== settingsHash)
                 return conflict('settings_sha256');
         }
+        if (resuming &&
+            (priorAttempt.version_id ||
+                priorAttempt.phase === 'upload_pending' ||
+                priorAttempt.script_creation)) {
+            let id = priorAttempt.version_id;
+            const creation = priorAttempt.script_creation !== undefined;
+            if (!id) {
+                const versions = await api.list(`${base}/versions`, 'items');
+                const matches = versions.filter((v) => versionAnnotationsMatch(object(v.annotations), priorAttempt, creation));
+                if (matches.length !== 1 || !uuid(matches[0].id))
+                    return unknown();
+                id = matches[0].id;
+            }
+            await version(api, base, id, priorAttempt, allNames, plainBindings, creation);
+        }
         if (!resuming && current.versions.length > 1)
             return conflict('deployment');
         checkManaged();
         function checkManaged() {
             if (resuming)
                 return;
-            let managed = priorAttempt?.intended_settings ?? recordedVerified?.intended_settings;
-            if (priorAttempt?.phase === 'failed' || priorAttempt?.phase === 'rolled_back')
-                managed =
-                    restoredSnapshot(priorAttempt, priorAttempt.phase === 'failed' && equal(current, beforeCandidate(priorAttempt))
-                        ? live
-                        : undefined) ?? conflict('managed_settings');
-            if (live.routes.some((r) => !requestedRoutes.some((x) => x.zone_id === r.zone_id && x.pattern === r.pattern)))
-                return conflict('routes', 'routes:unmanaged_own');
-            // Never take over pre-existing attachments without a previous managed receipt.
-            if ((live.consumer || live.schedules.length || live.routes.length || live.domain) &&
-                (!managed || !matchesManaged(live, managed)))
-                return conflict('managed_settings');
+            checkManagedSettings(priorAttempt, recordedVerified, live, current, requestedRoutes);
         }
         if (priorJournal) {
             const pendingHistory = structuredClone(priorJournal);
             recordDeploymentHistory(pendingHistory, {
                 plainBinding: { name: 'PB_PUBLIC_URL', text: url },
             });
+            recordDeploymentHistory(pendingHistory, {
+                plainBinding: { name: 'PB_AUTH_LOCAL', text: localAuth },
+            });
             recordDeploymentHistory(pendingHistory, {
                 reserveVersion: !resuming || !priorAttempt.version_id,
                 ...(endpointEnv ? { plainBinding: { name: endpointEnv, text: telemetryEndpoint } } : {}),
@@ -1719,6 +1847,7 @@ export async function deploy(o, operations = {}) {
         if (resuming) {
             a = priorAttempt;
             a.identity_sha256 = identityHash;
+            a.local_auth = localAuth;
         }
         else {
             a = {
@@ -1728,6 +1857,7 @@ export async function deploy(o, operations = {}) {
                 settings_sha256: settingsHash,
                 providers_sha256: providersText === null ? null : digest(providersText),
                 identity_sha256: identityHash,
+                local_auth: localAuth,
                 ...(providersText === null ? {} : { providers_text: providersText }),
                 secret_names: allNames,
                 build_info: artifact.info,
@@ -1757,6 +1887,9 @@ export async function deploy(o, operations = {}) {
                 last_verified: verified,
                 ...(priorJournal?.history ? { history: structuredClone(priorJournal.history) } : {}),
             };
+            recordDeploymentHistory(journal.deployment, {
+                plainBinding: { name: 'PB_AUTH_LOCAL', text: localAuth },
+            });
             recordDeploymentHistory(journal.deployment, {
                 ...(priorAttempt?.version_id ? { versionId: priorAttempt.version_id } : {}),
                 ...(endpointEnv ? { plainBinding: { name: endpointEnv, text: telemetryEndpoint } } : {}),
@@ -1764,10 +1897,16 @@ export async function deploy(o, operations = {}) {
             await save(store, journal, now);
         }
         attemptStarted = true;
-        if (endpointEnv && journal.deployment)
+        if (journal.deployment) {
             recordDeploymentHistory(journal.deployment, {
-                plainBinding: { name: endpointEnv, text: telemetryEndpoint },
+                plainBinding: { name: 'PB_AUTH_LOCAL', text: localAuth },
             });
+            if (endpointEnv)
+                recordDeploymentHistory(journal.deployment, {
+                    plainBinding: { name: endpointEnv, text: telemetryEndpoint },
+                });
+            await save(store, journal, now);
+        }
         outputAttempt(output, a);
         if (a.script_creation?.state === 'pending' ||
             (a.script_creation?.state === 'complete' && a.phase === 'preparing_upload')) {
@@ -1800,6 +1939,7 @@ export async function deploy(o, operations = {}) {
                     form.set('metadata', JSON.stringify({
                         ...COMPATIBILITY,
                         main_module: 'worker.js',
+                        limits: { cpu_ms: cpuMs },
                         bindings: [...plainBindings, ...updates],
                         ...(installedNames.length ? { keep_bindings: ['secret_text'] } : {}),
                         assets: { jwt: token, config: ASSET_CONFIG },
@@ -1871,6 +2011,10 @@ export async function deploy(o, operations = {}) {
         if (!a.version_id)
             return unknown();
         await version(api, base, a.version_id, a, allNames, plainBindings);
+        recordDeploymentHistory(journal.deployment, {
+            plainBinding: { name: 'PB_AUTH_LOCAL', text: localAuth },
+        });
+        await save(store, journal, now);
         if (providersText !== null) {
             recordDeploymentHistory(journal.deployment, {
                 plainBinding: { name: 'PB_IDP_PROVIDERS', text: providersText },