alchemy 0.5.1 → 0.6.0

package/src/cloudflare/auth.ts

@@ -1,12 +1,22 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import type { Secret } from "../secret";
+import type { CloudflareAccountId } from "./account-id";
+import { handleApiError } from "./api-error";
 /**
  * Authentication options for Cloudflare API
  */
 export interface CloudflareAuthOptions {
   /**
-   * If true, throw an error when no authentication is found
-   * @default true
+   * API Key to use with API Key
    */
-  required?: boolean;
+  apiKey?: Secret;
+
+  /**
+   * API Token to use with API Key
+   */
+  apiToken?: Secret;
 
   /**
    * Email to use with API Key
@@ -15,126 +25,137 @@ export interface CloudflareAuthOptions {
   email?: string;
 }
 
-/**
- * Authentication headers for Cloudflare API
- */
-export interface CloudflareAuthHeaders {
-  /**
-   * Authentication headers to use with fetch
-   */
-  headers: Record<string, string>;
+export interface CloudflareAccount {
+  name: string;
+  id: CloudflareAccountId;
+  type: "standard" | "zero_rating" | "full_control";
+  settings: {
+    enforce_twofactor: boolean;
+    api_access_enabled: null;
+    access_approval_expiry: null;
+    abuse_contact_email: null;
+  };
+  legacy_flags: {
+    enterprise_zone_quota: {
+      maximum: number;
+      current: number;
+      available: number;
+    };
+  };
+}
 
-  /**
-   * Type of authentication being used
-   */
-  type: "token" | "key" | "none";
+export interface CloudflareUserInfo {
+  apiToken?: Secret;
+  apiKey?: Secret;
+  email: string;
+  username: string;
+  accounts: CloudflareAccount[];
+  organizations: CloudflareOrganization[];
+  tokenPermissions: string[] | undefined;
+  first_name: string | null;
+  last_name: string | null;
+  telephone: string | null;
+  country: string | null;
+  zipcode: string | null;
+  two_factor_authentication_enabled: boolean;
+  two_factor_authentication_locked: boolean;
+  has_pro_zones: boolean;
+  has_business_zones: boolean;
+  has_enterprise_zones: boolean;
+  suspended: boolean;
+  betas: string[];
+}
 
-  /**
-   * User email (only present when using API Key auth)
-   */
-  email?: string;
+export interface CloudflareOrganization {
+  id: string;
+  name: string;
+  status: string;
+  permissions: string[];
+  roles: string[];
 }
 
-/**
- * Response from the Cloudflare User API
- */
-interface CloudflareUserResponse {
-  success: boolean;
-  result: {
-    id: string;
-    email: string;
-    name: string;
-    [key: string]: any;
+const userInfoCache: Record<string, CloudflareUserInfo> = {};
+
+export async function getCloudflareUserInfo(
+  options: CloudflareAuthOptions
+): Promise<CloudflareUserInfo> {
+  const cacheKey = JSON.stringify({
+    apiKey: options.apiKey?.unencrypted,
+    apiToken: options.apiToken?.unencrypted,
+    email: options.email,
+  });
+  if (userInfoCache[cacheKey]) {
+    return userInfoCache[cacheKey];
+  }
+  const headers = await getCloudflareAuthHeaders(options);
+  const user = await fetch("https://api.cloudflare.com/client/v4/user", {
+    headers,
+  });
+  if (!user.ok) {
+    if (user.status === 403) {
+      throw new Error(
+        "Cloudflare authentication required. Did you forget to login with `wrangler login` or set CLOUDFLARE_API_TOKEN, CLOUDFLARE_API_KEY, or CLOUDFLARE_EMAIL, or CLOUDFLARE_API_KEY?"
+      );
+    }
+    await handleApiError(user, "getting", "user", "user");
+  }
+  const accounts = await fetch(
+    "https://api.cloudflare.com/client/v4/accounts",
+    {
+      headers,
+    }
+  );
+  const userInfo: CloudflareUserInfo = {
+    ...((await user.json()) as any).result,
+    accounts: ((await accounts.json()) as any).result,
   };
+  userInfoCache[cacheKey] = userInfo;
+  return userInfo;
 }
 
-/**
- * Get authentication headers for Cloudflare API
- *
- * Priority:
- * 1. API Token (CLOUDFLARE_API_TOKEN) - Recommended by Cloudflare
- * 2. API Key (CLOUDFLARE_API_KEY) - Will attempt to discover email automatically
- *
- * @param options Authentication options
- * @returns Authentication headers
- */
-export async function getCloudflareAuth(
-  options: CloudflareAuthOptions = {},
-): Promise<CloudflareAuthHeaders> {
-  const { required = true } = options;
-
+export async function getCloudflareAuthHeaders(
+  options: CloudflareAuthOptions = {}
+): Promise<Record<string, string>> {
   // Check for API Token (preferred method)
-  const apiToken = process.env.CLOUDFLARE_API_TOKEN;
+  const apiToken =
+    options.apiToken?.unencrypted ?? process.env.CLOUDFLARE_API_TOKEN;
   if (apiToken) {
     return {
-      headers: {
-        Authorization: `Bearer ${apiToken}`,
-      },
-      type: "token",
+      Authorization: `Bearer ${apiToken}`,
     };
   }
 
   // Check for API Key
-  const apiKey = process.env.CLOUDFLARE_API_KEY;
+  const apiKey = options.apiKey?.unencrypted ?? process.env.CLOUDFLARE_API_KEY;
   if (apiKey) {
-    // If email is provided directly, use it
-    const providedEmail = options.email || process.env.CLOUDFLARE_EMAIL;
-    if (providedEmail) {
-      return {
-        headers: {
-          "X-Auth-Key": apiKey,
-          "X-Auth-Email": providedEmail,
-        },
-        type: "key",
-        email: providedEmail,
-      };
-    }
-
-    // Otherwise, try to discover email from Cloudflare API
-    try {
-      const email = await getUserEmailFromApiKey(apiKey);
-      return {
-        headers: {
-          "X-Auth-Key": apiKey,
-          "X-Auth-Email": email,
-        },
-        type: "key",
-        email,
-      };
-    } catch (error) {
-      console.error("Failed to discover email from API key:", error);
-      throw new Error(
-        "Failed to automatically discover email for API Key authentication.\n" +
-          "Options:\n" +
-          "1. Set CLOUDFLARE_EMAIL environment variable\n" +
-          "2. Use CLOUDFLARE_API_TOKEN instead (recommended by Cloudflare)",
-      );
-    }
+    return {
+      "X-Auth-Key": apiKey,
+      "X-Auth-Email":
+        options.email ??
+        process.env.CLOUDFLARE_EMAIL ??
+        (await getUserEmailFromApiKey(apiKey)),
+    };
   }
 
-  // No authentication found
-  if (required) {
-    throw new Error(
-      "Cloudflare authentication required. Set either:\n" +
-        "1. CLOUDFLARE_API_TOKEN (recommended by Cloudflare)\n" +
-        "   Generate a token at: https://dash.cloudflare.com/profile/api-tokens\n" +
-        "2. CLOUDFLARE_API_KEY environment variable",
-    );
+  const authConfig = await getRefreshedAuthConfig();
+  if (authConfig.oauth_token) {
+    return {
+      Authorization: `Bearer ${authConfig.oauth_token}`,
+    };
   }
 
-  return {
-    headers: {},
-    type: "none",
-  };
+  throw new Error(
+    "Cloudflare authentication required. Did you forget to login with `wrangler login` or set CLOUDFLARE_API_TOKEN, CLOUDFLARE_API_KEY, or CLOUDFLARE_EMAIL, or CLOUDFLARE_API_KEY?"
+  );
 }
 
-/**
- * Fetch the user's email from Cloudflare API using API Key
- *
- * @param apiKey The Cloudflare API key
- * @returns The user's email
- */
+const emailCache: Record<string, string> = {};
+
 async function getUserEmailFromApiKey(apiKey: string): Promise<string> {
+  if (emailCache[apiKey]) {
+    return emailCache[apiKey];
+  }
+
   try {
     const baseUrl = "https://api.cloudflare.com/client/v4";
 
@@ -148,40 +169,162 @@ async function getUserEmailFromApiKey(apiKey: string): Promise<string> {
 
     if (!response.ok) {
       throw new Error(
-        `Failed to get user information: ${response.status} ${response.statusText}`,
+        `Failed to get user information: ${response.status} ${response.statusText}`
       );
     }
 
-    const data = (await response.json()) as CloudflareUserResponse;
+    const data = (await response.json()) as {
+      success: boolean;
+      result: {
+        id: string;
+        email: string;
+        name: string;
+        [key: string]: any;
+      };
+    };
 
     if (!data.success || !data.result || !data.result.email) {
       throw new Error("Cloudflare API did not return valid user information");
     }
 
+    emailCache[apiKey] = data.result.email;
     return data.result.email;
   } catch (error) {
     console.error("Error retrieving email from Cloudflare API:", error);
     throw new Error(
-      "Failed to automatically discover email for API Key authentication",
+      "Failed to automatically discover email for API Key authentication"
     );
   }
 }
 
-/**
- * Get headers for a Cloudflare API request, including content-type
- *
- * @param contentType Content type for the request
- * @param options Authentication options
- * @returns Complete headers for the request
- */
-export async function getCloudflareHeaders(
-  contentType = "application/json",
-  options: CloudflareAuthOptions = {},
-): Promise<Record<string, string>> {
-  const auth = await getCloudflareAuth(options);
+async function refreshAuthToken(
+  options: WranglerConfig
+): Promise<WranglerConfig> {
+  const response = await fetch("https://dash.cloudflare.com/oauth2/token", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+    },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: options.refresh_token!,
+      client_id: "54d11594-84e4-41aa-b438-e81b8fa78ee7",
+    }).toString(),
+  });
+
+  if (!response.ok) {
+    throw new Error(
+      `Failed to refresh auth token: ${response.status} ${response.statusText}`
+    );
+  }
+
+  const data: any = await response.json();
+  if (!data.access_token) {
+    throw new Error("Failed to refresh auth token - no access token returned");
+  }
+
+  options.oauth_token = data.access_token;
+  options.refresh_token = data.refresh_token;
+  options.expiration_time = new Date(
+    Date.now() + data.expires_in * 1000
+  ).toISOString();
+  options.scopes = data.scope?.split(" ") || [];
+
+  return options;
+}
+
+interface WranglerConfig {
+  path: string;
+  oauth_token?: string;
+  refresh_token?: string;
+  expiration_time?: string;
+  scopes?: string[];
+  /** @deprecated - this field was only provided by the deprecated v1 `wrangler config` command. */
+  api_token?: string;
+}
 
-  return {
-    "Content-Type": contentType,
-    ...auth.headers,
+async function getRefreshedAuthConfig(): Promise<WranglerConfig> {
+  let authConfig = await readWranglerConfig();
+  if (authConfig.expiration_time) {
+    const expiry = new Date(authConfig.expiration_time);
+    // if expiring in 10s
+    if (expiry.getTime() < Date.now() + 10 * 1000) {
+      authConfig = await refreshAuthToken(authConfig);
+      authConfigCache[authConfig.path] = authConfig;
+      await writeWranglerConfig(authConfig);
+    }
+  }
+  return authConfig;
+}
+
+async function writeWranglerConfig(config: WranglerConfig) {
+  const TOML = await import("@iarna/toml");
+  const configPath = await findWranglerConfig();
+  config = {
+    ...config,
   };
+  // @ts-ignore - i put this here
+  delete config.path;
+  const toml = TOML.stringify(config as any);
+  await fs.writeFile(configPath, toml);
+}
+
+// cache the file once per process
+const authConfigCache: Record<string, WranglerConfig> = {};
+
+async function readWranglerConfig(): Promise<WranglerConfig> {
+  const configPath = await findWranglerConfig();
+  const config = (authConfigCache[configPath] ??= await parseTOML(
+    await fs.readFile(configPath, "utf-8")
+  ));
+  config.path = configPath;
+  return config;
+}
+
+let wranglerConfigPath: string | undefined;
+
+async function findWranglerConfig(): Promise<string> {
+  if (wranglerConfigPath) {
+    return wranglerConfigPath;
+  }
+  const environment = process.env.WRANGLER_API_ENVIRONMENT ?? "production";
+  const filePath = path.join(
+    "config",
+    `${environment === "production" ? "default.toml" : `${environment}.toml`}`
+  );
+
+  const xdgAppPaths = (await import("xdg-app-paths")).default;
+  //TODO: We should implement a custom path --global-config and/or the WRANGLER_HOME type environment variable
+  const configDir = xdgAppPaths(".wrangler").config(); // New XDG compliant config path
+  const legacyConfigDir = path.join(os.homedir(), ".wrangler"); // Legacy config in user's home directory
+
+  // Check for the .wrangler directory in root if it is not there then use the XDG compliant path.
+  wranglerConfigPath = path.join(
+    (await isDirectory(legacyConfigDir)) ? legacyConfigDir : configDir,
+    filePath
+  );
+  return wranglerConfigPath;
+}
+
+async function parseTOML(input: string): Promise<any> {
+  const TOML = await import("@iarna/toml");
+  try {
+    // Normalize CRLF to LF to avoid hitting https://github.com/iarna/iarna-toml/issues/33.
+    const normalizedInput = input.replace(/\r\n/g, "\n");
+    return TOML.parse(normalizedInput);
+  } catch (err: any) {
+    const { name } = err;
+    if (name !== "TomlError") {
+      throw err;
+    }
+    throw new Error("TOML parse error");
+  }
+}
+
+async function isDirectory(dir: string) {
+  try {
+    return (await fs.stat(dir)).isDirectory();
+  } catch (err) {
+    return false;
+  }
 }

package/src/cloudflare/bucket.ts

@@ -1,19 +1,14 @@
 import { AwsClient } from "aws4fetch";
 import type { Context } from "../context";
 import { Resource } from "../resource";
-import {
-  CloudflareAccountId,
-  CloudflareApi,
-  CloudflareApiError,
-  createCloudflareApi,
-  handleApiError,
-  type CloudflareApiOptions,
-} from "./api";
+import type { Secret } from "../secret";
+import { CloudflareApi, createCloudflareApi } from "./api";
+import { CloudflareApiError, handleApiError } from "./api-error";
 
 /**
  * Properties for creating or updating an R2 Bucket
  */
-export interface BucketProps extends CloudflareApiOptions {
+export interface BucketProps {
   /**
    * Name of the bucket
    * Names can only contain lowercase letters (a-z), numbers (0-9), and hyphens (-)
@@ -52,6 +47,36 @@ export interface BucketProps extends CloudflareApiOptions {
    * @default false
    */
   empty?: boolean;
+
+  /**
+   * API Token to use for the bucket
+   */
+  apiToken?: Secret;
+
+  /**
+   * API Key to use for the bucket
+   */
+  apiKey?: Secret;
+
+  /**
+   * Email to use for the bucket
+   */
+  email?: string;
+
+  /**
+   * Account ID to use for the bucket
+   */
+  accountId?: string;
+
+  /**
+   * Access Key to use for the bucket
+   */
+  accessKey?: Secret;
+
+  /**
+   * Secret Access Key to use for the bucket
+   */
+  secretAccessKey?: Secret;
 }
 
 /**
@@ -135,7 +160,10 @@ export const R2Bucket = Resource(
       if (props.delete !== false) {
         if (props.empty) {
           console.log("Emptying R2 bucket:", bucketName);
-          const r2Client = await createR2Client(props);
+          const r2Client = await createR2Client({
+            ...props,
+            accountId: api.accountId,
+          });
           // Empty the bucket first by deleting all objects
           await emptyBucket(r2Client, bucketName, props.jurisdiction);
         }
@@ -166,6 +194,7 @@ export const R2Bucket = Resource(
         creationDate: new Date(),
         jurisdiction: props.jurisdiction || "default",
         type: "r2_bucket",
+        accountId: api.accountId,
       });
     }
   }
@@ -175,9 +204,9 @@ export const R2Bucket = Resource(
  * Configuration for R2 client to connect to Cloudflare R2
  */
 export interface R2ClientConfig {
-  accountId?: string;
-  accessKeyId?: string;
-  secretAccessKey?: string;
+  accountId: string;
+  accessKeyId?: Secret;
+  secretAccessKey?: Secret;
   jurisdiction?: string;
 }
 
@@ -188,13 +217,12 @@ type R2Client = AwsClient & { accountId: string };
  *
  * @see https://developers.cloudflare.com/r2/examples/aws/aws-sdk-js-v3/
  */
-export async function createR2Client(
-  config: R2ClientConfig = {}
-): Promise<R2Client> {
-  const accountId = await CloudflareAccountId(config);
-  const accessKeyId = config.accessKeyId || process.env.R2_ACCESS_KEY_ID;
+export function createR2Client(config?: R2ClientConfig): Promise<R2Client> {
+  const accountId = config?.accountId ?? process.env.CLOUDFLARE_ACCOUNT_ID;
+  const accessKeyId =
+    config?.accessKeyId?.unencrypted || process.env.R2_ACCESS_KEY_ID;
   const secretAccessKey =
-    config.secretAccessKey || process.env.R2_SECRET_ACCESS_KEY;
+    config?.secretAccessKey?.unencrypted || process.env.R2_SECRET_ACCESS_KEY;
 
   if (!accountId) {
     throw new Error("CLOUDFLARE_ACCOUNT_ID environment variable is required");
@@ -282,12 +310,11 @@ export async function createBucket(
   );
 
   if (!createResponse.ok) {
-    const errorData: any = await createResponse.json().catch(() => ({
-      errors: [{ message: createResponse.statusText }],
-    }));
-    throw new CloudflareApiError(
-      `Error creating R2 bucket '${bucketName}': ${errorData.errors?.[0]?.message || createResponse.statusText}`,
-      createResponse
+    return await handleApiError(
+      createResponse,
+      "creating",
+      "R2 bucket",
+      bucketName
     );
   }
 
@@ -469,10 +496,6 @@ export async function updatePublicAccess(
   allowPublicAccess: boolean,
   jurisdiction?: string
 ): Promise<void> {
-  console.log(
-    `/accounts/${api.accountId}/r2/buckets/${bucketName}/domains/managed`
-  );
-
   const headers = withJurisdiction({}, jurisdiction);
 
   const response = await api.put(

package/src/cloudflare/custom-domain.ts

@@ -1,11 +1,16 @@
 import type { Context } from "../context";
 import { Resource } from "../resource";
-import { CloudflareApi, createCloudflareApi, handleApiError } from "./api";
+import {
+  CloudflareApi,
+  createCloudflareApi,
+  type CloudflareApiOptions,
+} from "./api";
+import { handleApiError } from "./api-error";
 
 /**
  * Properties for creating or updating a CustomDomain
  */
-export interface CustomDomainProps {
+export interface CustomDomainProps extends CloudflareApiOptions {
   /**
    * The domain name to bind to the worker
    */
@@ -89,7 +94,7 @@ export const CustomDomain = Resource(
     props: CustomDomainProps
   ): Promise<CustomDomain> {
     // Create Cloudflare API client with automatic account discovery
-    const api = await createCloudflareApi();
+    const api = await createCloudflareApi(props);
 
     // Validate required properties
     if (!props.name) {

package/src/cloudflare/dns-records.ts

@@ -5,7 +5,11 @@ import type {
   DnsRecordWithMetadata,
 } from "../dns/record";
 import { Resource } from "../resource";
-import { type CloudflareApi, createCloudflareApi } from "./api";
+import {
+  type CloudflareApi,
+  type CloudflareApiOptions,
+  createCloudflareApi,
+} from "./api";
 import type { CloudflareResponse } from "./response";
 
 /**
@@ -48,7 +52,7 @@ export interface DnsRecord extends DnsRecordWithMetadata {}
 /**
  * Properties for managing multiple DNS records
  */
-export interface DnsRecordsProps {
+export interface DnsRecordsProps extends CloudflareApiOptions {
   /**
    * Zone ID or domain name where records will be created
    */
@@ -127,7 +131,7 @@ export const DnsRecords = Resource(
     props: DnsRecordsProps
   ): Promise<DnsRecords> {
     // Create Cloudflare API client
-    const api = await createCloudflareApi();
+    const api = await createCloudflareApi(props);
 
     // Get zone ID if domain name was provided
     const zoneId = props.zoneId;