pi-cloudflare 0.3.0 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +24 -10
- package/bin/setup.mjs +1 -5
- package/dist/auth-flow.d.ts +0 -1
- package/dist/auth-flow.d.ts.map +1 -1
- package/dist/auth-flow.js +0 -1
- package/dist/auth-flow.js.map +1 -1
- package/dist/config.d.ts +0 -6
- package/dist/config.d.ts.map +1 -1
- package/dist/config.js.map +1 -1
- package/dist/index.d.ts +19 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +27 -5
- package/dist/index.js.map +1 -1
- package/dist/oauth.d.ts +0 -1
- package/dist/oauth.d.ts.map +1 -1
- package/dist/oauth.js +0 -2
- package/dist/oauth.js.map +1 -1
- package/dist/token-store.d.ts +5 -1
- package/dist/token-store.d.ts.map +1 -1
- package/dist/token-store.js +10 -4
- package/dist/token-store.js.map +1 -1
- package/package.json +1 -1
- package/skills/cloudflare/SKILL.md +4 -0
- package/skills/cloudflare-api-token/SKILL.md +63 -0
- package/skills/cloudflare-auth-setup/SKILL.md +53 -0
- package/skills/cloudflare-token-roll/SKILL.md +34 -0
- package/skills/cloudflare-token-scopes/SKILL.md +32 -0
package/README.md
CHANGED
|
@@ -89,22 +89,36 @@ Two levers for longer-lived credentials:
|
|
|
89
89
|
```
|
|
90
90
|
|
|
91
91
|
Create one at dash.cloudflare.com → Manage Account → API Tokens with
|
|
92
|
-
the scopes your agents need
|
|
92
|
+
the scopes your agents need (exact template, additions, and account
|
|
93
|
+
scoping in `docs/api-token.md`). Other servers stay on browser OAuth.
|
|
93
94
|
|
|
94
|
-
2. **
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
{ "pi-cloudflare": { "oauthScope": "offline_access" } }
|
|
99
|
-
```
|
|
100
|
-
|
|
101
|
-
Or per re-auth: `pi-cloudflare-setup --only api --scope offline_access`.
|
|
102
|
-
If an issuer rejects the scope, drop it — support varies.
|
|
95
|
+
2. **Re-authenticate surgically.** Browser OAuth is the fallback for the
|
|
96
|
+
other four servers. Tested 2026-09-06: the issuers ignore `offline_access`
|
|
97
|
+
(a scoped approval returned the standard 1-hour access token), so there is
|
|
98
|
+
no scope knob — refresh behavior is set server-side.
|
|
103
99
|
|
|
104
100
|
Avoid re-running full setup on a schedule: each fresh approval can rotate
|
|
105
101
|
away tokens other sessions still hold. Re-authenticate single servers with
|
|
106
102
|
`--only` and only when told to.
|
|
107
103
|
|
|
104
|
+
## Wrangler CLI vs MCP tools
|
|
105
|
+
|
|
106
|
+
Both are first-class; pick per task. Credentials do not transfer: wrangler
|
|
107
|
+
bearers are recognized by MCP servers but scope-rejected (verified live),
|
|
108
|
+
so use each where it wins:
|
|
109
|
+
|
|
110
|
+
| Task | Use |
|
|
111
|
+
| -------------------------------------------- | ---------------------------------------------- |
|
|
112
|
+
| Deploys, `tail -f`, KV/R2/D1 CLIs, scripting | `wrangler` in bash (durable months-long login) |
|
|
113
|
+
| Endpoint discovery, docs search | `cf_api_search`, `cf_docs_*` |
|
|
114
|
+
| Typed CRUD on bindings with agent-shaped I/O | `cf_bindings_*` |
|
|
115
|
+
| Builds history, log exploration | `cf_builds_*`, `cf_obs_*` |
|
|
116
|
+
| Arbitrary API paths with static credentials | `cf_api_execute` + `apiToken` |
|
|
117
|
+
|
|
118
|
+
Wrangler's months-long session comes from its first-party OAuth grant; MCP
|
|
119
|
+
servers require their own per-server grants (verified: cross-use fails
|
|
120
|
+
closed on scope). They complement; neither replaces the other.
|
|
121
|
+
|
|
108
122
|
## Troubleshooting
|
|
109
123
|
|
|
110
124
|
| Symptom | Likely cause | Fix |
|
package/bin/setup.mjs
CHANGED
|
@@ -9,9 +9,6 @@
|
|
|
9
9
|
* pi-cloudflare-setup # authorize missing/expired servers
|
|
10
10
|
* pi-cloudflare-setup --only builds # re-auth specific servers
|
|
11
11
|
* pi-cloudflare-setup --only api,observability
|
|
12
|
-
* pi-cloudflare-setup --scope offline_access # request extra OAuth scope
|
|
13
|
-
*
|
|
14
|
-
* OAUTH_SCOPE env works like --scope.
|
|
15
12
|
*
|
|
16
13
|
* Nothing secret is ever logged or written anywhere else.
|
|
17
14
|
*/
|
|
@@ -43,7 +40,6 @@ function parseOnly() {
|
|
|
43
40
|
}
|
|
44
41
|
|
|
45
42
|
const only = parseOnly()
|
|
46
|
-
const scope = argValue('--scope') ?? process.env.OAUTH_SCOPE ?? undefined
|
|
47
43
|
const wanted = only ?? AUTHED_IDS
|
|
48
44
|
const file = readTokenFile() ?? { version: 1, servers: {} }
|
|
49
45
|
const { fresh, needed } = partitionServers(wanted, file.servers)
|
|
@@ -64,7 +60,7 @@ if (needed.length === 0) {
|
|
|
64
60
|
const definition = CLOUDFLARE_SERVERS.find((server) => server.id === id)
|
|
65
61
|
console.log(`[${index}/${needed.length}] Approving ${id} (${definition.url})...`)
|
|
66
62
|
try {
|
|
67
|
-
const { tokens, clientId, tokenEndpoint } = await runOAuthFlow(definition
|
|
63
|
+
const { tokens, clientId, tokenEndpoint } = await runOAuthFlow(definition)
|
|
68
64
|
file.servers[id] = { ...tokens, clientId, tokenEndpoint }
|
|
69
65
|
writeTokenFile(file.servers)
|
|
70
66
|
console.log(`[${index}/${needed.length}] ${id}: authorized and stored\n`)
|
package/dist/auth-flow.d.ts
CHANGED
package/dist/auth-flow.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth-flow.d.ts","sourceRoot":"","sources":["../src/auth-flow.ts"],"names":[],"mappings":"AAGA,OAAO,EAOL,KAAK,WAAW,EACjB,MAAM,YAAY,CAAA;AACnB,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAE9D,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,WAAW,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;CACtB;AAkDD;;;GAGG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,0BAA0B,EACtC,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,
|
|
1
|
+
{"version":3,"file":"auth-flow.d.ts","sourceRoot":"","sources":["../src/auth-flow.ts"],"names":[],"mappings":"AAGA,OAAO,EAOL,KAAK,WAAW,EACjB,MAAM,YAAY,CAAA;AACnB,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAE9D,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,WAAW,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;CACtB;AAkDD;;;GAGG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,0BAA0B,EACtC,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC,OAAO,CAAC,eAAe,CAAC,CA0C1B"}
|
package/dist/auth-flow.js
CHANGED
|
@@ -72,7 +72,6 @@ export async function runOAuthFlow(definition, options = {}) {
|
|
|
72
72
|
state,
|
|
73
73
|
challenge,
|
|
74
74
|
resource: definition.url,
|
|
75
|
-
scope: options.scope,
|
|
76
75
|
}));
|
|
77
76
|
const code = await waitForCallback(server, state, options.timeoutMs ?? 5 * 60_000);
|
|
78
77
|
const tokens = await exchangeCode({
|
package/dist/auth-flow.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth-flow.js","sourceRoot":"","sources":["../src/auth-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAA;AACnF,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAE1C,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,cAAc,GAEf,MAAM,YAAY,CAAA;AASnB,SAAS,eAAe,CACtB,MAAuC,EACvC,aAAqB,EACrB,SAAiB;IAEjB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,KAAK,EAAE,CAAA;YACd,MAAM,CAAC,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC,CAAA;QACzE,CAAC,EAAE,SAAS,CAAC,CAAA;QACb,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAwB,EAAE,QAAwB,EAAE,EAAE;YAC1E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAA;YAC3D,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAA;YACxD,QAAQ,CAAC,GAAG,CACV,yGAAyG,CAC1G,CAAA;YACD,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,MAAM,CAAC,KAAK,EAAE,CAAA;YACd,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;gBAC9D,OAAM;YACR,CAAC;YACD,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,aAAa,EAAE,CAAC;gBACpD,MAAM,CAAC,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC,CAAA;gBAC1E,OAAM;YACR,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAC3C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC,CAAA;gBACnD,OAAM;YACR,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACzC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAA;gBACvD,OAAM;YACR,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAA;QACf,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;IAClE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;IACvE,KAAK,CAAC,KAAK,EAAE,CAAA;IACb,OAAO,CAAC,GAAG,CAAC,6DAA6D,GAAG,IAAI,CAAC,CAAA;AACnF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,UAAsC,EACtC,
|
|
1
|
+
{"version":3,"file":"auth-flow.js","sourceRoot":"","sources":["../src/auth-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAA;AACnF,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAE1C,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,cAAc,GAEf,MAAM,YAAY,CAAA;AASnB,SAAS,eAAe,CACtB,MAAuC,EACvC,aAAqB,EACrB,SAAiB;IAEjB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,KAAK,EAAE,CAAA;YACd,MAAM,CAAC,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC,CAAA;QACzE,CAAC,EAAE,SAAS,CAAC,CAAA;QACb,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAwB,EAAE,QAAwB,EAAE,EAAE;YAC1E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAA;YAC3D,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAA;YACxD,QAAQ,CAAC,GAAG,CACV,yGAAyG,CAC1G,CAAA;YACD,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,MAAM,CAAC,KAAK,EAAE,CAAA;YACd,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;gBAC9D,OAAM;YACR,CAAC;YACD,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,aAAa,EAAE,CAAC;gBACpD,MAAM,CAAC,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC,CAAA;gBAC1E,OAAM;YACR,CAAC;YACD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAC3C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC,CAAA;gBACnD,OAAM;YACR,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACzC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAA;gBACvD,OAAM;YACR,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAA;QACf,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;IAClE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;IACvE,KAAK,CAAC,KAAK,EAAE,CAAA;IACb,OAAO,CAAC,GAAG,CAAC,6DAA6D,GAAG,IAAI,CAAC,CAAA;AACnF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,UAAsC,EACtC,UAAkC,EAAE;IAEpC,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;IACzD,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,CAAC,EAAE,uDAAuD,CAAC,CAAA;IAC1F,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,EAAE,CAAA;IAC7B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC5B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;IAChC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,CAAC,KAAK,EAAE,CAAA;QACd,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACtD,CAAC;IACD,MAAM,WAAW,GAAG,oBAAoB,OAAO,CAAC,IAAI,WAAW,CAAA;IAC/D,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,oBAAoB,EAAE,WAAW,CAAC,CAAA;QACrF,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,gBAAgB,EAAE,CAAA;QAClD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAA;QAC7B,WAAW,CACT,iBAAiB,CAAC;YAChB,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;YACrD,QAAQ;YACR,WAAW;YACX,KAAK;YACL,SAAS;YACT,QAAQ,EAAE,UAAU,CAAC,GAAG;SACzB,CAAC,CACH,CAAA;QACD,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;QAClF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;YAChC,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,QAAQ;YACR,IAAI;YACJ,WAAW;YACX,QAAQ;SACT,CAAC,CAAA;QACF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAA;IACpE,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,KAAK,EAAE,CAAA;IAChB,CAAC;AACH,CAAC"}
|
package/dist/config.d.ts
CHANGED
|
@@ -11,12 +11,6 @@ export interface PiCloudflareConfig {
|
|
|
11
11
|
* Other servers always use browser OAuth.
|
|
12
12
|
*/
|
|
13
13
|
apiToken?: string;
|
|
14
|
-
/**
|
|
15
|
-
* Extra OAuth scope requested at authorize time (e.g. `offline_access`)
|
|
16
|
-
* when the issuer honors it for longer-lived refresh tokens. Unset by
|
|
17
|
-
* default; unknown scopes are left for the issuer to ignore or reject.
|
|
18
|
-
*/
|
|
19
|
-
oauthScope?: string;
|
|
20
14
|
}
|
|
21
15
|
export interface ResolvedPiCloudflareConfig {
|
|
22
16
|
enabledServerIds: CloudflareServerId[];
|
package/dist/config.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAGtD,MAAM,WAAW,kBAAkB;IACjC,iEAAiE;IACjE,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAA;IACtD,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;
|
|
1
|
+
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAGtD,MAAM,WAAW,kBAAkB;IACjC,iEAAiE;IACjE,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC,CAAA;IACtD,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,0BAA0B;IACzC,gBAAgB,EAAE,kBAAkB,EAAE,CAAA;IACtC,gBAAgB,EAAE,MAAM,CAAA;CACzB;AAID,wBAAgB,aAAa,CAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,GAAG,0BAA0B,CAQhG"}
|
package/dist/config.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;
|
|
1
|
+
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAqBjD,MAAM,0BAA0B,GAAG,MAAM,CAAA;AAEzC,MAAM,UAAU,aAAa,CAAC,MAAsC;IAClE,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,CAC3E,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,KAAK,KAAK,CACxC,CAAA;IACD,OAAO;QACL,gBAAgB;QAChB,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,IAAI,0BAA0B;KACzE,CAAA;AACH,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -1,3 +1,6 @@
|
|
|
1
|
+
import { type ServerConnection } from './client.js';
|
|
2
|
+
import { type CloudflareServerDefinition } from './servers.js';
|
|
3
|
+
import { type StoredServerTokens } from './token-store.js';
|
|
1
4
|
interface PiToolDefinition {
|
|
2
5
|
name: string;
|
|
3
6
|
label?: string;
|
|
@@ -9,10 +12,26 @@ interface PiHost {
|
|
|
9
12
|
registerTool: (definition: PiToolDefinition) => void;
|
|
10
13
|
on: (event: 'session_start' | 'session_shutdown', handler: (...args: never[]) => unknown) => void;
|
|
11
14
|
}
|
|
15
|
+
interface ServerEntry {
|
|
16
|
+
definition: CloudflareServerDefinition;
|
|
17
|
+
connection?: ServerConnection;
|
|
18
|
+
stored?: StoredServerTokens;
|
|
19
|
+
/** Static bearer token (api server only): never expires, never refreshes. */
|
|
20
|
+
staticToken?: string;
|
|
21
|
+
timeoutMs: number;
|
|
22
|
+
/** Access token the live connection was built with; drift triggers reconnect. */
|
|
23
|
+
connectedToken?: string;
|
|
24
|
+
}
|
|
12
25
|
/** Exact command that re-authorizes one server; shown to agents, never guessed. */
|
|
13
26
|
export declare function reauthHint(serverId: string): string;
|
|
14
27
|
/** True when a failure smells like rejected credentials rather than a broken server. */
|
|
15
28
|
export declare function isAuthFailure(error: unknown): boolean;
|
|
29
|
+
/**
|
|
30
|
+
* Adopt rotations performed by sibling sessions: parallel Pi processes
|
|
31
|
+
* share one token file, and refresh grants are single-use. If the file
|
|
32
|
+
* holds a different grant than memory, the file wins without network I/O.
|
|
33
|
+
*/
|
|
34
|
+
export declare function syncFromFile(entry: ServerEntry, home?: string): void;
|
|
16
35
|
/**
|
|
17
36
|
* pi-coding-agent extension entry point.
|
|
18
37
|
*
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAiB,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAIlE,OAAO,EAAsB,KAAK,0BAA0B,EAAE,MAAM,cAAc,CAAA;AAClF,OAAO,EAA4C,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAEpG,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,OAAO,EAAE,CACP,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC,OAAO,CAAC,CAAA;CACtB;AAED,UAAU,MAAM;IACd,YAAY,EAAE,CAAC,UAAU,EAAE,gBAAgB,KAAK,IAAI,CAAA;IACpD,EAAE,EAAE,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,KAAK,IAAI,CAAA;CAClG;AAMD,UAAU,WAAW;IACnB,UAAU,EAAE,0BAA0B,CAAA;IACtC,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,MAAM,CAAC,EAAE,kBAAkB,CAAA;IAC3B,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,iFAAiF;IACjF,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AA4CD,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQnD;AAED,wFAAwF;AACxF,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAKrD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAKpE;AAmCD;;;;;;;;;GASG;AACH,MAAM,CAAC,OAAO,UAAU,qBAAqB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAwF9D"}
|
package/dist/index.js
CHANGED
|
@@ -10,10 +10,12 @@ import { CLOUDFLARE_SERVERS } from './servers.js';
|
|
|
10
10
|
import { isExpired, readTokenFile, writeTokenFile } from './token-store.js';
|
|
11
11
|
async function reconnect(entry) {
|
|
12
12
|
await entry.connection?.close().catch(() => undefined);
|
|
13
|
+
const token = entry.staticToken ?? entry.stored?.accessToken;
|
|
13
14
|
entry.connection = await connectServer(entry.definition, {
|
|
14
|
-
apiToken:
|
|
15
|
+
apiToken: token,
|
|
15
16
|
timeoutMs: entry.timeoutMs,
|
|
16
17
|
});
|
|
18
|
+
entry.connectedToken = token;
|
|
17
19
|
}
|
|
18
20
|
function expandEnvVars(value) {
|
|
19
21
|
if (typeof value === 'string') {
|
|
@@ -48,16 +50,30 @@ function warn(message) {
|
|
|
48
50
|
/** Exact command that re-authorizes one server; shown to agents, never guessed. */
|
|
49
51
|
export function reauthHint(serverId) {
|
|
50
52
|
return (`${serverId} needs re-authentication (token expired, revoked, or never granted). ` +
|
|
51
|
-
`
|
|
52
|
-
`npx -p pi-cloudflare pi-cloudflare-setup --only ${serverId}`
|
|
53
|
+
`For temporary access, run in a terminal (approve in the browser when it opens): ` +
|
|
54
|
+
`npx -p pi-cloudflare pi-cloudflare-setup --only ${serverId}. ` +
|
|
55
|
+
`For persistent access across sessions, create an API token instead — ` +
|
|
56
|
+
`see the cloudflare-auth-setup skill (it asks once, then sets up either path).`);
|
|
53
57
|
}
|
|
54
58
|
/** True when a failure smells like rejected credentials rather than a broken server. */
|
|
55
59
|
export function isAuthFailure(error) {
|
|
56
60
|
const message = error instanceof Error ? error.message : String(error);
|
|
57
61
|
return /\b401\b|\b403\b|unauthorized|invalid_token|invalid_grant|token refresh failed|expired|forbidden|authenticate/i.test(message);
|
|
58
62
|
}
|
|
63
|
+
/**
|
|
64
|
+
* Adopt rotations performed by sibling sessions: parallel Pi processes
|
|
65
|
+
* share one token file, and refresh grants are single-use. If the file
|
|
66
|
+
* holds a different grant than memory, the file wins without network I/O.
|
|
67
|
+
*/
|
|
68
|
+
export function syncFromFile(entry, home) {
|
|
69
|
+
const latest = readTokenFile(home)?.servers[entry.definition.id];
|
|
70
|
+
if (latest && latest.refreshToken !== entry.stored?.refreshToken) {
|
|
71
|
+
entry.stored = latest;
|
|
72
|
+
}
|
|
73
|
+
}
|
|
59
74
|
/** Refresh unconditionally (caller decided the token is rejected). Persists and reconnects. */
|
|
60
75
|
async function refreshNow(entry) {
|
|
76
|
+
syncFromFile(entry);
|
|
61
77
|
const stored = entry.stored;
|
|
62
78
|
if (!stored?.refreshToken)
|
|
63
79
|
throw new Error(`${entry.definition.id}: no refresh token stored`);
|
|
@@ -76,11 +92,16 @@ async function refreshNow(entry) {
|
|
|
76
92
|
async function ensureFreshToken(entry) {
|
|
77
93
|
if (entry.staticToken)
|
|
78
94
|
return entry.staticToken;
|
|
95
|
+
syncFromFile(entry);
|
|
79
96
|
const stored = entry.stored;
|
|
80
97
|
if (!stored)
|
|
81
98
|
return undefined;
|
|
82
|
-
if (!isExpired(stored) || !stored.refreshToken)
|
|
99
|
+
if (!isExpired(stored) || !stored.refreshToken) {
|
|
100
|
+
if (!entry.connection || entry.connectedToken !== stored.accessToken) {
|
|
101
|
+
await reconnect(entry);
|
|
102
|
+
}
|
|
83
103
|
return stored.accessToken;
|
|
104
|
+
}
|
|
84
105
|
await refreshNow(entry);
|
|
85
106
|
return entry.stored?.accessToken;
|
|
86
107
|
}
|
|
@@ -114,7 +135,8 @@ export default function piCloudflareExtension(pi) {
|
|
|
114
135
|
try {
|
|
115
136
|
entry.stored = file?.servers[definition.id];
|
|
116
137
|
await ensureFreshToken(entry);
|
|
117
|
-
|
|
138
|
+
if (!entry.connection)
|
|
139
|
+
await reconnect(entry);
|
|
118
140
|
const tools = (await entry.connection?.listTools()) ?? [];
|
|
119
141
|
const registrations = buildAllRegistrations([
|
|
120
142
|
{
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAA;AAE9B,OAAO,EAAE,aAAa,EAAyB,MAAM,aAAa,CAAA;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,aAAa,EAA2B,MAAM,aAAa,CAAA;AACpE,OAAO,EAAE,qBAAqB,EAAyB,MAAM,YAAY,CAAA;AACzE,OAAO,EAAE,kBAAkB,EAAmC,MAAM,cAAc,CAAA;AAClF,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,EAA2B,MAAM,kBAAkB,CAAA;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAA;AAE9B,OAAO,EAAE,aAAa,EAAyB,MAAM,aAAa,CAAA;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAAE,aAAa,EAA2B,MAAM,aAAa,CAAA;AACpE,OAAO,EAAE,qBAAqB,EAAyB,MAAM,YAAY,CAAA;AACzE,OAAO,EAAE,kBAAkB,EAAmC,MAAM,cAAc,CAAA;AAClF,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,EAA2B,MAAM,kBAAkB,CAAA;AAkCpG,KAAK,UAAU,SAAS,CAAC,KAAkB;IACzC,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IACtD,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,EAAE,WAAW,CAAA;IAC5D,KAAK,CAAC,UAAU,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE;QACvD,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC,CAAA;IACF,KAAK,CAAC,cAAc,GAAG,KAAK,CAAA;AAC9B,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE;YAC9D,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACxC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7C,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IACzD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CACzE,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAA;QAClF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAA;QAChD,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC,CAAA;QACvC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QAC7D,OAAO,aAAa,CAAC,OAAO,CAAuB,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,OAAe;IAC3B,OAAO,CAAC,IAAI,CAAC,mBAAmB,OAAO,EAAE,CAAC,CAAA;AAC5C,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,OAAO,CACL,GAAG,QAAQ,uEAAuE;QAClF,kFAAkF;QAClF,mDAAmD,QAAQ,IAAI;QAC/D,uEAAuE;QACvE,+EAA+E,CAChF,CAAA;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACtE,OAAO,+GAA+G,CAAC,IAAI,CACzH,OAAO,CACR,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAkB,EAAE,IAAa;IAC5D,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;IAChE,IAAI,MAAM,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC;QACjE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAA;IACvB,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,KAAK,UAAU,UAAU,CAAC,KAAkB;IAC1C,YAAY,CAAC,KAAK,CAAC,CAAA;IACnB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC3B,IAAI,CAAC,MAAM,EAAE,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,EAAE,2BAA2B,CAAC,CAAA;IAC7F,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC;QACrC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY;KAClC,CAAC,CAAA;IACF,KAAK,CAAC,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IACtC,MAAM,IAAI,GAAG,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,CAAU,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IACpE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAA;IAChD,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC5B,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;AACxB,CAAC;AAED,gHAAgH;AAChH,KAAK,UAAU,gBAAgB,CAAC,KAAkB;IAChD,IAAI,KAAK,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC,WAAW,CAAA;IAC/C,YAAY,CAAC,KAAK,CAAC,CAAA;IACnB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC3B,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,cAAc,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;YACrE,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;QACxB,CAAC;QACD,OAAO,MAAM,CAAC,WAAW,CAAA;IAC3B,CAAC;IACD,MAAM,UAAU,CAAC,KAAK,CAAC,CAAA;IACvB,OAAO,KAAK,CAAC,MAAM,EAAE,WAAW,CAAA;AAClC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,OAAO,UAAU,qBAAqB,CAAC,EAAU;IACtD,IAAI,OAAO,GAAkB,EAAE,CAAA;IAE/B,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE;QAChC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACxD,CAAC;QACD,OAAO,GAAG,EAAE,CAAA;QACZ,MAAM,UAAU,GAAG,cAAc,EAAE,IAAI,EAAE,CAAA;QACzC,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,CAAA;QACxC,MAAM,IAAI,GAAG,aAAa,EAAE,CAAA;QAC5B,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CACvD,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAC5C,CAAA;QACD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,KAAK,GAAgB;gBACzB,UAAU;gBACV,SAAS,EAAE,MAAM,CAAC,gBAAgB;gBAClC,WAAW,EAAE,UAAU,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;aACvE,CAAA;YACD,IAAI,CAAC;gBACH,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;gBAC3C,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAA;gBAC7B,IAAI,CAAC,KAAK,CAAC,UAAU;oBAAE,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;gBAC7C,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,CAAA;gBACzD,MAAM,aAAa,GAAuB,qBAAqB,CAAC;oBAC9D;wBACE,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,KAAK;wBACL,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;4BAC/B,IAAI,CAAC,KAAK,CAAC,UAAU;gCAAE,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,CAAC,EAAE,iBAAiB,CAAC,CAAA;4BACzE,OAAO,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;wBAChD,CAAC;qBACF;iBACF,CAAC,CAAA;gBACF,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;oBACzC,EAAE,CAAC,YAAY,CAAC;wBACd,GAAG,YAAY;wBACf,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;4BAC5C,MAAM,gBAAgB,CAAC,KAAK,CAAC,CAAA;4BAC7B,IAAI,CAAC;gCACH,OAAO,MAAM,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;4BAC/D,CAAC;4BAAC,OAAO,KAAK,EAAE,CAAC;gCACf,2DAA2D;gCAC3D,0DAA0D;gCAC1D,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC;oCAC9E,MAAM,KAAK,CAAA;gCACb,CAAC;gCACD,IAAI,CAAC;oCACH,MAAM,UAAU,CAAC,KAAK,CAAC,CAAA;oCACvB,OAAO,MAAM,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;gCAC/D,CAAC;gCAAC,MAAM,CAAC;oCACP,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;oCACrE,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,CAAC,EAAE,uBAAuB,MAAM,MAAM,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAC/E,CAAA;gCACH,CAAC;4BACH,CAAC;wBACH,CAAC;qBACF,CAAC,CAAA;gBACJ,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACrB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CACF,GAAG,UAAU,CAAC,EAAE,kBAAkB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAC7F,CAAA;gBACD,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzB,kEAAkE;oBAClE,EAAE,CAAC,YAAY,CAAC;wBACd,IAAI,EAAE,GAAG,UAAU,CAAC,MAAM,gBAAgB;wBAC1C,KAAK,EAAE,GAAG,UAAU,CAAC,MAAM,gBAAgB;wBAC3C,WAAW,EAAE,GAAG,UAAU,CAAC,EAAE,iFAAiF;wBAC9G,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;wBAC3B,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;4BACpB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC;yBAC7D,CAAC;qBACH,CAAC,CAAA;oBACF,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;gBACjC,CAAC;gBACD,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACxD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,EAAE,CAAC,kBAAkB,EAAE,KAAK,IAAI,EAAE;QACnC,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;QAC3F,OAAO,GAAG,EAAE,CAAA;IACd,CAAC,CAAC,CAAA;AACJ,CAAC"}
|
package/dist/oauth.d.ts
CHANGED
package/dist/oauth.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,qBAAqB,EAAE,MAAM,CAAA;IAC7B,aAAa,EAAE,MAAM,CAAA;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;CAClB;AAUD,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,gBAAgB,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAG1E;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAUD,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAmCrF;AAED,wBAAsB,cAAc,CAClC,oBAAoB,EAAE,MAAM,EAC5B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,CAAC,CAiB3B;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE;IACzC,qBAAqB,EAAE,MAAM,CAAA;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;
|
|
1
|
+
{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,qBAAqB,EAAE,MAAM,CAAA;IAC7B,aAAa,EAAE,MAAM,CAAA;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;CAClB;AAUD,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,gBAAgB,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAG1E;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAUD,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAmCrF;AAED,wBAAsB,cAAc,CAClC,oBAAoB,EAAE,MAAM,EAC5B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,gBAAgB,CAAC,CAiB3B;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE;IACzC,qBAAqB,EAAE,MAAM,CAAA;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,MAAM,CAWT;AAED,wBAAsB,YAAY,CAAC,OAAO,EAAE;IAC1C,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG,OAAO,CAAC,WAAW,CAAC,CAiBvB;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,aAAa,EAAE,MAAM,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBvB"}
|
package/dist/oauth.js
CHANGED
|
@@ -80,8 +80,6 @@ export function buildAuthorizeUrl(options) {
|
|
|
80
80
|
state: options.state,
|
|
81
81
|
resource: options.resource,
|
|
82
82
|
});
|
|
83
|
-
if (options.scope)
|
|
84
|
-
params.set('scope', options.scope);
|
|
85
83
|
return `${options.authorizationEndpoint}?${params.toString()}`;
|
|
86
84
|
}
|
|
87
85
|
export async function exchangeCode(options) {
|
package/dist/oauth.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAoBrD,SAAS,SAAS,CAAC,KAA0B;IAC3C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACtB,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACvB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AAClE,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;IAC3C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAA;AAC5D,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;AACnC,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAW;IAClC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;IAC9E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,OAAO,GAAG,gBAAgB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IAC9D,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAA;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc;IACrD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;QACpC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;KAChE,CAAC,CAAA;IACF,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,SAAS,SAAS,CAAC,MAAM,EAAE,CAAC,CAAA;IACxF,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAA;IAC/D,MAAM,WAAW,GAAG,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACpE,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,EAAE,CAAC,CAAA;IACjF,MAAM,QAAQ,GAAG,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,CAG7C,CAAA;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,CAAA;IAClD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,EAAE,CAAC,CAAA;IAC/E,MAAM,QAAQ,GAAG,CAAC,MAAM,SAAS,CAC/B,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,yCAAyC,CACtE,CAKA,CAAA;IACD,IAAI,CAAC,QAAQ,CAAC,sBAAsB,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,EAAE,CAAC,CAAA;IAC7D,CAAC;IACD,OAAO;QACL,MAAM;QACN,qBAAqB,EAAE,QAAQ,CAAC,sBAAsB;QACtD,aAAa,EAAE,QAAQ,CAAC,cAAc;QACtC,oBAAoB,EAAE,QAAQ,CAAC,qBAAqB;KACrD,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,oBAA4B,EAC5B,WAAmB;IAEnB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,oBAAoB,EAAE;QACjD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,aAAa,EAAE,CAAC,WAAW,CAAC;YAC5B,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,0BAA0B,EAAE,MAAM;YAClC,WAAW,EAAE,eAAe;SAC7B,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAA;IAC9D,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC9E,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,oBAAoB,EAAE,CAAA;AAC1E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,
|
|
1
|
+
{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAoBrD,SAAS,SAAS,CAAC,KAA0B;IAC3C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACtB,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACvB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;AAClE,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;IAC3C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAA;AAC5D,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;AACnC,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAW;IAClC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAA;IAC9E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,OAAO,GAAG,gBAAgB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IAC9D,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAA;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAc;IACrD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;QACpC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;KAChE,CAAC,CAAA;IACF,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,SAAS,SAAS,CAAC,MAAM,EAAE,CAAC,CAAA;IACxF,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAA;IAC/D,MAAM,WAAW,GAAG,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACpE,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,EAAE,CAAC,CAAA;IACjF,MAAM,QAAQ,GAAG,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,CAG7C,CAAA;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,CAAA;IAClD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,EAAE,CAAC,CAAA;IAC/E,MAAM,QAAQ,GAAG,CAAC,MAAM,SAAS,CAC/B,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,yCAAyC,CACtE,CAKA,CAAA;IACD,IAAI,CAAC,QAAQ,CAAC,sBAAsB,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,EAAE,CAAC,CAAA;IAC7D,CAAC;IACD,OAAO;QACL,MAAM;QACN,qBAAqB,EAAE,QAAQ,CAAC,sBAAsB;QACtD,aAAa,EAAE,QAAQ,CAAC,cAAc;QACtC,oBAAoB,EAAE,QAAQ,CAAC,qBAAqB;KACrD,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,oBAA4B,EAC5B,WAAmB;IAEnB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,oBAAoB,EAAE;QACjD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,aAAa,EAAE,CAAC,WAAW,CAAC;YAC5B,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,0BAA0B,EAAE,MAAM;YAClC,WAAW,EAAE,eAAe;SAC7B,CAAC;KACH,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IACvE,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAA;IAC9D,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAC9E,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,oBAAoB,EAAE,CAAA;AAC1E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAOjC;IACC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,cAAc,EAAE,OAAO,CAAC,SAAS;QACjC,qBAAqB,EAAE,MAAM;QAC7B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAA;IACF,OAAO,GAAG,OAAO,CAAC,qBAAqB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAA;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAMlC;IACC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,YAAY,EAAE,OAAO,CAAC,WAAW;QACjC,aAAa,EAAE,OAAO,CAAC,QAAQ;KAChC,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE;QAClD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IAClE,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAIxC;IACC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,eAAe;QAC3B,SAAS,EAAE,OAAO,CAAC,QAAQ;QAC3B,aAAa,EAAE,OAAO,CAAC,YAAY;KACpC,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE;QAClD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;IAChD,OAAO;QACL,GAAG,MAAM;QACT,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY;KAC1D,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAa;IAC/B,MAAM,MAAM,GAAG,IAAiF,CAAA;IAChG,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;IACvD,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAA;IACjF,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,YAAY,EAAE,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;QACzF,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI;KAC1D,CAAA;AACH,CAAC"}
|
package/dist/token-store.d.ts
CHANGED
|
@@ -11,7 +11,11 @@ interface TokenFile {
|
|
|
11
11
|
export declare function tokenFilePath(home?: string): string;
|
|
12
12
|
/** Read stored per-server OAuth tokens. Missing file means not authenticated. */
|
|
13
13
|
export declare function readTokenFile(home?: string): TokenFile | undefined;
|
|
14
|
-
/**
|
|
14
|
+
/**
|
|
15
|
+
* Persist per-server tokens with owner-only permissions. Never logs values.
|
|
16
|
+
* Writes atomically (temp file plus rename) so concurrent Pi sessions
|
|
17
|
+
* cannot interleave partial writes into a corrupt token file.
|
|
18
|
+
*/
|
|
15
19
|
export declare function writeTokenFile(servers: Partial<Record<CloudflareServerId, StoredServerTokens>>, home?: string): void;
|
|
16
20
|
export declare function isExpired(tokens: Pick<OAuthTokens, 'expiresAt'>, skewMs?: number): boolean;
|
|
17
21
|
/** Split server ids into fresh (skip) vs needing approval. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,MAAM,WAAW,kBAAmB,SAAQ,WAAW;IACrD,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,UAAU,SAAS;IACjB,OAAO,EAAE,CAAC,CAAA;IACV,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,CAAA;CACjE;AAED,wBAAgB,aAAa,CAAC,IAAI,SAAY,GAAG,MAAM,CAEtD;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,IAAI,SAAY,GAAG,SAAS,GAAG,SAAS,CAUrE;AAED
|
|
1
|
+
{"version":3,"file":"token-store.d.ts","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,MAAM,WAAW,kBAAmB,SAAQ,WAAW;IACrD,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,UAAU,SAAS;IACjB,OAAO,EAAE,CAAC,CAAA;IACV,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,CAAA;CACjE;AAED,wBAAgB,aAAa,CAAC,IAAI,SAAY,GAAG,MAAM,CAEtD;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,IAAI,SAAY,GAAG,SAAS,GAAG,SAAS,CAUrE;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,EAChE,IAAI,SAAY,GACf,IAAI,CASN;AAED,wBAAgB,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,MAAM,SAAS,GAAG,OAAO,CAE1F;AAED,8DAA8D;AAC9D,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,kBAAkB,EAAE,EACzB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC,GAAG,SAAS,GAC1E;IAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAAC,MAAM,EAAE,kBAAkB,EAAE,CAAA;CAAE,CAS/D"}
|
package/dist/token-store.js
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
|
|
1
|
+
import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
|
|
2
2
|
import { homedir } from 'node:os';
|
|
3
3
|
import { join } from 'node:path';
|
|
4
4
|
export function tokenFilePath(home = homedir()) {
|
|
@@ -19,14 +19,20 @@ export function readTokenFile(home = homedir()) {
|
|
|
19
19
|
return undefined;
|
|
20
20
|
}
|
|
21
21
|
}
|
|
22
|
-
/**
|
|
22
|
+
/**
|
|
23
|
+
* Persist per-server tokens with owner-only permissions. Never logs values.
|
|
24
|
+
* Writes atomically (temp file plus rename) so concurrent Pi sessions
|
|
25
|
+
* cannot interleave partial writes into a corrupt token file.
|
|
26
|
+
*/
|
|
23
27
|
export function writeTokenFile(servers, home = homedir()) {
|
|
24
28
|
const path = tokenFilePath(home);
|
|
25
29
|
mkdirSync(join(home, '.pi'), { recursive: true });
|
|
26
|
-
|
|
30
|
+
const tmp = `${path}.${process.pid}.tmp`;
|
|
31
|
+
writeFileSync(tmp, JSON.stringify({ version: 1, servers }, null, 2) + '\n', {
|
|
27
32
|
mode: 0o600,
|
|
28
33
|
});
|
|
29
|
-
chmodSync(
|
|
34
|
+
chmodSync(tmp, 0o600);
|
|
35
|
+
renameSync(tmp, path);
|
|
30
36
|
}
|
|
31
37
|
export function isExpired(tokens, skewMs = 30_000) {
|
|
32
38
|
return Date.now() + skewMs >= tokens.expiresAt;
|
package/dist/token-store.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;
|
|
1
|
+
{"version":3,"file":"token-store.js","sourceRoot":"","sources":["../src/token-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACnG,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAehC,MAAM,UAAU,aAAa,CAAC,IAAI,GAAG,OAAO,EAAE;IAC5C,OAAO,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,wBAAwB,CAAC,CAAA;AACpD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,IAAI,GAAG,OAAO,EAAE;IAC5C,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAc,CAAA;QAClE,IAAI,MAAM,EAAE,OAAO,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QACjF,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAgE,EAChE,IAAI,GAAG,OAAO,EAAE;IAEhB,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAChC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACjD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAA;IACxC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;QAC1E,IAAI,EAAE,KAAK;KACZ,CAAC,CAAA;IACF,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACrB,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;AACvB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,MAAsC,EAAE,MAAM,GAAG,MAAM;IAC/E,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,SAAS,CAAA;AAChD,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,gBAAgB,CAC9B,GAAyB,EACzB,MAA2E;IAE3E,MAAM,KAAK,GAAyB,EAAE,CAAA;IACtC,MAAM,MAAM,GAAyB,EAAE,CAAA;IACvC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;QAC1B,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;;YACzC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACtB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;AAC1B,CAAC"}
|
package/package.json
CHANGED
|
@@ -28,6 +28,10 @@ Fetch the **latest** information before citing specific numbers, API signatures,
|
|
|
28
28
|
|
|
29
29
|
When a reference file and the docs disagree, **trust the docs**. This is especially important for: numeric limits, pricing tiers, type signatures, and configuration options.
|
|
30
30
|
|
|
31
|
+
## Authentication First
|
|
32
|
+
|
|
33
|
+
Before any Cloudflare task, load the **cloudflare-auth-setup** skill when auth is unknown, expired, or rejected. It triages state (API token → OAuth → unauthenticated), asks the user once to choose persistent token vs temporary OAuth, adapts to environments with or without browser automation, and proves access before the real task. Token lifecycle details live in **cloudflare-api-token** (create), **cloudflare-token-roll** (lost/leaked secret), and **cloudflare-token-scopes** (add/remove groups).
|
|
34
|
+
|
|
31
35
|
## Quick Decision Trees
|
|
32
36
|
|
|
33
37
|
### "I need feature flags"
|
|
@@ -0,0 +1,63 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: cloudflare-api-token
|
|
3
|
+
description: Create, scope, verify, and rotate Cloudflare dashboard API tokens for agents. Use when a task needs a long-lived token with specific permission groups, when extending token scope for new tools, or when agents report 403s that name a missing permission group. Covers the UI builder flow, the same-origin API fast path, and secret hygiene.
|
|
4
|
+
---
|
|
5
|
+
|
|
6
|
+
# Cloudflare API Token Creation
|
|
7
|
+
|
|
8
|
+
OAuth tokens cannot mint API tokens (audience-bound — verified `400`), so this is a dashboard flow. See also `docs/api-token.md` for the standing permission table.
|
|
9
|
+
|
|
10
|
+
## Session setup (non-negotiable)
|
|
11
|
+
|
|
12
|
+
- Persistent browser, **headed**. `dash.cloudflare.com` serves an interactive Turnstile challenge to headless sessions even with a valid login — do not attempt this fresh or headless.
|
|
13
|
+
- Confirm the Cloudflare login is live first (dashboard home renders, not a challenge or login wall). If not, run the headed auth flow and have the human sign in before touching the builder.
|
|
14
|
+
|
|
15
|
+
## The rule that runs the whole flow
|
|
16
|
+
|
|
17
|
+
Every permission row has **three** dropdowns: scope | permission | **level**. A row with an unset level stays invalid (`Choose a permission`), and an invalid row blocks everything downstream — no further rows, no summary. **Complete all three dropdowns on each row and verify the commit in a fresh snapshot before moving to the next row.** Never batch assumed successes.
|
|
18
|
+
|
|
19
|
+
- UI `Edit` = API `Write`. UI `Read` = API `Read`.
|
|
20
|
+
- Commit check per row: snapshot shows `value="<Group>"`, the level shows `Edit`/`Read` (not `Select...`), and no error text sits under the row.
|
|
21
|
+
|
|
22
|
+
## UI fast path (batched, not step-verified)
|
|
23
|
+
|
|
24
|
+
Move fast row by row. One snapshot per row to learn its uids, then drive its controls without re-reading until the row is done. Each permission is four quick steps:
|
|
25
|
+
|
|
26
|
+
1. Click **Add more** (fresh uid — rows shift uids on every structural change).
|
|
27
|
+
2. Scope: leave `Account` unless the task needs otherwise.
|
|
28
|
+
3. Permission box: click it, `type_text` to filter, ArrowDown + Enter to commit. Trusted keystrokes commit reliably; synthetic DOM clicks can look committed (`value=` set) while leaving the row invalid — prefer keystrokes.
|
|
29
|
+
4. Level box: click its combobox, ArrowDown + Enter on Edit/Read. UI `Edit` = API `Write`.
|
|
30
|
+
|
|
31
|
+
Do not snapshot between steps 1–4. Piggyback verification for free: the next row's snapshot shows the previous row's committed state — glance at it while grabbing the next row's uids. If a level menu opens empty, that row's permission did **not** really commit — redo its step 3 on the spot, then resume speed.
|
|
32
|
+
|
|
33
|
+
Then, once, at the end:
|
|
34
|
+
|
|
35
|
+
5. Account Resources: Include + every managed account. Zone Resources: include (needed for Workers Routes). Leave Client IP filtering off and TTL unset unless the task says otherwise.
|
|
36
|
+
6. Screenshot the whole builder and **read back every row** (scope + permission + level). Missing or `Select...` rows get added/fixed now, before proceeding — never after Create.
|
|
37
|
+
7. Continue to summary → confirm the summary matches the read-back → Create.
|
|
38
|
+
8. The secret is shown **once**. A later GET never returns it — capture immediately (roll skill covers recovery).
|
|
39
|
+
|
|
40
|
+
Hiccup protocol: on any failure (stale uid, empty menu, vanished row), take one screenshot plus one fresh snapshot, resolve from what you actually see, and continue. Never retry-loop blindly, and never batch assumed successes across a failure — re-verify that row, then resume speed.
|
|
41
|
+
|
|
42
|
+
## API fast path (when the UI fights)
|
|
43
|
+
|
|
44
|
+
Same-origin `/api/v4/*` in page context carries the session:
|
|
45
|
+
|
|
46
|
+
- `GET /api/v4/user/tokens/permission_groups?per_page=100` — resolve every group by exact name first (`D1 Write`, not `D1 Edit`). All ~400 come back in one page.
|
|
47
|
+
- Mirror an existing token's policy split (`GET /api/v4/user/tokens`): zone-scoped groups under `com.cloudflare.api.account.zone.*`, user groups under `com.cloudflare.api.user.<id>`, account groups per account id (or the account wildcard). A single policy mixing scopes fails with `Failed common permission check`.
|
|
48
|
+
- `POST /api/v4/user/tokens` with `{name, policies}` → capture `result.value` from **that** response.
|
|
49
|
+
- Verify with the token itself (`GET /user`, one scoped read per new group — full matrix below), hand the secret over once, destroy every local copy (`chmod 600` while it lives, then delete). Rollback is dashboard roll, not delete + recreate (there is no public roll route — see `skills/cloudflare-token-roll/SKILL.md`).
|
|
50
|
+
|
|
51
|
+
## React-select mechanics (dash dropdowns)
|
|
52
|
+
|
|
53
|
+
- Menus open on control mousedown, not input click; options may expose no a11y role until open — snapshot after opening, act on fresh uids only.
|
|
54
|
+
- Never reuse coordinates across scrolls or snapshots: annotate → click immediately, then re-verify. Stale-coordinate clicks land on neighboring ✕ buttons and delete finished rows.
|
|
55
|
+
- `evaluate_script` DOM clicks can set display text without committing React state. Treat `value=` in a snapshot as necessary but not sufficient — sufficiency is the level menu opening with real options.
|
|
56
|
+
|
|
57
|
+
## After creation: validation matrix (live-proven 2026-09-06)
|
|
58
|
+
|
|
59
|
+
- Run `CLOUDFLARE_API_TOKEN=<paste-once> node scripts/verify-api-token.mjs` (identity, token status, Workers scripts read).
|
|
60
|
+
- Then one live read per relied-upon group, all passing on the reference token: `GET /user`, `GET /accounts`, Workers scripts list, KV namespaces list, R2 buckets list, D1 databases list, Hyperdrive configs list, zones list, zone routes list, account read, memberships list, audit-logs list (proves Logs Read).
|
|
61
|
+
- Known non-gaps, do not chase: `GET /user/tokens/:id` returns `9109` by design (tokens cannot manage tokens); zone-analytics `10000` without the Zone Analytics group is correct least privilege (observability rollups go through the separate obs MCP, not this token); Workers Tail needs a websocket (group presence + dashboard UI is the check).
|
|
62
|
+
- Template drift is real: the dashboard template grows over time (Builds/Agents/Containers/Observability/Pages appeared after the doc was written). Enumerate required groups per task from `docs/api-token.md`; never assume the template equals the need.
|
|
63
|
+
- A 403 naming a missing group later means extend-then-verify, not a new token: same flow, one more row.
|
|
@@ -0,0 +1,53 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: cloudflare-auth-setup
|
|
3
|
+
description: Set up Cloudflare authentication from any state. Use before any Cloudflare task when auth is unknown, expired, or rejected; when choosing between a persistent API token and temporary browser OAuth; or when the environment may lack browser automation. Routes to token creation, OAuth, or manual fallback.
|
|
4
|
+
---
|
|
5
|
+
|
|
6
|
+
# Cloudflare Auth Setup (Router)
|
|
7
|
+
|
|
8
|
+
This skill runs **before** any Cloudflare work when authentication is not already proven. Never guess at credentials and never loop a rejected auth wall — triage, ask once, then set up exactly one path.
|
|
9
|
+
|
|
10
|
+
## Step 0 — What state are we in?
|
|
11
|
+
|
|
12
|
+
Check in order, stop at the first hit:
|
|
13
|
+
|
|
14
|
+
1. **API token configured?** `pi-cloudflare.apiToken` setting (or `CLOUDFLARE_API_TOKEN` env) present → verify with one cheap read (`GET /user`). Works → done, proceed with the task.
|
|
15
|
+
2. **Browser OAuth fresh?** Stored tokens exist and unexpired (or a silent refresh succeeds) → done.
|
|
16
|
+
3. **Otherwise → unauthenticated.** Go to Step 1. This includes expired/revoked tokens and any 401/403/`invalid_grant` from a tool call.
|
|
17
|
+
|
|
18
|
+
## Step 1 — Stop and ask (one question, three options)
|
|
19
|
+
|
|
20
|
+
Do not pick for the user. Ask:
|
|
21
|
+
|
|
22
|
+
> Cloudflare isn't authenticated. How should I set it up?
|
|
23
|
+
> 1. **API token (recommended for repeat work)** — I create it in your dashboard, store it, verify it. Survives restarts, no browser popups afterward.
|
|
24
|
+
> 2. **Browser OAuth (quickest for one-off work)** — you approve once in a browser window; lasts about an hour.
|
|
25
|
+
> 3. **I'll paste a token** — you create it in the dashboard yourself and hand me the value; I store and verify it.
|
|
26
|
+
|
|
27
|
+
If the user already answered implicitly ("just set it up", "use a token"), skip the question and proceed — note the assumption.
|
|
28
|
+
|
|
29
|
+
## Step 2 — Check what this environment can do
|
|
30
|
+
|
|
31
|
+
| Capability | How to tell | If missing |
|
|
32
|
+
|---|---|---|
|
|
33
|
+
| Drive a browser (`browser_*` tools or equivalent) | Tool list contains browser automation | Token creation becomes **guided manual**: give exact dashboard clicks (see cloudflare-api-token skill UI path), user pastes the secret back, you store + verify. OAuth becomes **manual**: user runs the setup command in their own terminal. |
|
|
34
|
+
| Open a terminal for the setup CLI | You can execute shell | Otherwise do everything in-chat: manual dashboard steps + paste-back. |
|
|
35
|
+
| Existing dashboard session | Previous browser profile with a login | Without it, every browser path starts with a human sign-in (SSO/2FA/passkeys are theirs to complete). |
|
|
36
|
+
|
|
37
|
+
The matrix composes: no browser + no terminal still works (pure manual + paste-back). Never declare the task impossible — degrade to the manual path with precise steps.
|
|
38
|
+
|
|
39
|
+
## Step 3 — Execute exactly one path
|
|
40
|
+
|
|
41
|
+
- **API token** → `cloudflare-api-token` skill (create), including its store step (env file + shell block + settings reference + verify). On a lost secret later: `cloudflare-token-roll`. On scope changes: `cloudflare-token-scopes`.
|
|
42
|
+
- **Browser OAuth** → run the per-server setup command from the error hint (`pi-cloudflare-setup --only <server>`); the human approves in the opened window. Re-verify with one cheap read. Warn that it expires in about an hour.
|
|
43
|
+
- **Pasted token** → store exactly like a created one (same store step, same file perms), verify, destroy chat-visible copies from your side (never write the value to repo files, logs, or docs).
|
|
44
|
+
|
|
45
|
+
## Step 4 — Prove it before the real task
|
|
46
|
+
|
|
47
|
+
One cheap read in the task's domain (identity, one list call). Only then continue. If it fails, you misdiagnosed Step 0 — restart triage instead of retry-looping.
|
|
48
|
+
|
|
49
|
+
## Rules
|
|
50
|
+
|
|
51
|
+
- One auth question per session unless the state changes; remember the answer.
|
|
52
|
+
- Secrets: `chmod 600` while they live, settings hold references (`${...}`) never literals, temp copies destroyed, values never land in repos, issues, or docs.
|
|
53
|
+
- A 403 naming a missing group after setup is a scoping task (`cloudflare-token-scopes`), not an auth failure — do not restart triage.
|
|
@@ -0,0 +1,34 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: cloudflare-token-roll
|
|
3
|
+
description: Roll a Cloudflare dashboard API token when its secret is lost or may be exposed. Use when the stored secret is missing, when a token may have leaked, or when validation needs a capturable value. Covers the UI roll flow, secret capture, verification, and handoff. There is no public roll API route — this is UI-driven by design.
|
|
4
|
+
---
|
|
5
|
+
|
|
6
|
+
# Cloudflare Token Roll
|
|
7
|
+
|
|
8
|
+
There is no public roll endpoint (`POST /user/tokens/:id/roll` returns `7000 No route`). Roll happens in the dashboard: token row Actions menu → Roll → confirm dialog → **secret modal shows the new value once**. A later GET never returns it.
|
|
9
|
+
|
|
10
|
+
## Preconditions
|
|
11
|
+
|
|
12
|
+
- Persistent browser, **headed** (dashboard challenges headless). Never fresh.
|
|
13
|
+
- Confirm with the user first: rolling **kills the current secret immediately**. Only roll when the old value is unused, lost, or compromised. If it is wired anywhere, that wiring breaks at confirm time.
|
|
14
|
+
|
|
15
|
+
## Flow
|
|
16
|
+
|
|
17
|
+
1. My Profile → API Tokens → token row Actions → Roll.
|
|
18
|
+
2. Menu interaction notes: open the Actions menu, then drive the dialog with DOM clicks if a11y clicks stall (dialog buttons sometimes need `querySelector` + `.click()` while a11y clicks dismiss). Confirm only the intended token (dialog names it — read it back before confirming).
|
|
19
|
+
3. The secret modal (`Token rolled successfully` / `Copy your API token now`) holds the **only copy**. Capture `cfut_...` immediately.
|
|
20
|
+
4. Click Done. Verify the token row still shows Active.
|
|
21
|
+
5. Validate before handoff: `GET /user` (identity), one scoped read per newly relied-upon group (see cloudflare-api-token skill matrix). `GET /user/tokens/:id` confirming policies is safe (never returns the secret).
|
|
22
|
+
6. **Store it for them — never hand off manual steps.** The user must not need to touch anything:
|
|
23
|
+
- Write `export CLOUDFLARE_API_TOKEN="<secret>"` to `~/.pi/cloudflare-api-token` (mode `0600`, no other content that matters).
|
|
24
|
+
- Ensure `~/.zshrc` sources it inside a marked idempotent block (`# >>> pi-managed: cloudflare-api-token >>>` … `# <<< pi-managed: cloudflare-api-token <<<`), replacing any previous block.
|
|
25
|
+
- Set `~/.pi/agent/settings.json` → `pi-cloudflare.apiToken` to the literal string `${CLOUDFLARE_API_TOKEN}` (reference, never the secret). Preserve every other key byte-for-byte in meaning.
|
|
26
|
+
- Verify: fresh interactive shell resolves a 53-char value; settings parses; one live API read succeeds.
|
|
27
|
+
- Tell the user to open a new terminal (or `source ~/.zshrc`) and restart Pi sessions so the new environment is picked up.
|
|
28
|
+
7. Destroy temp copies. Report stored + verified **without printing the secret**.
|
|
29
|
+
|
|
30
|
+
## What success looks like
|
|
31
|
+
|
|
32
|
+
- Exactly one active token under the expected name (list and check for duplicates — a failed first attempt often leaves one behind).
|
|
33
|
+
- `modified_on` bumped, old secret rejected (spot-check one call with it only if exposure is suspected; otherwise just rotate wiring).
|
|
34
|
+
- Never retry-loop the confirm dialog. One confirm, one capture.
|
|
@@ -0,0 +1,32 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: cloudflare-token-scopes
|
|
3
|
+
description: Add, remove, or change permission scopes on an existing Cloudflare API token. Use when a 403 names a missing permission group, when new tools need new groups, or when trimming an over-scoped token. Prefers the PUT update path (secret preserved) over delete-and-recreate.
|
|
4
|
+
---
|
|
5
|
+
|
|
6
|
+
# Cloudflare Token Scope Updates
|
|
7
|
+
|
|
8
|
+
Prefer updating in place: the secret survives, wiring stays intact, and the change is one auditable diff. Delete-and-recreate (or roll) is only for lost secrets and suspected exposure — see cloudflare-token-roll.
|
|
9
|
+
|
|
10
|
+
## Discover the current state first
|
|
11
|
+
|
|
12
|
+
- `GET /api/v4/user/tokens` → find the token id by name.
|
|
13
|
+
- `GET /api/v4/user/tokens/:id` → full policies (resources + groups). Never returns the secret — safe to log and diff.
|
|
14
|
+
- A 403 from an agent tool names the missing group (`Failed common permission check` or the dashboard equivalent). That name, not guesswork, drives the change.
|
|
15
|
+
|
|
16
|
+
## Resolve groups by exact name
|
|
17
|
+
|
|
18
|
+
- `GET /api/v4/user/tokens/permission_groups?per_page=100` returns all ~400 in one page.
|
|
19
|
+
- UI verbs map to API verbs: UI `Edit` = API `Write`, UI `Read` = API `Read` (e.g. UI `D1` level Edit → `D1 Write`).
|
|
20
|
+
- Never invent group names. If a dashboard label has no exact API match (template labels drift ahead of the API), stop and surface the candidates — do not approximate on a credential.
|
|
21
|
+
|
|
22
|
+
## Update via PUT (secret preserved)
|
|
23
|
+
|
|
24
|
+
- `PUT /api/v4/user/tokens/:id` with the **complete** new `{name, policies}` — it replaces, so send the full intended set: keep existing groups, add or drop the target ones.
|
|
25
|
+
- Split policies by scope exactly like creation: zone-scoped groups under `com.cloudflare.api.account.zone.*`, user groups under `com.cloudflare.api.user.<id>`, account groups per account (explicit ids or the account wildcard). A mixed-scope policy fails with `Failed common permission check`.
|
|
26
|
+
- Same-origin `/api/v4/*` in page context carries the session (persistent browser, headed for dashboard pages). `Content-Type: application/json` required.
|
|
27
|
+
- Verify after: re-GET the token and diff policies, then exercise one live read per changed group. A 403 afterward means the group mapping was wrong, not the mechanism.
|
|
28
|
+
|
|
29
|
+
## When update is the wrong tool
|
|
30
|
+
|
|
31
|
+
- Secret lost or leaked → cloudflare-token-roll (no public roll route; UI flow).
|
|
32
|
+
- Token for a different identity or account set → create fresh (cloudflare-api-token), then delete the old one only after the new wiring verifies.
|