alchemy 0.46.0 → 0.47.0

package/src/cloudflare/api.ts

@@ -1,12 +1,12 @@
-import { alchemy } from "../alchemy.ts";
 import type { Secret } from "../secret.ts";
 import { withExponentialBackoff } from "../util/retry.ts";
 import { safeFetch } from "../util/safe-fetch.ts";
 import {
   getCloudflareAuthHeaders,
+  normalizeAuthOptions,
   type CloudflareAuthOptions,
 } from "./auth.ts";
-import { getCloudflareAccounts, getUserEmailFromApiKey } from "./user.ts";
+import { getCloudflareAccountId } from "./user.ts";
 
 /**
  * Options for Cloudflare API requests
@@ -42,6 +42,12 @@ export interface CloudflareApiOptions {
   email?: string;
 }
 
+/** Used to propagate normalized auth options from a parent resource to `createCloudflareApi` in a child resource */
+export type InternalCloudflareApiOptions = CloudflareAuthOptions & {
+  baseUrl?: string;
+  accountId: string;
+};
+
 /**
  * Creates a CloudflareApi instance with automatic account ID discovery if not provided
  *
@@ -49,44 +55,18 @@ export interface CloudflareApiOptions {
  * @returns Promise resolving to a CloudflareApi instance
  */
 export async function createCloudflareApi(
-  options: Partial<CloudflareApiOptions> = {},
+  options: Partial<CloudflareApiOptions> | InternalCloudflareApiOptions = {},
 ): Promise<CloudflareApi> {
-  const apiKey =
-    options.apiKey ??
-    (process.env.CLOUDFLARE_API_KEY
-      ? alchemy.secret(process.env.CLOUDFLARE_API_KEY)
-      : undefined);
-  const apiToken =
-    options.apiToken ??
-    (process.env.CLOUDFLARE_API_TOKEN
-      ? alchemy.secret(process.env.CLOUDFLARE_API_TOKEN)
-      : undefined);
-  let email = options.email ?? process.env.CLOUDFLARE_EMAIL;
-  if (apiKey && !email) {
-    email = await getUserEmailFromApiKey(apiKey.unencrypted);
-  }
+  const authOptions = await normalizeAuthOptions(options);
   const accountId =
     options.accountId ??
     process.env.CLOUDFLARE_ACCOUNT_ID ??
     process.env.CF_ACCOUNT_ID ??
-    (
-      await getCloudflareAccounts({
-        apiKey,
-        apiToken,
-        email,
-      } as CloudflareAuthOptions)
-    )[0]?.id;
-  if (accountId === undefined) {
-    throw new Error(
-      "Either accountId or CLOUDFLARE_ACCOUNT_ID must be provided",
-    );
-  }
+    (await getCloudflareAccountId(authOptions));
   return new CloudflareApi({
     baseUrl: options.baseUrl,
     accountId,
-    email,
-    apiKey,
-    apiToken,
+    authOptions,
   });
 }
 
@@ -96,9 +76,6 @@ export async function createCloudflareApi(
 export class CloudflareApi {
   public readonly accountId: string;
   public readonly baseUrl: string;
-  public readonly apiKey: Secret | undefined;
-  public readonly apiToken: Secret | undefined;
-  public readonly email: string | undefined;
   public readonly authOptions: CloudflareAuthOptions;
 
   /**
@@ -108,30 +85,14 @@ export class CloudflareApi {
    *
    * @param options API options
    */
-  constructor(
-    options: CloudflareApiOptions & {
-      accountId: string;
-    },
-  ) {
+  constructor(options: {
+    baseUrl?: string;
+    accountId: string;
+    authOptions: CloudflareAuthOptions;
+  }) {
     this.accountId = options.accountId;
     this.baseUrl = options.baseUrl ?? "https://api.cloudflare.com/client/v4";
-    this.apiKey = options.apiKey;
-    this.apiToken = options.apiToken;
-    this.email = options.email;
-
-    if (this.apiKey && this.apiToken) {
-      throw new Error("'apiKey' and 'apiToken' cannot both be provided");
-    } else if (this.apiKey && !this.email) {
-      throw new Error("'email' must be provided if 'apiKey' is provided");
-    }
-    this.authOptions = this.apiKey
-      ? {
-          apiKey: this.apiKey,
-          email: this.email!,
-        }
-      : {
-          apiToken: this.apiToken,
-        };
+    this.authOptions = options.authOptions;
   }
 
   /**

package/src/cloudflare/auth.ts

@@ -1,85 +1,101 @@
+import { alchemy } from "../alchemy.ts";
 import type { Secret } from "../secret.ts";
-import { getRefreshedWranglerConfig } from "./auth-wrangler.ts";
-/**
- * Authentication options for Cloudflare API
- */
-export type CloudflareAuthOptions =
-  | CloudflareApiKeyAuthOptions
-  | CloudflareApiTokenAuthOptions;
-
-export type CloudflareApiKeyAuthOptions = {
-  /**
-   * API Key to use with API Key
-   */
-  apiKey: Secret;
-  /**
-   * Email to use with API Key
-   * If not provided, will attempt to discover from Cloudflare API
-   */
-  email: string;
+import type { CloudflareApiOptions } from "./api.ts";
+import { getRefreshedWranglerConfig } from "./oauth.ts";
+import { getUserEmailFromApiKey } from "./user.ts";
 
-  /**
-   * API Token to use with API Key
-   */
-  apiToken?: undefined;
-};
+export interface CloudflareApiTokenAuthOptions {
+  type: "api-token";
+  apiToken: Secret<string>;
+}
 
-export function isCloudflareApiKeyAuthOptions(
-  options: CloudflareAuthOptions | undefined,
-): options is CloudflareApiKeyAuthOptions {
-  return options !== undefined && options.apiKey !== undefined;
+export interface CloudflareApiKeyAuthOptions {
+  type: "api-key";
+  apiKey: Secret;
+  apiEmail: string;
 }
 
-export type CloudflareApiTokenAuthOptions = {
-  /**
-   * API Token to use with API Key
-   */
-  apiToken?: Secret;
+export interface CloudflareWranglerAuthOptions {
+  type: "wrangler";
+}
 
-  /**
-   * API Key to use with API Token
-   */
-  apiKey?: undefined;
+export type CloudflareAuthOptions =
+  | CloudflareApiTokenAuthOptions
+  | CloudflareApiKeyAuthOptions
+  | CloudflareWranglerAuthOptions;
 
-  /**
-   * Email to use with API Token
-   */
-  email?: undefined;
+export const isCloudflareAuthOptions = (
+  input?: CloudflareApiOptions | CloudflareAuthOptions,
+): input is CloudflareAuthOptions => {
+  return (
+    input !== undefined &&
+    "type" in input &&
+    (input.type === "api-token" ||
+      input.type === "api-key" ||
+      input.type === "wrangler")
+  );
 };
 
-export function isCloudflareApiTokenAuthOptions(
-  options: CloudflareAuthOptions | undefined,
-): options is CloudflareApiTokenAuthOptions {
-  return options !== undefined && options.apiToken !== undefined;
-}
+export async function normalizeAuthOptions(
+  input?: CloudflareApiOptions | CloudflareAuthOptions,
+): Promise<CloudflareAuthOptions> {
+  if (isCloudflareAuthOptions(input)) {
+    return input;
+  }
 
-export async function getCloudflareAuthHeaders(
-  options: CloudflareAuthOptions | undefined,
-): Promise<Record<string, string>> {
-  if (isCloudflareApiKeyAuthOptions(options)) {
-    // Global API Key
-    return {
-      "X-Auth-Key": options.apiKey.unencrypted,
-      "X-Auth-Email": options.email,
-    };
-  } else if (isCloudflareApiTokenAuthOptions(options)) {
-    // API Token
+  const email = async (apiKey: Secret<string>) =>
+    input?.email ??
+    process.env.CLOUDFLARE_EMAIL ??
+    (await getUserEmailFromApiKey(apiKey.unencrypted));
+
+  if (input?.apiKey) {
     return {
-      Authorization: `Bearer ${options.apiToken?.unencrypted}`,
+      type: "api-key",
+      apiKey: input.apiKey,
+      apiEmail: await email(input.apiKey),
     };
   }
-  // Wrangler OAuth Token
-  const wranglerConfig = await getRefreshedWranglerConfig();
-  if (wranglerConfig.isOk() && wranglerConfig.value) {
+  if (input?.apiToken) {
+    return { type: "api-token", apiToken: input.apiToken };
+  }
+  if (process.env.CLOUDFLARE_API_KEY) {
+    const key = alchemy.secret(process.env.CLOUDFLARE_API_KEY);
+    return { type: "api-key", apiKey: key, apiEmail: await email(key) };
+  }
+  if (process.env.CLOUDFLARE_API_TOKEN) {
     return {
-      Authorization: `Bearer ${wranglerConfig.value.oauth_token}`,
+      type: "api-token",
+      apiToken: alchemy.secret(process.env.CLOUDFLARE_API_TOKEN),
     };
-  } else if (wranglerConfig.isErr()) {
-    throw new Error(
-      `Cloudflare authentication failed: ${wranglerConfig.error.message}`,
-    );
   }
-  throw new Error(
-    "Cloudflare authentication required. Did you forget to login with `wrangler login` or set CLOUDFLARE_API_TOKEN, CLOUDFLARE_API_KEY?",
-  );
+  return { type: "wrangler" };
+}
+
+export async function getCloudflareAuthHeaders(
+  authOptions: CloudflareAuthOptions,
+): Promise<Record<string, string>> {
+  switch (authOptions.type) {
+    case "api-token":
+      return { Authorization: `Bearer ${authOptions.apiToken.unencrypted}` };
+    case "api-key":
+      return {
+        "X-Auth-Key": authOptions.apiKey.unencrypted,
+        "X-Auth-Email": authOptions.apiEmail,
+      };
+    case "wrangler": {
+      const wranglerConfig = await getRefreshedWranglerConfig();
+      if (wranglerConfig.isErr()) {
+        throw new Error(
+          [
+            wranglerConfig.error.message,
+            "Please run `alchemy login`, or set either CLOUDFLARE_API_TOKEN or CLOUDFLARE_API_KEY in your environment.",
+            "Learn more: https://alchemy.run/guides/cloudflare/",
+          ].join("\n"),
+        );
+      }
+      return {
+        Authorization: `Bearer ${wranglerConfig.value.oauth_token}`,
+      };
+    }
+  }
 }