fastpass-cli 0.2.0 → 0.2.1

package/README.md

@@ -60,12 +60,9 @@ Options:
 
 ## Credentials
 
-fastpass needs Cloudflare API access. It checks, in order:
+fastpass needs a Cloudflare API token via the `CLOUDFLARE_API_TOKEN` environment variable.
 
-1. `CLOUDFLARE_API_TOKEN` environment variable
-2. Wrangler OAuth token from `~/.wrangler/config/default.toml` (from `npx wrangler login`)
-
-**Recommended:** Use an API token with:
+Create an API token with:
 
 - **Access: Organizations, Identity Providers, and Groups** — Edit
 - **Access: Apps and Policies** — Edit
@@ -80,8 +77,6 @@ export CLOUDFLARE_API_TOKEN="your-token"
 export CLOUDFLARE_ACCOUNT_ID="your-account-id"
 ```
 
-**Note:** Wrangler’s OAuth token typically does not include Access scopes. If `wrangler login` works for Workers but fastpass fails with permission errors, use a dedicated API token with the permissions above.
-
 **Logs:** The `logs` and `status` commands fetch access events. If they fail, your token may need **Access: Audit Logs** — Read.
 
 ## Prerequisites

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fastpass-cli",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Cloudflare Access in 60 seconds.",
   "type": "module",
   "bin": {

package/src/auth.js

@@ -1,36 +1,21 @@
-import { readFile } from 'node:fs/promises';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
 import pc from 'picocolors';
 import { spin } from './ui.js';
 
 /**
  * Resolve Cloudflare credentials.
  *
- * Priority:
- *  1. CLOUDFLARE_API_TOKEN env var
- *  2. Wrangler OAuth token from ~/.wrangler/config/default.toml
- *
- * Account ID:
- *  1. CLOUDFLARE_ACCOUNT_ID env var
- *  2. Fetched from /accounts API
+ * Token:    CLOUDFLARE_API_TOKEN env var
+ * Account:  CLOUDFLARE_ACCOUNT_ID env var, or fetched from /accounts API
  */
 export async function getCredentials() {
   const s = spin('Checking Cloudflare credentials');
 
-  let token = process.env.CLOUDFLARE_API_TOKEN;
-
-  if (!token) {
-    s.text = 'Checking Cloudflare credentials (trying wrangler)';
-    token = await tryWranglerToken();
-  }
+  const token = process.env.CLOUDFLARE_API_TOKEN;
 
   if (!token) {
     s.fail('No Cloudflare credentials found');
     console.error('');
-    console.error(`  ${pc.bold('How to fix — pick one:')}`);
-    console.error('');
-    console.error(`  ${pc.cyan('1.')} Set an API token (recommended):`);
+    console.error(`  ${pc.bold('Set an API token:')}`);
     console.error('');
     console.error(`     ${pc.bold('export CLOUDFLARE_API_TOKEN=<your-token>')}`);
     console.error('');
@@ -39,10 +24,6 @@ export async function getCredentials() {
     console.error(`       ${pc.dim('•')} Access: Organizations, Identity Providers, and Groups — Edit`);
     console.error(`       ${pc.dim('•')} Access: Apps and Policies — Edit`);
     console.error('');
-    console.error(`  ${pc.cyan('2.')} Log in with wrangler:`);
-    console.error('');
-    console.error(`     ${pc.bold('npx wrangler login')}`);
-    console.error('');
     process.exit(1);
   }
 
@@ -57,25 +38,6 @@ export async function getCredentials() {
   return { token, accountId };
 }
 
-async function tryWranglerToken() {
-  try {
-    const configPath = join(homedir(), '.wrangler', 'config', 'default.toml');
-    const content = await readFile(configPath, 'utf-8');
-    const match = content.match(/^oauth_token\s*=\s*"(.+)"/m);
-    if (match?.[1]) {
-      // Check if token is expired
-      const expMatch = content.match(/^expiration_time\s*=\s*"(.+)"/m);
-      if (expMatch?.[1] && new Date(expMatch[1]) < new Date()) {
-        return null; // expired
-      }
-      return match[1];
-    }
-  } catch {
-    // config file not found — wrangler not logged in
-  }
-  return null;
-}
-
 async function fetchAccountId(token) {
   const res = await fetch('https://api.cloudflare.com/client/v4/accounts?per_page=5', {
     headers: { Authorization: `Bearer ${token}` },

package/src/cli.js

@@ -15,7 +15,7 @@ export function run() {
   program
     .name('fastpass-cli')
     .description('Cloudflare Access in 60 seconds.')
-    .version('0.2.0');
+    .version('0.2.1');
 
   // Default action (no subcommand) — run the protect wizard
   program