shopify-tunnel-dev 0.2.0 → 0.3.0

package/README.md

@@ -47,18 +47,20 @@ pnpm add -D shopify-tunnel-dev
 "scripts": { "dev": "shopify-tunnel-dev" }
 ```
 
-`.gitignore`:
-
-```
-.cloudflared/
+```bash
+npx shopify-tunnel-dev init
 ```
 
+`init` creates `.cloudflared/account.json` (empty template, mode 600), adds `.cloudflared/` to
+`.gitignore`, and adds `DEV_HOST=` / `DEV_PORT=` to `.env`. It never overwrites anything, and
+`pnpm dev` runs it automatically in a fresh clone.
+
 Give each dev their own app in the Partner Dashboard; the app URL lives on Shopify, not in the tunnel.
 
 ## Per dev
 
-Copy `cert.pem` and `account.json` from the password manager into `.cloudflared/`
-(`chmod 600 .cloudflared/*`), then add to `.env`:
+Run `pnpm dev` once to scaffold, then fill `.cloudflared/account.json` and add `.cloudflared/cert.pem`
+from the password manager (`chmod 600 .cloudflared/*`). Set in `.env`:
 
 ```
 DEV_HOST=dev-myapp-alice.example.com

package/bin/shopify-tunnel-dev.js

@@ -3,9 +3,15 @@ import { spawn } from 'node:child_process';
 import { resolveCloudflared } from '../src/cloudflared-binary.js';
 import { ConfigError, loadConfig } from '../src/load-config.js';
 import { stopCloudflared } from '../src/run-cloudflared.js';
+import { scaffoldProject } from '../src/scaffold-project.js';
 import { startNamedTunnel, startQuickTunnel } from '../src/start-tunnel.js';
 
 const USAGE = `Usage: shopify-tunnel-dev [dev] [options] [-- shopify app dev args]
+       shopify-tunnel-dev init
+
+Commands:
+  dev    Start the tunnel and shopify app dev (default)
+  init   Create .cloudflared/account.json, gitignore it, add DEV_HOST/DEV_PORT to .env
 
 Options:
   -q, --quick   Random *.trycloudflare.com URL, no Cloudflare credentials needed
@@ -14,9 +20,13 @@ Options:
 
 Any other argument (e.g. --reset, --store=foo) is passed to \`shopify app dev\`.`;
 
+const NEXT_STEPS =
+  'set DEV_HOST and DEV_PORT in .env, fill .cloudflared/account.json and add .cloudflared/cert.pem';
+
 function parseArgs(argv) {
-  const args = argv[0] === 'dev' ? argv.slice(1) : argv;
-  const opts = { quick: false, force: false, help: false, passthrough: [] };
+  const init = argv[0] === 'init';
+  const args = argv[0] === 'dev' || init ? argv.slice(1) : argv;
+  const opts = { init, quick: false, force: false, help: false, passthrough: [] };
   for (const arg of args) {
     if (arg === '-q' || arg === '--quick') opts.quick = true;
     else if (arg === '-f' || arg === '--force') opts.force = true;
@@ -29,6 +39,15 @@ function parseArgs(argv) {
 async function main() {
   const opts = parseArgs(process.argv.slice(2));
   if (opts.help) return console.log(USAGE);
+  // `init` scaffolds explicitly; a named `dev` run in a fresh clone does the same before complaining,
+  // so the config error points at files that already exist.
+  if (opts.init || !opts.quick) {
+    const changes = scaffoldProject();
+    changes.forEach((change) => console.log(`[init] ${change}`));
+    if (changes.length) console.log(`[init] next: ${NEXT_STEPS}`);
+    else if (opts.init) console.log('[init] nothing to do');
+    if (opts.init) return;
+  }
 
   const cfg = loadConfig({ quick: opts.quick });
   const bin = await resolveCloudflared();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shopify-tunnel-dev",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Run `shopify app dev` behind a fixed-hostname Cloudflare named tunnel that the whole team shares one credential set for",
   "type": "module",
   "bin": {

package/src/scaffold-project.js

@@ -0,0 +1,44 @@
+import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { parseEnv } from 'node:util';
+
+const ACCOUNT_TEMPLATE = { CF_ACCOUNT_TAG: '', CF_SECRET_KEY: '', CF_HOST_PATTERN: '' };
+
+// Idempotent: only creates what is missing, never overwrites. Returns the list of changes made.
+export function scaffoldProject(cwd = process.cwd()) {
+  const changes = [];
+  const dir = path.join(cwd, '.cloudflared');
+  const accountPath = path.join(dir, 'account.json');
+
+  if (!existsSync(dir)) {
+    mkdirSync(dir, { mode: 0o700 });
+    changes.push('created .cloudflared/');
+  }
+  if (!existsSync(accountPath)) {
+    writeFileSync(accountPath, `${JSON.stringify(ACCOUNT_TEMPLATE, null, 2)}\n`, { mode: 0o600 });
+    changes.push('created .cloudflared/account.json (fill in from your password manager)');
+  }
+
+  // Keep the shared secrets out of git before anyone pastes them in.
+  const gitignorePath = path.join(cwd, '.gitignore');
+  const gitignore = existsSync(gitignorePath) ? readFileSync(gitignorePath, 'utf8') : '';
+  if (!/^\/?\.cloudflared\/?(\*)?\s*$/m.test(gitignore)) {
+    appendLine(gitignorePath, gitignore, '.cloudflared/');
+    changes.push('added .cloudflared/ to .gitignore');
+  }
+
+  const envPath = [path.join(cwd, 'web/.env'), path.join(cwd, '.env')].find((p) => existsSync(p)) ?? path.join(cwd, '.env');
+  const envText = existsSync(envPath) ? readFileSync(envPath, 'utf8') : '';
+  const env = parseEnv(envText);
+  const missingKeys = ['DEV_HOST', 'DEV_PORT'].filter((key) => !(key in env));
+  if (missingKeys.length) {
+    appendLine(envPath, envText, missingKeys.map((key) => `${key}=`).join('\n'));
+    changes.push(`added ${missingKeys.join(', ')} to ${path.relative(cwd, envPath)}`);
+  }
+
+  return changes;
+}
+
+function appendLine(file, current, line) {
+  appendFileSync(file, `${current && !current.endsWith('\n') ? '\n' : ''}${line}\n`);
+}