alchemy 0.80.1 → 0.81.0

package/src/cloudflare/warp-default-profile.ts

@@ -0,0 +1,320 @@
+import type { Context } from "../context.ts";
+import { Resource, ResourceKind } from "../resource.ts";
+import { handleApiError } from "./api-error.ts";
+import {
+  createCloudflareApi,
+  type CloudflareApi,
+  type CloudflareApiOptions,
+} from "./api.ts";
+import type {
+  ServiceModeV2,
+  SplitTunnelConfig,
+} from "./warp-device-profile.ts";
+
+/**
+ * Properties for updating the WARP Default Profile
+ */
+export interface WarpDefaultProfileProps extends CloudflareApiOptions {
+  /**
+   * Service mode configuration for WARP client
+   */
+  serviceModeV2?: ServiceModeV2;
+
+  /**
+   * Disable automatic fallback to direct connection if tunnel fails
+   */
+  disableAutoFallback?: boolean;
+
+  /**
+   * Allow users to manually switch WARP modes
+   */
+  allowModeSwitch?: boolean;
+
+  /**
+   * Lock the WARP toggle switch (users cannot change it)
+   */
+  switchLocked?: boolean;
+
+  /**
+   * Tunnel protocol to use
+   */
+  tunnelProtocol?: "wireguard" | "masque";
+
+  /**
+   * Auto-connect timeout in seconds
+   * Set to 0 to disable auto-connect
+   */
+  autoConnect?: number;
+
+  /**
+   * Allow users to disconnect from WARP
+   */
+  allowedToLeave?: boolean;
+
+  /**
+   * Captive portal timeout in seconds
+   * Time before showing captive portal
+   */
+  captivePortal?: number;
+
+  /**
+   * Support URL for feedback button in WARP client
+   */
+  supportUrl?: string;
+
+  /**
+   * Exclude office IPs from WARP tunnel
+   */
+  excludeOfficeIps?: boolean;
+
+  /**
+   * LAN allow duration in minutes
+   */
+  lanAllowMinutes?: number;
+
+  /**
+   * LAN subnet size for local network access
+   */
+  lanAllowSubnetSize?: number;
+
+  /**
+   * Split tunnel configuration
+   * Controls which routes bypass or use the WARP tunnel
+   */
+  splitTunnel?: SplitTunnelConfig;
+
+  /**
+   * Whether to delete the default profile settings when removed from Alchemy
+   * Note: This does not actually delete the default profile (which always exists),
+   * but removes it from Alchemy state management
+   *
+   * @default false
+   */
+  delete?: boolean;
+}
+
+export function isWarpDefaultProfile(
+  resource: any,
+): resource is WarpDefaultProfile {
+  return resource?.[ResourceKind] === "cloudflare::WarpDefaultProfile";
+}
+
+/**
+ * Output returned after WARP Default Profile update
+ */
+export type WarpDefaultProfile = WarpDefaultProfileProps & {
+  /**
+   * Time at which the profile was last modified
+   */
+  modifiedAt: number;
+};
+
+/**
+ * Manages the Cloudflare WARP Default Device Profile, which defines the
+ * account-wide default WARP client settings that apply when no custom profile matches.
+ *
+ * The default profile always exists and cannot be deleted. This resource allows you
+ * to update its settings programmatically.
+ *
+ * @see https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/configure-warp/device-profiles/
+ *
+ * @example
+ * ## Update default WARP settings
+ *
+ * Configure the default behavior for all devices
+ *
+ * const defaultProfile = await WarpDefaultProfile("default", {
+ *   serviceModeV2: { mode: "warp" },
+ *   autoConnect: 0,
+ *   captivePortal: 180,
+ *   supportUrl: "https://support.example.com"
+ * });
+ *
+ * @example
+ * ## Default profile with split tunnel
+ *
+ * Configure default split tunnel behavior for all devices
+ *
+ * const defaultWithSplitTunnel = await WarpDefaultProfile("default", {
+ *   serviceModeV2: { mode: "warp" },
+ *   splitTunnel: {
+ *     mode: "exclude",
+ *     entries: [
+ *       { address: "10.0.0.0/8", description: "Internal network" },
+ *       { address: "192.168.0.0/16", description: "Local network" }
+ *     ]
+ *   }
+ * });
+ *
+ * @example
+ * ## Locked default profile
+ *
+ * Create a locked-down default configuration
+ *
+ * const lockedDefault = await WarpDefaultProfile("default", {
+ *   serviceModeV2: { mode: "warp" },
+ *   switchLocked: true,
+ *   allowedToLeave: false,
+ *   disableAutoFallback: true,
+ *   tunnelProtocol: "wireguard"
+ * });
+ */
+export const WarpDefaultProfile = Resource(
+  "cloudflare::WarpDefaultProfile",
+  async function (
+    this: Context<WarpDefaultProfile>,
+    id: string,
+    props: WarpDefaultProfileProps = {},
+  ): Promise<WarpDefaultProfile> {
+    const api = await createCloudflareApi(props);
+
+    if (this.phase === "delete") {
+      // Default profile cannot be deleted, just remove from state
+      return this.destroy();
+    }
+
+    // Update default profile (single PATCH endpoint)
+    await updateDefaultPolicy(api, props);
+
+    return {
+      ...props,
+      modifiedAt: Date.now(),
+    };
+  },
+);
+
+/**
+ * Internal API response type for default policy
+ * @internal
+ */
+interface CloudflareDefaultPolicyResponse {
+  device_settings?: {
+    service_mode_v2?: {
+      mode: string;
+      port?: number;
+    };
+    disable_auto_fallback?: boolean;
+    allow_mode_switch?: boolean;
+    switch_locked?: boolean;
+    tunnel_protocol?: string;
+    auto_connect?: number;
+    allowed_to_leave?: boolean;
+    captive_portal?: number;
+    support_url?: string;
+    exclude_office_ips?: boolean;
+    lan_allow_minutes?: number;
+    lan_allow_subnet_size?: number;
+  };
+}
+
+// Keys with special handling (not simple 1:1 mapping)
+type SpecialKeys = "serviceModeV2" | "splitTunnel" | "delete";
+
+// Simple device setting keys that map directly to snake_case API fields
+type SimpleDeviceSettingKey = Exclude<
+  keyof WarpDefaultProfileProps,
+  keyof CloudflareApiOptions | SpecialKeys
+>;
+
+// Type-safe mapping - TypeScript errors if any SimpleDeviceSettingKey is missing
+const DEVICE_SETTINGS_MAP: Record<SimpleDeviceSettingKey, string> = {
+  disableAutoFallback: "disable_auto_fallback",
+  allowModeSwitch: "allow_mode_switch",
+  switchLocked: "switch_locked",
+  tunnelProtocol: "tunnel_protocol",
+  autoConnect: "auto_connect",
+  allowedToLeave: "allowed_to_leave",
+  captivePortal: "captive_portal",
+  supportUrl: "support_url",
+  excludeOfficeIps: "exclude_office_ips",
+  lanAllowMinutes: "lan_allow_minutes",
+  lanAllowSubnetSize: "lan_allow_subnet_size",
+};
+
+async function updateDefaultPolicy(
+  api: CloudflareApi,
+  props: WarpDefaultProfileProps,
+): Promise<void> {
+  // Build device settings object
+  const deviceSettings: Record<string, unknown> = {};
+
+  if (props.serviceModeV2) {
+    deviceSettings.service_mode_v2 = {
+      mode: props.serviceModeV2.mode,
+      ...(props.serviceModeV2.port && { port: props.serviceModeV2.port }),
+    };
+  }
+
+  // Apply all simple field mappings
+  for (const propKey of Object.keys(
+    DEVICE_SETTINGS_MAP,
+  ) as SimpleDeviceSettingKey[]) {
+    deviceSettings[DEVICE_SETTINGS_MAP[propKey]] = props[propKey];
+  }
+
+  // Split tunnel config is part of the body for default policy
+  if (props.splitTunnel) {
+    if (props.splitTunnel.mode === "include") {
+      deviceSettings.include = props.splitTunnel.entries.map((entry) => ({
+        address: entry.address,
+        ...(entry.description && { description: entry.description }),
+      }));
+    } else {
+      deviceSettings.exclude = props.splitTunnel.entries.map((entry) => ({
+        address: entry.address,
+        ...(entry.description && { description: entry.description }),
+      }));
+    }
+  }
+
+  const requestBody: any = {
+    ...(Object.keys(deviceSettings).length > 0 && { ...deviceSettings }),
+  };
+
+  const response = await api.patch(
+    `/accounts/${api.accountId}/devices/policy`,
+    requestBody,
+  );
+
+  if (!response.ok) {
+    await handleApiError(response, "update", "warp_default_profile", "default");
+  }
+}
+
+async function updateDefaultSplitTunnel(
+  api: CloudflareApi,
+  config: SplitTunnelConfig,
+): Promise<void> {
+  const routes = config.entries.map((entry) => ({
+    address: entry.address,
+    ...(entry.description && { description: entry.description }),
+  }));
+
+  if (config.mode === "include") {
+    const response = await api.put(
+      `/accounts/${api.accountId}/devices/policies/default/includes`,
+      routes,
+    );
+    if (!response.ok) {
+      await handleApiError(
+        response,
+        "update split tunnel includes",
+        "warp_default_profile",
+        "default",
+      );
+    }
+  } else {
+    const response = await api.put(
+      `/accounts/${api.accountId}/devices/policies/default/excludes`,
+      routes,
+    );
+    if (!response.ok) {
+      await handleApiError(
+        response,
+        "update split tunnel excludes",
+        "warp_default_profile",
+        "default",
+      );
+    }
+  }
+}