create-safest-tools 0.2.2 → 0.3.0

package/template/reports.config.example.json

@@ -1,6 +1,6 @@
 {
   "$schema": "./reports.schema.json",
-  "schemaVersion": 1,
+  "schemaVersion": 2,
   "installationId": "acme-resolve",
   "resources": {
     "workerName": "acme-resolve-worker",
@@ -18,10 +18,7 @@
   "allowedOrigins": [
     "https://app.example.com"
   ],
-  "access": {
-    "audience": "replace-with-the-cloudflare-access-application-aud",
-    "ownerEmails": ["infrastructure@example.com"]
-  },
+  "owner": { "email": "infrastructure@example.com" },
   "email": {
     "enabled": true,
     "fromAddress": "reports@example.com"

package/template/reports.schema.json

@@ -1,13 +1,13 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://safest.tools/schemas/reports-installation-v1.json",
+  "$id": "https://safest.tools/schemas/reports-installation-v2.json",
   "title": "Safest Resolve installation",
   "type": "object",
   "additionalProperties": false,
-  "required": ["schemaVersion", "installationId", "resources", "publicBaseUrl", "allowedOrigins", "access", "email", "auth", "retention"],
+  "required": ["schemaVersion", "installationId", "resources", "publicBaseUrl", "allowedOrigins", "owner", "email", "auth", "retention"],
   "properties": {
     "$schema": { "type": "string" },
-    "schemaVersion": { "const": 1 },
+    "schemaVersion": { "const": 2 },
     "installationId": { "type": "string", "pattern": "^[a-z][a-z0-9-]{0,62}$" },
     "resources": {
       "type": "object",
@@ -34,19 +34,12 @@
       "uniqueItems": true,
       "items": { "type": "string", "format": "uri", "pattern": "^https://" }
     },
-    "access": {
+    "owner": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["audience", "ownerEmails"],
+      "required": ["email"],
       "properties": {
-        "audience": { "type": "string", "minLength": 1, "maxLength": 200 },
-        "ownerEmails": {
-          "type": "array",
-          "minItems": 1,
-          "maxItems": 20,
-          "uniqueItems": true,
-          "items": { "type": "string", "format": "email" }
-        }
+        "email": { "type": "string", "format": "email", "maxLength": 254 }
       }
     },
     "email": {

package/template/scripts/reports-deploy.mjs

@@ -12,6 +12,7 @@ import {
 } from "./reports-cloudflare-preflight.mjs";
 import { loadReportsPlan } from "./reports-plan.mjs";
 import { initializeSecrets, parseSecrets } from "./reports-secrets.mjs";
+import { issueOwnerSetup, printOwnerSetup } from "./reports-owner-setup.mjs";
 
 const projectRoot = fileURLToPath(new URL("..", import.meta.url));
 const wrangler = fileURLToPath(new URL("../node_modules/wrangler/bin/wrangler.js", import.meta.url));
@@ -155,13 +156,14 @@ export async function deployReports(argv = process.argv.slice(2)) {
   const installationPath = resolve(projectRoot, ".safest/installation.json");
   await mkdir(dirname(installationPath), { recursive: true, mode: 0o700 });
   await writeFile(installationPath, `${JSON.stringify({
-    schemaVersion: 1,
+    schemaVersion: 2,
     installationId: config.installationId,
     installedAt: new Date().toISOString(),
     resources: config.resources,
-    accessAudience: config.access.audience,
+    ownerEmail: config.owner.email,
   }, null, 2)}\n`, { mode: 0o600 });
-  console.log("\nDeployment finished. Verify public /health, bootstrap the infrastructure owner through Access, run the authenticated setup feature checks until /ready succeeds, invite an administrator and analyst, then verify one server report and Queue consumption before production traffic.");
+  if (!options.upgrade) printOwnerSetup(await issueOwnerSetup({ config }));
+  console.log("\nDeployment finished. Open the one-time owner setup link, run the authenticated setup feature checks until /ready succeeds, invite an administrator and analyst, then verify one server report and Queue consumption before production traffic.");
   return { status: "deployed", plan };
 }
 

package/template/scripts/reports-owner-setup.mjs

@@ -0,0 +1,132 @@
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { spawn } from "node:child_process";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { loadReportsPlan } from "./reports-plan.mjs";
+
+const projectRoot = fileURLToPath(new URL("..", import.meta.url));
+const wrangler = fileURLToPath(new URL("../node_modules/wrangler/bin/wrangler.js", import.meta.url));
+const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/u;
+const TOKEN_TTL_MINUTES = 15;
+
+function sqlLiteral(value) {
+  return `'${String(value).replaceAll("'", "''")}'`;
+}
+
+function runWrangler(args) {
+  return new Promise((resolvePromise, reject) => {
+    const child = spawn(process.execPath, [wrangler, ...args], {
+      cwd: projectRoot,
+      env: { ...process.env, WRANGLER_LOG: "none", WRANGLER_WRITE_LOGS: "false" },
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (chunk) => { stdout += chunk; });
+    child.stderr.on("data", (chunk) => { stderr += chunk; });
+    child.once("error", reject);
+    child.once("exit", (code, signal) => {
+      if (code === 0) return resolvePromise({ stdout, stderr });
+      reject(new Error(`Owner setup token creation failed${signal ? ` with signal ${signal}` : ` with exit code ${code}`}${stderr.trim() ? `: ${stderr.trim()}` : ""}`));
+    });
+  });
+}
+
+export function parseOwnerSetupArguments(argv) {
+  const result = { purpose: "bootstrap", email: "", config: "reports.config.json" };
+  for (let index = 0; index < argv.length; index += 1) {
+    const argument = argv[index];
+    if (argument === "--recover") result.purpose = "recovery";
+    else if (argument === "--email" || argument === "--config") {
+      const value = argv[index + 1];
+      if (!value || value.startsWith("-")) throw new Error(`${argument} needs a value`);
+      index += 1;
+      if (argument === "--email") result.email = value.trim().toLowerCase();
+      else result.config = value;
+    } else throw new Error(`unknown option: ${argument}`);
+  }
+  return result;
+}
+
+export function createOwnerSetupRecord({ email, purpose = "bootstrap", now = new Date(), token, id } = {}) {
+  const normalizedEmail = String(email ?? "").trim().toLowerCase();
+  if (!EMAIL.test(normalizedEmail) || normalizedEmail.length > 254) throw new Error("owner setup requires a valid email address");
+  if (purpose !== "bootstrap" && purpose !== "recovery") throw new Error("owner setup purpose must be bootstrap or recovery");
+  const rawToken = token ?? randomBytes(32).toString("base64url");
+  if (!/^[A-Za-z0-9_-]{43,200}$/u.test(rawToken)) throw new Error("owner setup token must contain at least 256 bits of base64url entropy");
+  const createdAt = new Date(now).toISOString();
+  return {
+    id: id ?? randomUUID(),
+    email: normalizedEmail,
+    purpose,
+    rawToken,
+    tokenHash: createHash("sha256").update(rawToken).digest("base64url"),
+    createdAt,
+    expiresAt: new Date(Date.parse(createdAt) + TOKEN_TTL_MINUTES * 60_000).toISOString(),
+  };
+}
+
+export function ownerSetupSql(record) {
+  const ownerGuard = record.purpose === "bootstrap"
+    ? `NOT EXISTS (SELECT 1 FROM operator_users WHERE status = 'active' AND roles_json LIKE '%"owner"%')`
+    : `EXISTS (SELECT 1 FROM operator_users WHERE email = ${sqlLiteral(record.email)} AND status = 'active' AND roles_json LIKE '%"owner"%')`;
+  return `
+UPDATE owner_setup_tokens
+SET status = 'revoked', revoked_at = ${sqlLiteral(record.createdAt)}
+WHERE email = ${sqlLiteral(record.email)} AND purpose = ${sqlLiteral(record.purpose)} AND status = 'pending';
+INSERT INTO owner_setup_tokens (id, email, token_hash, purpose, status, expires_at, created_at)
+SELECT ${sqlLiteral(record.id)}, ${sqlLiteral(record.email)}, ${sqlLiteral(record.tokenHash)},
+  ${sqlLiteral(record.purpose)}, 'pending', ${sqlLiteral(record.expiresAt)}, ${sqlLiteral(record.createdAt)}
+WHERE ${ownerGuard}
+RETURNING id, email, purpose, expires_at;
+`.trim();
+}
+
+function executionRows(stdout) {
+  let parsed;
+  try { parsed = JSON.parse(stdout.trim()); } catch { throw new Error("Wrangler returned unreadable D1 JSON while creating the owner setup token"); }
+  const results = Array.isArray(parsed) ? parsed : Array.isArray(parsed?.result) ? parsed.result : [parsed];
+  return results.flatMap((entry) => Array.isArray(entry?.results) ? entry.results : []);
+}
+
+export async function issueOwnerSetup({ config, email, purpose = "bootstrap", runner = runWrangler, now, token, id } = {}) {
+  if (!config?.publicBaseUrl || !config?.owner?.email) throw new Error("owner setup requires a parsed Safest Resolve configuration");
+  const record = createOwnerSetupRecord({ email: email || config.owner.email, purpose, now, token, id });
+  const result = await runner(["d1", "execute", "DB", "--remote", "--command", ownerSetupSql(record), "--json", "--yes"]);
+  const created = executionRows(result.stdout).find((row) => row?.id === record.id);
+  if (!created) {
+    throw new Error(purpose === "bootstrap"
+      ? "An active infrastructure owner already exists. Use `npm run owner:recover` for break-glass access."
+      : `Recovery was refused because ${record.email} is not an active infrastructure owner.`);
+  }
+  return {
+    purpose,
+    email: record.email,
+    expiresAt: record.expiresAt,
+    url: `${new URL(config.publicBaseUrl).origin}/#setup=${encodeURIComponent(record.rawToken)}`,
+  };
+}
+
+export function printOwnerSetup(result, output = console) {
+  const label = result.purpose === "bootstrap" ? "Owner setup" : "Owner recovery";
+  output.log(`\n${label} link (single use; expires ${new Date(result.expiresAt).toLocaleString()}):\n${result.url}`);
+  output.log("\nThe secret is in the URL fragment, is not stored in Cloudflare logs, and was not written to disk.");
+  output.log(result.purpose === "bootstrap"
+    ? "If it expires, run `npm run owner:setup` to replace it."
+    : "This recovery link creates a 12-hour break-glass session. Reset the owner password after signing in.");
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const options = parseOwnerSetupArguments(process.argv.slice(2));
+  loadReportsPlan(options.config).then(async ({ config }) => {
+    const result = await issueOwnerSetup({
+      config,
+      email: options.email || config.owner.email,
+      purpose: options.purpose,
+    });
+    printOwnerSetup(result);
+  }).catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  });
+}

package/template/scripts/reports-plan.mjs

@@ -3,7 +3,6 @@ import { resolve } from "node:path";
 
 const RESOURCE_NAME = /^[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$/u;
 const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/u;
-const ACCESS_AUD = /^[a-f0-9]{64}$/iu;
 const AUTH_PROVIDERS = new Set(["google", "github", "cloudflare"]);
 const AUTH_SECRET_NAMES = {
   google: ["AUTH_GOOGLE_CLIENT_ID", "AUTH_GOOGLE_CLIENT_SECRET"],
@@ -68,17 +67,14 @@ function stringList(value, field, maximum, parse) {
 
 export function parseReportsConfig(value) {
   const input = object(value, "configuration");
-  exactKeys(input, new Set(["$schema", "schemaVersion", "installationId", "resources", "publicBaseUrl", "allowedOrigins", "access", "email", "auth", "retention"]), "configuration");
-  if (input.schemaVersion !== 1) throw new ReportsConfigError("schemaVersion must be 1");
+  exactKeys(input, new Set(["$schema", "schemaVersion", "installationId", "resources", "publicBaseUrl", "allowedOrigins", "owner", "email", "auth", "retention"]), "configuration");
+  if (input.schemaVersion !== 2) throw new ReportsConfigError("schemaVersion must be 2");
   const resources = object(input.resources, "resources");
   exactKeys(resources, new Set(["workerName", "databaseName", "profileMediaBucketName", "workflowArtifactsBucketName", "evidenceBucketName", "exportsBucketName", "workflowName", "reportQueueName", "deliveryQueueName", "operationsDlqName"]), "resources");
-  const access = object(input.access, "access");
-  exactKeys(access, new Set(["audience", "ownerEmails"]), "access");
-  const ownerEmails = stringList(access.ownerEmails, "access.ownerEmails", 20, (email, field) => {
-    const result = text(email, field, 254).toLowerCase();
-    if (!EMAIL.test(result)) throw new ReportsConfigError(`${field} is invalid`);
-    return result;
-  });
+  const owner = object(input.owner, "owner");
+  exactKeys(owner, new Set(["email"]), "owner");
+  const ownerEmail = text(owner.email, "owner.email", 254).toLowerCase();
+  if (!EMAIL.test(ownerEmail)) throw new ReportsConfigError("owner.email is invalid");
   const retention = object(input.retention, "retention");
   exactKeys(retention, new Set(["reportsDays", "messagesDays", "appealWindowDays"]), "retention");
   const email = input.email === undefined ? { enabled: false, fromAddress: "" } : object(input.email, "email");
@@ -99,7 +95,7 @@ export function parseReportsConfig(value) {
   }
   if (new Set(authProviders).size !== authProviders.length) throw new ReportsConfigError("auth.providers cannot contain duplicates");
   const parsed = {
-    schemaVersion: 1,
+    schemaVersion: 2,
     installationId: resourceName(input.installationId, "installationId"),
     resources: {
       workerName: resourceName(resources.workerName, "resources.workerName"),
@@ -115,10 +111,7 @@ export function parseReportsConfig(value) {
     },
     publicBaseUrl: origin(input.publicBaseUrl, "publicBaseUrl"),
     allowedOrigins: stringList(input.allowedOrigins, "allowedOrigins", 20, origin),
-    access: {
-      audience: text(access.audience, "access.audience", 200),
-      ownerEmails,
-    },
+    owner: { email: ownerEmail },
     email: { enabled: email.enabled, fromAddress: emailFromAddress },
     auth: { password: true, providers: authProviders },
     retention: {
@@ -133,19 +126,16 @@ export function parseReportsConfig(value) {
 }
 
 export function buildReportsPlan(config) {
-  const accessReady = ACCESS_AUD.test(config.access.audience);
   const emailReady = config.email.enabled;
   const publicHostname = new URL(config.publicBaseUrl).hostname;
-  const ownerBootstrapPath = `${publicHostname}/v1/infrastructure/*`;
   const customDomain = publicHostname.endsWith(".workers.dev") ? null : publicHostname;
   return {
     product: "Safest Resolve",
-    schemaVersion: 1,
+    schemaVersion: 2,
     installationId: config.installationId,
     ownership: "All resources, data, secrets, policies, and logs remain in the customer's Cloudflare account.",
-    ready: accessReady && emailReady,
+    ready: emailReady,
     blockers: [
-      ...(!accessReady ? ["Create the customer-owned Cloudflare Access application and replace access.audience with its 64-character AUD."] : []),
       ...(!emailReady ? ["Onboard the sender domain in Cloudflare Email Sending and set email.fromAddress; invitations and password recovery cannot be deployed without email delivery."] : []),
     ],
     resources: {
@@ -171,11 +161,10 @@ export function buildReportsPlan(config) {
         oauthProviders: config.auth.providers,
         callbackUrls: Object.fromEntries(config.auth.providers.map((provider) => [provider, `${config.publicBaseUrl}/api/auth/callback/${provider}`])),
       },
-      access: {
-        applicationPath: ownerBootstrapPath,
-        audience: accessReady ? config.access.audience : "not configured",
-        ownerEmails: config.access.ownerEmails,
-        purpose: "Infrastructure-owner bootstrap and recovery only. Invited admins and analysts use Safest accounts.",
+      ownerSetup: {
+        email: config.owner.email,
+        bootstrap: "A 256-bit, single-use setup link is created after deployment and expires after 15 minutes.",
+        recovery: "Wrangler-authenticated npm run owner:recover creates a 12-hour break-glass session.",
       },
     },
     networkContract: {
@@ -185,14 +174,13 @@ export function buildReportsPlan(config) {
       reportSubmissionOnly: true,
     },
     order: [
-      "Review this plan, the infrastructure-owner allowlist, and the Access application path.",
-      "Create or select the Cloudflare Access application for /v1/infrastructure/* and record its AUD.",
+      "Review this plan and the initial infrastructure-owner email.",
       "Onboard the sender domain to Cloudflare Email Service before deployment.",
       "Initialize local secrets without committing them.",
       "Create D1, four private R2 buckets, and the three Queues in the customer account.",
       "Apply all report migrations before accepting traffic.",
       `Deploy the Worker, assets, Worker Loader, Dynamic Workflow, presence Durable Object, Queue consumers, cron, Workers AI binding${customDomain ? `, and ${customDomain} Custom Domain` : ""}.`,
-      "Bootstrap the infrastructure owner, verify required setup features and authenticated /ready, invite an administrator, invite an analyst, then verify report intake, routing, and delivery recovery.",
+      "Open the generated one-time owner setup link, create the owner account, verify required setup features and authenticated /ready, invite an administrator and analyst, then verify report intake, routing, and delivery recovery.",
     ],
     lifecycle: {
       backup: "D1 SQL export plus all four private R2 buckets, stable inventory, per-object SHA-256 digests, and a durable verification record; Queue and live Workflow state remain separate.",

package/template/scripts/reports-uninstall-plan.mjs

@@ -10,7 +10,7 @@ export async function buildReportsUninstallPlan() {
       "Queue backlog and dead letters",
       "Worker service bindings and custom domains",
       "verified D1 and R2 backup manifests and checksums",
-      "Access application policies",
+      "outstanding owner setup or recovery tokens",
       "enrichment, notification, and action webhook dependencies",
     ],
     exactResources: {
@@ -19,9 +19,8 @@ export async function buildReportsUninstallPlan() {
       database: config.resources.databaseName,
       r2Buckets: [config.resources.profileMediaBucketName, config.resources.workflowArtifactsBucketName, config.resources.evidenceBucketName, config.resources.exportsBucketName],
       dynamicWorkflow: config.resources.workflowName,
-      accessAudience: config.access.audience,
     },
-    defaultPreservation: ["D1 database", "all private R2 buckets", "Access application", "independent secrets recovery", "verified D1/R2 archive manifests"],
+    defaultPreservation: ["D1 database", "all private R2 buckets", "independent secrets recovery", "verified D1/R2 archive manifests"],
     note: "Removal stays manual so data, dependencies, and exact resource ownership can be verified immediately beforehand.",
   };
 }

package/template/src/index.ts

@@ -18,7 +18,6 @@ import {
   projectOperatorFields,
   requireIntegration,
   requireOperator,
-  resolveInfrastructureOwnerIdentity,
   appendOperatorAuthenticationCookies,
   resolveOperatorAuthentication,
   resolveOperatorSession,
@@ -26,10 +25,13 @@ import {
 import {
   callBetterAuth,
   configuredAuthProviders,
+  clearOwnerSetupCookie,
   handleBetterAuthRequest,
   inspectInvitation,
+  inspectOwnerSetup,
   invitationAllowsEmail,
   invitationIdFromRequest,
+  ownerSetupContextFromRequest,
   revokeBetterAuthSessionsForOperator,
   sendOperatorInvitationEmail,
 } from "./report-better-auth";
@@ -121,7 +123,6 @@ import {
 } from "./report-operations";
 import {
   appendOperatorSessionCookies,
-  bootstrapOwner,
   clearOperatorSessionCookies,
   createOperatorInvitation,
   deleteOperatorProfilePicture,
@@ -130,6 +131,7 @@ import {
   operatorProfilePictureResponse,
   revokeOperatorInvitation,
   revokeOperatorSessions,
+  recoverOwnerWithSetup,
   resolveBetterAuthOperator,
   updateOperatorUser,
   updateOperatorProfile,
@@ -922,18 +924,52 @@ async function handleOperatorLogout(request: Request, env: Env, ctx: ExecutionCo
   return clearOperatorSessionCookies(response, request);
 }
 
-async function handleInfrastructureBootstrap(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
-  if (request.method !== "GET" && request.method !== "POST") return methodNotAllowed(["GET", "POST"]);
-  const identity = await resolveInfrastructureOwnerIdentity(request, env, ctx);
-  if (!identity) throw new ApiError(401, "infrastructure_authentication_required", "Cloudflare Access authentication is required for infrastructure owner setup.");
-  const issued = await bootstrapOwner(env.DB, identity);
-  if (request.method === "POST") {
-    return appendOperatorSessionCookies(json({ schema_version: "1", bootstrapped: true }, { status: 201 }), issued, request);
+async function handleOwnerSetupAccept(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const setup = await ownerSetupContextFromRequest(request, env);
+  if (!setup) throw new ApiError(401, "invalid_owner_setup", "This owner setup link is invalid or expired.");
+  if (setup.purpose === "recovery") {
+    const issued = await recoverOwnerWithSetup(env.DB, setup.id, setup.email);
+    if (!issued) throw new ApiError(409, "owner_recovery_unavailable", "This owner recovery link has already been used or is no longer valid.");
+    return clearOwnerSetupCookie(appendOperatorSessionCookies(json({
+      schema_version: "1",
+      authenticated: true,
+      recovery_session_expires_at: issued.expiresAt,
+    }, { status: 201 }), issued, request), request);
   }
-  return appendOperatorSessionCookies(new Response(null, {
-    status: 303,
-    headers: { location: "/#reports", "cache-control": "no-store" },
-  }), issued, request);
+  const body = await readJsonObject(request, 8 * 1024);
+  const displayName = typeof body.display_name === "string" ? body.display_name.trim() : "";
+  const signUp = await callBetterAuth(request, env, ctx, "/sign-up/email", {
+    name: displayName,
+    email: setup.email,
+    password: body.password,
+    callbackURL: "/",
+    rememberMe: false,
+  });
+  if (!signUp.ok) return normalizedBetterAuthError(signUp, "The owner account could not be created.");
+  signUp.body?.cancel();
+  await env.DB.prepare(`UPDATE auth_user SET emailVerified = 1, updatedAt = ?2 WHERE email = ?1 COLLATE NOCASE`)
+    .bind(setup.email, new Date().toISOString()).run();
+  const signIn = await callBetterAuth(request, env, ctx, "/sign-in/email", {
+    email: setup.email,
+    password: body.password,
+    rememberMe: false,
+    callbackURL: "/",
+  });
+  if (!signIn.ok) return normalizedBetterAuthError(signIn, "The owner account could not be activated.");
+  const owner = await resolveBetterAuthOperator(env.DB, {
+    email: setup.email,
+    name: displayName || setup.email.split("@", 1)[0],
+  }, null, setup.id);
+  if (!owner?.roles.includes("owner")) {
+    signIn.body?.cancel();
+    throw new ApiError(409, "owner_setup_already_used", "This owner setup link has already been used or is no longer valid.");
+  }
+  return clearOwnerSetupCookie(normalizedBetterAuthSuccess(signIn, {
+    schema_version: "1",
+    account_created: true,
+    authenticated: true,
+  }, 201), request);
 }
 
 async function handleAdminPeople(request: Request, env: Env): Promise<Response> {
@@ -1004,7 +1040,7 @@ async function handleAdminOperatorPasswordReset(
     throw new ApiError(
       409,
       "password_authentication_unavailable",
-      "This account uses OAuth or Cloudflare Access and does not have a Safest password to reset.",
+      "This account uses OAuth and does not have a Safest password to reset.",
     );
   }
   const better = await callBetterAuth(request, env, ctx, "/request-password-reset", {
@@ -3452,6 +3488,8 @@ async function route(request: Request, env: Env, ctx: ExecutionContext): Promise
   if (url.pathname === "/v1/meta/capabilities") return handleMetaCapabilities(request, env);
   if (url.pathname === "/v1/meta/version") return handleMetaVersion(request, env);
   if (url.pathname === "/v1/auth/providers") return handleAuthProviders(request, env);
+  if (url.pathname === "/v1/auth/owner-setup/inspect") return inspectOwnerSetup(request, env);
+  if (url.pathname === "/v1/auth/owner-setup/accept") return handleOwnerSetupAccept(request, env, ctx);
   if (url.pathname === "/v1/auth/login") return handleOperatorLogin(request, env, ctx);
   if (url.pathname === "/v1/auth/invitations/inspect") return inspectInvitation(request, env);
   if (url.pathname === "/v1/auth/invitations/accept") return handleOperatorInvitationAccept(request, env, ctx);
@@ -3460,7 +3498,6 @@ async function route(request: Request, env: Env, ctx: ExecutionContext): Promise
   if (url.pathname === "/v1/auth/logout") return handleOperatorLogout(request, env, ctx);
   if (url.pathname === "/v1/account/profile") return handleOperatorProfile(request, env);
   if (url.pathname === "/v1/account/profile-picture") return handleOperatorProfilePicture(request, env, ctx);
-  if (url.pathname === "/v1/infrastructure/bootstrap") return handleInfrastructureBootstrap(request, env, ctx);
   if (url.pathname === "/v1/widget/config") return handleWidgetConfig(request, env);
   if (url.pathname === "/v1/brand") return handlePublicBrand(request, env);
   if (url.pathname === "/v1/public/config") return handlePublicConfig(request, env);

package/template/src/report-auth.ts

@@ -1,4 +1,3 @@
-import { createRemoteJWKSet, decodeJwt, jwtVerify, type JWTPayload } from "jose";
 import { ApiError } from "./report-http";
 import { secretsEqual, sha256 } from "./report-crypto";
 import {
@@ -12,82 +11,12 @@ import {
   betterAuthCsrfHash,
   betterAuthCsrfToken,
   invitationIdFromRequest,
+  ownerSetupContextFromRequest,
   resolveBetterAuthSession,
 } from "./report-better-auth";
 import { loadIntegration } from "./report-repository";
 import type { OperatorPermissions, OperatorSession } from "./report-types";
 
-type AccessIdentity = JWTPayload & {
-  email?: unknown;
-  name?: unknown;
-  picture?: unknown;
-  user_uuid?: unknown;
-  groups?: unknown;
-  custom?: unknown;
-};
-type AccessContext = Pick<ExecutionContext, "access">;
-
-const accessKeySets = new Map<string, ReturnType<typeof createRemoteJWKSet>>();
-function bounded(value: unknown, maximum: number): string | undefined {
-  if (typeof value !== "string") return undefined;
-  const normalized = value.trim();
-  return normalized ? normalized.slice(0, maximum) : undefined;
-}
-
-function avatarUrl(value: unknown): string | undefined {
-  const candidate = bounded(value, 2_048);
-  if (!candidate) return undefined;
-  try {
-    const url = new URL(candidate);
-    return url.protocol === "https:" && !url.username && !url.password ? url.href : undefined;
-  } catch {
-    return undefined;
-  }
-}
-
-function issuer(value: unknown): string | null {
-  if (typeof value !== "string") return null;
-  try {
-    const url = new URL(value);
-    return url.protocol === "https:" && !url.username && !url.password && !url.port
-      && (url.pathname === "/" || url.pathname === "") && !url.search && !url.hash
-      && url.hostname.endsWith(".cloudflareaccess.com")
-      ? url.origin
-      : null;
-  } catch {
-    return null;
-  }
-}
-
-async function accessIdentity(request: Request, env: Env, ctx: AccessContext): Promise<AccessIdentity | null> {
-  if (ctx.access) {
-    try {
-      return await ctx.access.getIdentity() as AccessIdentity;
-    } catch (error) {
-      console.warn("Cloudflare Access runtime identity was unavailable", error instanceof Error ? error.message : typeof error);
-    }
-  }
-  const token = request.headers.get("cf-access-jwt-assertion");
-  const audience = bounded(env.ACCESS_AUD, 200);
-  if (!token || !audience) return null;
-  try {
-    const tokenIssuer = issuer(decodeJwt(token).iss);
-    if (!tokenIssuer) return null;
-    let keySet = accessKeySets.get(tokenIssuer);
-    if (!keySet) {
-      keySet = createRemoteJWKSet(new URL("/cdn-cgi/access/certs", tokenIssuer));
-      accessKeySets.set(tokenIssuer, keySet);
-    }
-    const { payload } = await jwtVerify(token, keySet, {
-      algorithms: ["RS256"], audience, issuer: tokenIssuer,
-    });
-    return payload as AccessIdentity;
-  } catch (error) {
-    console.warn("Cloudflare Access JWT validation failed", error instanceof Error ? error.message : typeof error);
-    return null;
-  }
-}
-
 export async function resolveOperatorSession(request: Request, env: Env): Promise<OperatorSession | null> {
   return (await resolveOperatorAuthentication(request, env))?.session ?? null;
 }
@@ -111,7 +40,7 @@ export async function resolveOperatorAuthentication(
       email: better.user.email,
       name: better.user.name,
       image: better.user.image,
-    }, await invitationIdFromRequest(request, env));
+    }, await invitationIdFromRequest(request, env), (await ownerSetupContextFromRequest(request, env))?.id ?? null);
     if (session) {
       const csrfToken = await betterAuthCsrfToken(env, better.session.id);
       return {
@@ -148,26 +77,6 @@ export function appendOperatorAuthenticationCookies(
     : response;
 }
 
-export async function resolveInfrastructureOwnerIdentity(
-  request: Request,
-  env: Env,
-  ctx: AccessContext,
-): Promise<{ email: string; displayName: string; avatarUrl?: string } | null> {
-  const identity = await accessIdentity(request, env, ctx);
-  if (!identity) return null;
-  const email = bounded(identity.email, 254)?.toLowerCase();
-  if (!email) return null;
-  const allowedOwners = new Set((env.INFRASTRUCTURE_OWNER_EMAILS ?? "").split(",")
-    .map((value) => value.trim().toLowerCase()).filter(Boolean));
-  if (!allowedOwners.has(email)) return null;
-  const picture = avatarUrl(identity.picture);
-  return {
-    email,
-    displayName: bounded(identity.name, 100) ?? email,
-    ...(picture ? { avatarUrl: picture } : {}),
-  };
-}
-
 export async function requireOperator(
   request: Request,
   env: Env,