fastpass-cli 0.2.1 → 0.2.3

package/README.md

@@ -1,6 +1,6 @@
 # fastpass
 
-A CLI for rapdily configuring [Cloudflare Access](https://www.cloudflare.com/products/zero-trust/access/) — add authentication to internal apps without touching your application code. Creates Access Applications, Identity Providers, and policies via the Cloudflare API.
+A CLI for rapidly configuring [Cloudflare Access](https://www.cloudflare.com/products/zero-trust/access/) — add authentication to internal apps without touching your application code. Creates Access Applications, Identity Providers, and policies via the Cloudflare API.
 
 **Requirements:** Node 18+, Cloudflare account with the domain on your account, Cloudflare Zero Trust (Access) enabled.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fastpass-cli",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Cloudflare Access in 60 seconds.",
   "type": "module",
   "bin": {

package/src/auth.js

@@ -35,6 +35,7 @@ export async function getCredentials() {
   }
 
   s.succeed('Credentials OK');
+  console.log('');
   return { token, accountId };
 }
 

package/src/cli.js

@@ -1,6 +1,10 @@
+import { createRequire } from 'node:module';
 import { Command } from 'commander';
 import pc from 'picocolors';
 import { getCredentials } from './auth.js';
+
+const require = createRequire(import.meta.url);
+const { version } = require('../package.json');
 import { createApi } from './api.js';
 import { protect } from './commands/protect.js';
 import { list } from './commands/list.js';
@@ -15,7 +19,7 @@ export function run() {
   program
     .name('fastpass-cli')
     .description('Cloudflare Access in 60 seconds.')
-    .version('0.2.1');
+    .version(version);
 
   // Default action (no subcommand) — run the protect wizard
   program
@@ -23,6 +27,7 @@ export function run() {
     .description('Protect a domain with Cloudflare Access')
     .option('--auth <method>', 'Auth method(s): email, github, google (comma-separated for multiple)')
     .option('--allow <rule>', 'Who can access: email, *@domain.com, or "everyone"')
+    .option('--hidden', 'Hide email addresses from terminal output')
     .action(async (domain, opts) => {
       printBanner();
       const creds = await getCredentials();

package/src/commands/protect.js

@@ -1,10 +1,10 @@
 import pc from 'picocolors';
-import { input, select } from '@inquirer/prompts';
+import { input, password, select, confirm } from '@inquirer/prompts';
 import { getTeamName } from '../auth.js';
 import { ensureEmailOtp } from '../idp/email-otp.js';
 import { ensureGitHub } from '../idp/github.js';
 import { ensureGoogle } from '../idp/google.js';
-import { handleApiError } from '../api.js';
+import { handleApiError, ApiError } from '../api.js';
 import { spin, withSpinner } from '../ui.js';
 
 const AUTH_CHOICES = {
@@ -33,6 +33,16 @@ export async function protect(api, opts = {}) {
 
     // Validate domain exists in CF
     await withSpinner('Verifying domain...', () => validateDomain(api, domain.trim()));
+    console.log('');
+
+    // Check if domain is already protected
+    const existing = await checkExistingApp(api, domain.trim());
+    if (existing) {
+      console.log(`\n  ${pc.yellow('This domain is already protected by Access.')}\n`);
+      console.log(`  Run ${pc.cyan(`fastpass inspect ${domain.trim()}`)} to view its configuration.`);
+      console.log(`  Run ${pc.cyan(`fastpass remove ${domain.trim()}`)} to remove it first.\n`);
+      return;
+    }
 
     // Parse auth methods: comma-separated string from CLI, or single interactive choice
     const authMethods = opts.auth
@@ -48,9 +58,11 @@ export async function protect(api, opts = {}) {
         process.exit(1);
       }
     }
+    console.log('');
 
     // Resolve who gets access
-    const { include, includeType } = await resolveAccess(opts.allow);
+    const { include, includeType } = await resolveAccess(opts.allow, opts.hidden);
+    console.log('');
 
     // Get team name for OAuth callback URLs
     const teamName = await withSpinner('Fetching team info', () => getTeamName(api));
@@ -71,6 +83,30 @@ export async function protect(api, opts = {}) {
     // Build the policy include rules
     const policyInclude = buildIncludeRules(include, includeType);
 
+    // Describe access for the summary
+    const accessLabel = (opts.hidden && includeType === 'emails')
+      ? pc.dim('(hidden)')
+      : describeAccess(include, includeType);
+
+    // Show confirmation summary (skip when all CLI flags provided)
+    const allFlagsProvided = opts.domain && opts.auth && opts.allow;
+    if (!allFlagsProvided) {
+      console.log(`  ${pc.bold('Domain:')}  ${domain.trim()}`);
+      console.log(`  ${pc.bold('Login:')}   ${authMethods.map((m) => AUTH_CHOICES[m].label.split(' (')[0]).join(', ')}`);
+      console.log(`  ${pc.bold('Access:')}  ${accessLabel}`);
+      console.log('');
+
+      const ok = await confirm({
+        message: 'Create this Access application?',
+        default: true,
+      });
+
+      if (!ok) {
+        console.log(pc.dim('  Cancelled.\n'));
+        return;
+      }
+    }
+
     // Create the access application with an inline policy
     const s = spin(`Creating Access application for ${pc.bold(domain.trim())}...`);
 
@@ -91,7 +127,20 @@ export async function protect(api, opts = {}) {
       ],
     };
 
-    const { result: app } = await api.post('/access/apps', appBody);
+    let app;
+    try {
+      const { result } = await api.post('/access/apps', appBody);
+      app = result;
+    } catch (err) {
+      s.fail(`Failed to create Access application for ${pc.bold(domain.trim())}`);
+      if (err instanceof ApiError && err.message.includes('application_already_exists')) {
+        console.log(`\n  ${pc.yellow('This domain is already protected by Access.')}\n`);
+        console.log(`  Run ${pc.cyan(`fastpass inspect ${domain.trim()}`)} to view its configuration.`);
+        console.log(`  Run ${pc.cyan(`fastpass remove ${domain.trim()}`)} to remove it first.\n`);
+        return;
+      }
+      throw err;
+    }
 
     s.succeed(`Protected ${pc.bold(domain.trim())}`);
     console.log('');
@@ -124,7 +173,7 @@ export async function validateDomain(api, domain) {
   }
 }
 
-export async function resolveAccess(allowFlag) {
+export async function resolveAccess(allowFlag, hidden) {
   // If --allow flag was passed, parse it
   if (allowFlag) {
     if (allowFlag.startsWith('*@')) {
@@ -140,6 +189,8 @@ export async function resolveAccess(allowFlag) {
     return { include: allowFlag.split(',').map((e) => e.trim()), includeType: 'emails' };
   }
 
+  const emailPrompt = hidden ? password : input;
+
   // Interactive
   const accessType = await select({
     message: 'Who should have access?',
@@ -148,7 +199,7 @@ export async function resolveAccess(allowFlag) {
 
   switch (accessType) {
     case 'me': {
-      const email = await input({
+      const email = await emailPrompt({
         message: 'Your email address:',
         validate: (v) => v.includes('@') || 'Enter a valid email',
       });
@@ -169,7 +220,7 @@ export async function resolveAccess(allowFlag) {
       return { include: [org.trim()], includeType: 'github_org' };
     }
     case 'emails': {
-      const emails = await input({
+      const emails = await emailPrompt({
         message: 'Email addresses (comma-separated):',
         validate: (v) => v.includes('@') || 'Enter at least one email',
       });
@@ -182,6 +233,36 @@ export async function resolveAccess(allowFlag) {
   }
 }
 
+export async function checkExistingApp(api, domain) {
+  const s = spin('Checking for existing application...');
+  try {
+    const { result } = await api.get('/access/apps');
+    const match = result?.find(
+      (app) => app.type === 'self_hosted' && app.domain === domain,
+    );
+    s.stop();
+    return match || null;
+  } catch {
+    s.stop();
+    return null;
+  }
+}
+
+function describeAccess(include, includeType) {
+  switch (includeType) {
+    case 'emails':
+      return include.join(', ');
+    case 'domain':
+      return `*@${include[0]}`;
+    case 'github_org':
+      return `GitHub org: ${include[0]}`;
+    case 'everyone':
+      return 'Everyone (any logged-in user)';
+    default:
+      return 'Everyone';
+  }
+}
+
 export function buildIncludeRules(include, includeType) {
   switch (includeType) {
     case 'emails':