alchemy 0.67.0 → 0.69.0

package/src/cloudflare/auth.ts

@@ -1,101 +1,166 @@
-import { alchemy } from "../alchemy.ts";
-import type { Secret } from "../secret.ts";
-import type { CloudflareApiOptions } from "./api.ts";
-import { getRefreshedWranglerConfig } from "./oauth.ts";
-import { getUserEmailFromApiKey } from "./user.ts";
+import assert from "node:assert";
+import { Credentials } from "../auth.ts";
+import { OAuthClient } from "../util/oauth-client.ts";
 
-export interface CloudflareApiTokenAuthOptions {
-  type: "api-token";
-  apiToken: Secret<string>;
-}
-
-export interface CloudflareApiKeyAuthOptions {
-  type: "api-key";
-  apiKey: Secret;
-  apiEmail: string;
-}
-
-export interface CloudflareWranglerAuthOptions {
-  type: "wrangler";
-}
+export namespace CloudflareAuth {
+  export const client = new OAuthClient({
+    clientId: "6d8c2255-0773-45f6-b376-2914632e6f91",
+    redirectUri: "http://localhost:9976/auth/callback",
+    endpoints: {
+      authorize: "https://dash.cloudflare.com/oauth2/authorize",
+      token: "https://dash.cloudflare.com/oauth2/token",
+      revoke: "https://dash.cloudflare.com/oauth2/revoke",
+    },
+  });
 
-export type CloudflareAuthOptions =
-  | CloudflareApiTokenAuthOptions
-  | CloudflareApiKeyAuthOptions
-  | CloudflareWranglerAuthOptions;
+  export type Metadata = {
+    id: string;
+    name: string;
+  };
+  export const ALL_SCOPES = {
+    // TODO: Verify descriptions marked with `//*`
+    "access:read": "Read Cloudflare Access", //*
+    "access:write": "Write Cloudflare Access", //*
+    "account:read":
+      "See your account info such as account details, analytics, and memberships.",
+    "agw:read": "Read API Gateway", //*
+    "agw:run": "Run API Gateway", //*
+    "ai:read": "Read access to Workers AI catalog and assets",
+    "ai:write": "See and change Workers AI catalog and assets",
+    "aiaudit:read": "Read AI Audit", //*
+    "aiaudit:write": "Write AI Audit", //*
+    "aig:read": "Read AI Gateway", //*
+    "aig:write": "Write AI Gateway", //*
+    "auditlogs:read": "Read audit logs", //*
+    "browser:read": "Read Browser", //*
+    "browser:write": "Write Browser", //*
+    "cfone:read": "Read Cloudflare One", //*
+    "cfone:write": "Write Cloudflare One", //*
+    "cloudchamber:write": "Manage Cloudchamber",
+    "constellation:write": "Write Constellation", //*
+    "containers:write": "Manage Workers Containers",
+    "d1:write": "See and change D1 Databases.",
+    "dex:read": "Read DEX", //*
+    "dex:write": "Write DEX", //*
+    "dns_analytics:read": "Read DNS analytics",
+    "dns_records:edit": "Edit DNS records",
+    "dns_records:read": "Read DNS records",
+    "dns_settings:read": "Read DNS settings",
+    "firstpartytags:write": "Write First Party Tags", //*
+    "lb:edit": "Edit Load Balancer", //*
+    "lb:read": "Read Load Balancer", //*
+    "logpush:read": "Read Logpush", //*
+    "logpush:write": "Write Logpush", //*
+    "notification:read": "Read Notifications", //*
+    "notification:write": "Write Notifications", //*
+    "pages:read": "Read access to Pages projects, settings, and deployments.",
+    "pages:write": "See and change Pages projects, settings, and deployments.",
+    "pipelines:read": "Read access to Pipelines configurations and data",
+    "pipelines:setup": "Setup access to Pipelines configurations and data",
+    "pipelines:write": "See and change Pipelines configurations and data",
+    "query_cache:write": "Write Query Cache", //*
+    "queues:write": "See and change Queues settings and data",
+    "r2_catalog:write": "Write R2 Catalog", //*
+    "radar:read": "Read Radar", //*
+    "rag:read": "Read RAG", //*
+    "rag:write": "Write RAG", //*
+    "secrets_store:read":
+      "Read access to secrets + stores within the Secrets Store",
+    "secrets_store:write":
+      "See and change secrets + stores within the Secrets Store",
+    "sso-connector:read": "Read SSO Connector", //*
+    "sso-connector:write": "Write SSO Connector", //*
+    "ssl_certs:write": "See and manage mTLS certificates for your account",
+    "teams:pii": "Read Teams PII", //*
+    "teams:read": "Read Teams", //*
+    "teams:secure_location": "Read Secure Location", //*
+    "teams:write": "Write Teams", //*
+    "url_scanner:read": "Read URL Scanner", //*
+    "url_scanner:write": "Write URL Scanner", //*
+    "user:read":
+      "See your user info such as name, email address, and account memberships.",
+    "vectorize:write": "Write Vectorize", //*
+    "workers:write":
+      "See and change Cloudflare Workers data such as zones, KV storage, namespaces, scripts, and routes.",
+    "workers_builds:read": "Read Workers Builds", //*
+    "workers_builds:write": "Write Workers Builds", //*
+    "workers_kv:write":
+      "See and change Cloudflare Workers KV Storage data such as keys and namespaces.",
+    "workers_observability:read": "Read Workers Observability", //*
+    "workers_observability:write": "Write Workers Observability", //*
+    "workers_observability_telemetry:write":
+      "Write Workers Observability Telemetry", //*
+    "workers_routes:write":
+      "See and change Cloudflare Workers data such as filters and routes.",
+    "workers_scripts:write":
+      "See and change Cloudflare Workers scripts, durable objects, subdomains, triggers, and tail data.",
+    "workers_tail:read": "See Cloudflare Workers tail and script data.",
+    "zone:read": "Grants read level access to account zone.",
+    // Not granted yet
+    // "connectivity:admin":
+    //   "See, change, and bind to Connectivity Directory services, including creating services targeting Cloudflare Tunnel.",
+  };
+  export const DEFAULT_SCOPES = [
+    "account:read",
+    "user:read",
+    "workers:write",
+    "workers_kv:write",
+    "workers_routes:write",
+    "workers_scripts:write",
+    "workers_tail:read",
+    "d1:write",
+    "pages:write",
+    "zone:read",
+    "ssl_certs:write",
+    "ai:write",
+    "queues:write",
+    "pipelines:write",
+    "secrets_store:write",
+    "containers:write",
+    "cloudchamber:write",
+  ];
 
-export const isCloudflareAuthOptions = (
-  input?: CloudflareApiOptions | CloudflareAuthOptions,
-): input is CloudflareAuthOptions => {
-  return (
-    input !== undefined &&
-    "type" in input &&
-    (input.type === "api-token" ||
-      input.type === "api-key" ||
-      input.type === "wrangler")
-  );
-};
-
-export async function normalizeAuthOptions(
-  input?: CloudflareApiOptions | CloudflareAuthOptions,
-): Promise<CloudflareAuthOptions> {
-  if (isCloudflareAuthOptions(input)) {
-    return input;
-  }
-
-  const email = async (apiKey: Secret<string>) =>
-    input?.email ??
-    process.env.CLOUDFLARE_EMAIL ??
-    (await getUserEmailFromApiKey(apiKey.unencrypted));
-
-  if (input?.apiKey) {
-    return {
-      type: "api-key",
-      apiKey: input.apiKey,
-      apiEmail: await email(input.apiKey),
-    };
-  }
-  if (input?.apiToken) {
-    return { type: "api-token", apiToken: input.apiToken };
-  }
-  if (process.env.CLOUDFLARE_API_KEY) {
-    const key = alchemy.secret(process.env.CLOUDFLARE_API_KEY);
-    return { type: "api-key", apiKey: key, apiEmail: await email(key) };
-  }
-  if (process.env.CLOUDFLARE_API_TOKEN) {
-    return {
-      type: "api-token",
-      apiToken: alchemy.secret(process.env.CLOUDFLARE_API_TOKEN),
-    };
-  }
-  return { type: "wrangler" };
-}
+  /**
+   * Format Cloudflare credentials as headers, refreshing OAuth credentials if expired.
+   * If the credentials are OAuth, the `profile` is required so we can read and write the updated credentials.
+   */
+  export const formatHeadersWithRefresh = async (input: {
+    profile: string | undefined;
+    credentials: Credentials;
+  }) => {
+    // if the credentials are not expired, return them as is
+    if (!Credentials.isOAuthExpired(input.credentials)) {
+      return formatHeaders(input.credentials);
+    }
+    assert(input.profile, "Profile is required for OAuth credentials");
+    const credentials = await Credentials.getRefreshed(
+      {
+        provider: "cloudflare",
+        profile: input.profile,
+      },
+      async (credentials) => {
+        return await client.refresh(credentials);
+      },
+    );
+    return formatHeaders(credentials);
+  };
 
-export async function getCloudflareAuthHeaders(
-  authOptions: CloudflareAuthOptions,
-): Promise<Record<string, string>> {
-  switch (authOptions.type) {
-    case "api-token":
-      return { Authorization: `Bearer ${authOptions.apiToken.unencrypted}` };
-    case "api-key":
-      return {
-        "X-Auth-Key": authOptions.apiKey.unencrypted,
-        "X-Auth-Email": authOptions.apiEmail,
-      };
-    case "wrangler": {
-      const wranglerConfig = await getRefreshedWranglerConfig();
-      if (wranglerConfig.isErr()) {
-        throw new Error(
-          [
-            wranglerConfig.error.message,
-            "Please run `alchemy login`, or set either CLOUDFLARE_API_TOKEN or CLOUDFLARE_API_KEY in your environment.",
-            "Learn more: https://alchemy.run/guides/cloudflare/",
-          ].join("\n"),
-        );
-      }
-      return {
-        Authorization: `Bearer ${wranglerConfig.value.oauth_token}`,
-      };
+  /**
+   * Format Cloudflare credentials as headers.
+   */
+  export const formatHeaders = (
+    credentials: Credentials,
+  ): Record<string, string> => {
+    switch (credentials.type) {
+      case "api-key":
+        return {
+          "X-Auth-Key": credentials.apiKey,
+          "X-Auth-Email": credentials.email,
+        };
+      case "api-token":
+        return { Authorization: `Bearer ${credentials.apiToken}` };
+      case "oauth":
+        return { Authorization: `Bearer ${credentials.access}` };
     }
-  }
+  };
 }

package/src/cloudflare/bound.ts

@@ -97,7 +97,7 @@ export type Bound<T extends Binding> = T extends _DurableObjectNamespace<
                                     : T extends _RateLimit
                                       ? RateLimit
                                       : T extends string
-                                        ? string
+                                        ? T
                                         : T extends BrowserRendering
                                           ? Fetcher
                                           : T extends _Ai<infer M>

package/src/cloudflare/bucket-object.ts

@@ -0,0 +1,117 @@
+import type { Context } from "../context.ts";
+import { Resource } from "../resource.ts";
+import { createCloudflareApi, type CloudflareApiOptions } from "./api.ts";
+import { deleteObject, type PutObjectObject, type R2Bucket } from "./bucket.ts";
+
+/**
+ * Properties for creating or updating an R2 Object
+ */
+export interface R2ObjectProps extends CloudflareApiOptions {
+  /**
+   * The R2 bucket where the object will be stored
+   */
+  bucket: R2Bucket;
+
+  /**
+   * The key (path/name) of the object within the bucket
+   * Must be a valid object key as defined by R2 storage requirements
+   */
+  key: string;
+
+  /**
+   * The content to store in the object
+   * Supports various data types including streams, buffers, strings, and blobs
+   */
+  content: PutObjectObject;
+}
+
+/**
+ * Output returned after R2 Object creation/update
+ */
+export interface R2Object {
+  /**
+   * The resource identifier
+   */
+  id: string;
+
+  /**
+   * The key (path/name) of the object within the bucket
+   */
+  key: string;
+
+  /**
+   * The etag of the object
+   */
+  etag: string;
+}
+
+/**
+ * Creates and manages objects within Cloudflare R2 Buckets.
+ *
+ * R2 Objects represent individual files or data stored within an R2 bucket.
+ * This resource provides lifecycle management for object creation, updates, and deletion.
+ *
+ * @example
+ * // Create a simple text object in a bucket
+ * const textObject = await R2Object("readme", {
+ *   bucket: myBucket,
+ *   key: "docs/README.txt",
+ *   content: "Welcome to our application!"
+ * });
+ *
+ * @example
+ * // Store JSON data as an object
+ * const configObject = await R2Object("app-config", {
+ *   bucket: configBucket,
+ *   key: "config/app.json",
+ *   content: JSON.stringify({ version: "1.0.0", debug: false })
+ * });
+ *
+ * @example
+ * // Store binary data from a buffer
+ * const imageObject = await R2Object("user-avatar", {
+ *   bucket: assetsBucket,
+ *   key: "avatars/user-123.png",
+ *   content: imageBuffer
+ * });
+ *
+ * @example
+ * // Store data from a readable stream
+ * const streamObject = await R2Object("upload", {
+ *   bucket: uploadsBucket,
+ *   key: "uploads/file.dat",
+ *   content: readableStream
+ * });
+ *
+ * @see https://developers.cloudflare.com/r2/api/workers/workers-api-reference/
+ */
+export const R2Object = Resource(
+  "cloudflare::R2Object",
+  async function (
+    this: Context<R2Object>,
+    id: string,
+    props: R2ObjectProps,
+  ): Promise<R2Object> {
+    if (this.phase === "delete") {
+      const api = await createCloudflareApi(props);
+      // Delete the object from the bucket
+      await deleteObject(api, {
+        bucketName: props.bucket.name,
+        key: props.key,
+      });
+      return this.destroy();
+    } else {
+      if (this.phase === "update" && this.output?.key !== props.key) {
+        this.replace();
+      }
+      // Create or update the object in the bucket
+      const response = await props.bucket.put(props.key, props.content);
+
+      return {
+        id,
+        key: props.key,
+        etag: response.etag,
+      };
+    }
+  },
+);