devflare 1.0.0-next.5 → 1.0.0-next.50

package/dist/_chunks/tokens-iVcgNXi-.js

@@ -0,0 +1,221 @@
+import { a as apiGetAll, c as apiPut, r as apiDelete, s as apiPost } from "./api-TzdliH-6.js";
+//#region src/cloudflare/known-permission-group-ids.generated.ts
+const KNOWN_PERMISSION_GROUP_IDS_DATA = {
+	WORKERS_SCRIPTS_WRITE: null,
+	WORKERS_SCRIPTS_READ: null,
+	ACCOUNT_SETTINGS_READ: null,
+	WORKERS_KV_STORAGE_WRITE: null,
+	WORKERS_KV_STORAGE_READ: null,
+	ACCOUNT_API_TOKENS_WRITE: null,
+	ACCOUNT_API_TOKENS_READ: null
+};
+//#endregion
+//#region src/cloudflare/tokens.ts
+const MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS = 300;
+const DEVFLARE_MANAGED_TOKEN_PREFIX = "devflare-";
+const ACCOUNT_OWNED_TOKEN_SCOPE = "com.cloudflare.api.account";
+const ACCOUNT_ZONE_OWNED_TOKEN_SCOPE = "com.cloudflare.api.account.zone";
+const ACCOUNT_API_TOKENS_PERMISSION_GROUP_NAME_PATTERN = /^Account API Tokens\b/i;
+const DEVFLARE_MANAGED_TOKEN_NAME_PATTERN = /^devflare-/i;
+const DEVFLARE_PERMISSION_GROUP_NAME_PATTERNS = [
+	/^Account Analytics /i,
+	/^Account Settings /i,
+	/^Account Filter Lists /i,
+	/^AI /i,
+	/^Analytics /i,
+	/^Browser Rendering /i,
+	/^Cache Purge\b/i,
+	/^D1 /i,
+	/^DNS /i,
+	/^Email /i,
+	/^Hyperdrive /i,
+	/^Images /i,
+	/^Logs /i,
+	/^Logpush /i,
+	/^Pages /i,
+	/^Queues /i,
+	/^R2 /i,
+	/^SSL and Certificates /i,
+	/^Stream /i,
+	/^Vectorize /i,
+	/^Workers /i,
+	/^Zone Settings /i,
+	/^Zone /i
+];
+/**
+* Symbolic names for individual Cloudflare permission groups we care about
+* when reasoning about a Devflare token policy. Stable ids (when known)
+* should be preferred over display names, which Cloudflare is free to
+* rename or localize at any time.
+*
+* Entries set to `undefined` have not been confidently verified against
+* Cloudflare's `GET /accounts/:id/tokens/permission_groups` endpoint and
+* fall back to exact display-name matching via
+* {@link KNOWN_PERMISSION_GROUP_DISPLAY_NAMES}.
+*
+* The verified UUIDs (or `null` placeholders) live in
+* `known-permission-group-ids.generated.ts`, which is rewritten by
+* `scripts/refresh-permission-groups.ts` against a maintainer's Cloudflare
+* account so this file does not need hand-edits when Cloudflare publishes
+* or rotates permission-group ids.
+*/
+function deriveKnownPermissionGroupIds(data) {
+	const result = {};
+	for (const key of Object.keys(data)) {
+		const value = data[key];
+		result[key] = value === null ? void 0 : value;
+	}
+	return result;
+}
+deriveKnownPermissionGroupIds(KNOWN_PERMISSION_GROUP_IDS_DATA);
+function dedupePermissionGroups(permissionGroups) {
+	const seenIds = /* @__PURE__ */ new Set();
+	return permissionGroups.filter((permissionGroup) => {
+		if (seenIds.has(permissionGroup.id)) return false;
+		seenIds.add(permissionGroup.id);
+		return true;
+	});
+}
+function dedupePermissionGroupIds(permissionGroupIds) {
+	return Array.from(new Set(permissionGroupIds.map((id) => id.trim()).filter(Boolean)));
+}
+function dedupeScopedPermissionGroups(permissionGroups) {
+	const seenIds = /* @__PURE__ */ new Set();
+	return permissionGroups.filter((permissionGroup) => {
+		const id = permissionGroup.id.trim();
+		if (!id || seenIds.has(id)) return false;
+		seenIds.add(id);
+		return true;
+	});
+}
+function permissionGroupHasScope(permissionGroup, scope) {
+	return permissionGroup.scopes.some((value) => value.trim() === scope);
+}
+function buildCreateTokenPoliciesFromPermissionGroups(accountId, permissionGroups) {
+	const dedupedPermissionGroups = dedupeScopedPermissionGroups(permissionGroups);
+	const accountPermissionGroupIds = dedupePermissionGroupIds(dedupedPermissionGroups.filter((permissionGroup) => permissionGroupHasScope(permissionGroup, ACCOUNT_OWNED_TOKEN_SCOPE)).map((permissionGroup) => permissionGroup.id));
+	const zonePermissionGroupIds = dedupePermissionGroupIds(dedupedPermissionGroups.filter((permissionGroup) => permissionGroupHasScope(permissionGroup, ACCOUNT_ZONE_OWNED_TOKEN_SCOPE)).map((permissionGroup) => permissionGroup.id));
+	const policies = [];
+	if (accountPermissionGroupIds.length > 0) policies.push({
+		effect: "allow",
+		resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
+		permission_groups: accountPermissionGroupIds.map((id) => ({ id }))
+	});
+	if (zonePermissionGroupIds.length > 0) policies.push({
+		effect: "allow",
+		resources: { [`com.cloudflare.api.account.${accountId}`]: { [`${ACCOUNT_ZONE_OWNED_TOKEN_SCOPE}.*`]: "*" } },
+		permission_groups: zonePermissionGroupIds.map((id) => ({ id }))
+	});
+	return policies;
+}
+function buildCreateTokenPoliciesFromPermissionGroupIds(accountId, permissionGroupIds) {
+	const dedupedPermissionGroupIds = dedupePermissionGroupIds(permissionGroupIds);
+	if (dedupedPermissionGroupIds.length === 0) return [];
+	return [{
+		effect: "allow",
+		resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
+		permission_groups: dedupedPermissionGroupIds.map((id) => ({ id }))
+	}];
+}
+function excludeAccountApiTokensPermissionGroups(permissionGroups) {
+	return permissionGroups.filter((permissionGroup) => {
+		return !ACCOUNT_API_TOKENS_PERMISSION_GROUP_NAME_PATTERN.test(permissionGroup.name);
+	});
+}
+function keepAccountOwnedTokenCompatiblePermissionGroups(permissionGroups) {
+	return permissionGroups.filter((permissionGroup) => {
+		return permissionGroup.scopes.some((scope) => {
+			const normalizedScope = scope.trim();
+			return normalizedScope === ACCOUNT_OWNED_TOKEN_SCOPE || normalizedScope === ACCOUNT_ZONE_OWNED_TOKEN_SCOPE;
+		});
+	});
+}
+function selectReusableAccountOwnedTokenPermissionGroups(permissionGroups) {
+	return dedupePermissionGroups(excludeAccountApiTokensPermissionGroups(keepAccountOwnedTokenCompatiblePermissionGroups(permissionGroups)));
+}
+function parseOptionalDate(value) {
+	if (!value) return;
+	const parsed = new Date(value);
+	return Number.isNaN(parsed.getTime()) ? void 0 : parsed;
+}
+function mapAccountOwnedAPITokenPolicy(policy) {
+	return {
+		id: policy.id,
+		effect: policy.effect,
+		permissionGroups: policy.permission_groups?.map((permissionGroup) => ({
+			id: permissionGroup.id,
+			name: permissionGroup.name
+		}))
+	};
+}
+function mapAccountOwnedAPIToken(token) {
+	return {
+		id: token.id,
+		name: token.name ?? token.id,
+		status: token.status,
+		value: token.value,
+		issuedOn: parseOptionalDate(token.issued_on),
+		modifiedOn: parseOptionalDate(token.modified_on),
+		lastUsedOn: parseOptionalDate(token.last_used_on),
+		policies: token.policies?.map(mapAccountOwnedAPITokenPolicy)
+	};
+}
+function isDevflareManagedTokenName(name) {
+	return DEVFLARE_MANAGED_TOKEN_NAME_PATTERN.test(name.trim());
+}
+function normalizeDevflareTokenName(name) {
+	const trimmedName = name.trim();
+	if (!trimmedName) throw new Error("Devflare token name cannot be empty");
+	const suffix = isDevflareManagedTokenName(trimmedName) ? trimmedName.replace(DEVFLARE_MANAGED_TOKEN_NAME_PATTERN, "") : trimmedName;
+	if (!suffix) throw new Error("Devflare token name cannot be empty");
+	return `${DEVFLARE_MANAGED_TOKEN_PREFIX}${suffix}`;
+}
+function stripDevflareTokenNamePrefix(name) {
+	const trimmedName = name.trim();
+	if (!trimmedName) return trimmedName;
+	return trimmedName.replace(DEVFLARE_MANAGED_TOKEN_NAME_PATTERN, "") || trimmedName;
+}
+function filterDevflareManagedTokens(tokens) {
+	return tokens.filter((token) => isDevflareManagedTokenName(token.name));
+}
+function selectDevflarePermissionGroups(permissionGroups) {
+	const selectedPermissionGroups = dedupePermissionGroups(selectReusableAccountOwnedTokenPermissionGroups(permissionGroups).filter((permissionGroup) => {
+		return DEVFLARE_PERMISSION_GROUP_NAME_PATTERNS.some((pattern) => {
+			return pattern.test(permissionGroup.name);
+		});
+	}));
+	if (selectedPermissionGroups.length === 0) throw new Error("Could not map the available Cloudflare permission groups to a Devflare token policy.");
+	if (selectedPermissionGroups.length > MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS) throw new Error(`Devflare selected ${selectedPermissionGroups.length} permission groups, which exceeds Cloudflare's ${MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS}-group limit for account-owned tokens.`);
+	return selectedPermissionGroups;
+}
+function selectAllReusablePermissionGroups(permissionGroups) {
+	const selectedPermissionGroups = selectReusableAccountOwnedTokenPermissionGroups(permissionGroups);
+	if (selectedPermissionGroups.length === 0) throw new Error("Could not find any reusable account/zone-scoped Cloudflare permission groups for this Devflare token.");
+	if (selectedPermissionGroups.length > MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS) throw new Error(`Devflare selected ${selectedPermissionGroups.length} permission groups, which exceeds Cloudflare\'s ${MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS}-group limit for account-owned tokens.`);
+	return selectedPermissionGroups;
+}
+async function listAccountTokenPermissionGroups(accountId, options) {
+	return dedupePermissionGroups(await apiGetAll(`/accounts/${accountId}/tokens/permission_groups`, options));
+}
+async function listAccountOwnedAPITokens(accountId, options) {
+	return (await apiGetAll(`/accounts/${accountId}/tokens`, options)).map(mapAccountOwnedAPIToken);
+}
+async function deleteAccountOwnedAPIToken(accountId, tokenId, options) {
+	return apiDelete(`/accounts/${accountId}/tokens/${tokenId}`, options);
+}
+async function rollAccountOwnedAPITokenValue(accountId, tokenId, options) {
+	return apiPut(`/accounts/${accountId}/tokens/${tokenId}/value`, {}, options);
+}
+async function createAccountOwnedAPIToken(accountId, options, clientOptions) {
+	const permissionGroupIds = dedupePermissionGroupIds(options.permissionGroups?.map((permissionGroup) => permissionGroup.id) ?? options.permissionGroupIds ?? []);
+	if (permissionGroupIds.length === 0) throw new Error("Cannot create a Devflare token without any permission groups");
+	if (permissionGroupIds.length > MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS) throw new Error(`Cannot create a Devflare token with more than ${MAX_ACCOUNT_OWNED_TOKEN_PERMISSION_GROUPS} permission groups.`);
+	const policies = options.permissionGroups ? buildCreateTokenPoliciesFromPermissionGroups(accountId, options.permissionGroups) : buildCreateTokenPoliciesFromPermissionGroupIds(accountId, permissionGroupIds);
+	if (policies.length === 0) throw new Error("Cannot create a Devflare token without any account- or zone-scoped permission groups");
+	return mapAccountOwnedAPIToken(await apiPost(`/accounts/${accountId}/tokens`, {
+		name: options.name,
+		policies
+	}, clientOptions));
+}
+//#endregion
+export { listAccountTokenPermissionGroups as a, selectAllReusablePermissionGroups as c, listAccountOwnedAPITokens as i, selectDevflarePermissionGroups as l, deleteAccountOwnedAPIToken as n, normalizeDevflareTokenName as o, filterDevflareManagedTokens as r, rollAccountOwnedAPITokenValue as s, createAccountOwnedAPIToken as t, stripDevflareTokenNamePrefix as u };