void 0.20.2 → 0.21.0

package/dist/cf-access-rAZxzMkL.mjs

@@ -0,0 +1,181 @@
+import { n as isVoidAccessGatedUrl, t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
+import { S as writeKeyringPassword, c as platformCredentialAccount, s as normalizePlatformApiUrl, x as readKeyringPassword } from "./platform-registry-BJbgZLS1.mjs";
+import { spawnSync } from "node:child_process";
+//#region src/cli/cf-access.ts
+const ACCESS_KEYRING_SERVICE = "dev.void.cli.access";
+const keyringTokens = /* @__PURE__ */ new Map();
+function usableToken(token) {
+	try {
+		const payload = JSON.parse(Buffer.from(token.split(".")[1], "base64url").toString("utf8"));
+		return typeof payload.exp === "number" && payload.exp > Date.now() / 1e3 + 60;
+	} catch {
+		return false;
+	}
+}
+function rememberOriginToken(origin, token) {
+	let entries = {};
+	if (process.env.VOID_ACCESS_CREDENTIALS) {
+		const parsed = JSON.parse(process.env.VOID_ACCESS_CREDENTIALS);
+		if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("platform: VOID_ACCESS_CREDENTIALS must contain an origin-keyed JSON object.");
+		entries = parsed;
+	}
+	process.env.VOID_ACCESS_CREDENTIALS = JSON.stringify({
+		...entries,
+		[origin]: { CF_ACCESS_TOKEN: token }
+	});
+}
+function forgetOriginToken(origin) {
+	if (!process.env.VOID_ACCESS_CREDENTIALS) return;
+	const parsed = JSON.parse(process.env.VOID_ACCESS_CREDENTIALS);
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("platform: VOID_ACCESS_CREDENTIALS must contain an origin-keyed JSON object.");
+	const entries = { ...parsed };
+	delete entries[origin];
+	process.env.VOID_ACCESS_CREDENTIALS = JSON.stringify(entries);
+}
+function isCloudflareAccessChallenge(response) {
+	const location = response.headers.get("Location");
+	if (!location || response.status < 300 || response.status >= 400) return false;
+	try {
+		const target = new URL(location);
+		return target.protocol === "https:" && !target.username && !target.password && /^[a-z0-9-]+\.cloudflareaccess\.com$/.test(target.hostname) && target.pathname.startsWith("/cdn-cgi/access/login");
+	} catch {
+		return false;
+	}
+}
+/** Called for a selected origin, never for a redirect destination. */
+function ensurePlatformAccessToken(apiUrl, challenged = false, required = false, rejectedToken) {
+	const origin = normalizePlatformApiUrl(apiUrl);
+	if (!origin.startsWith("https://")) return;
+	const headers = cfAccessHeaders(process.env, origin);
+	if (headers["CF-Access-Client-Id"]) return;
+	if (!challenged && headers["cf-access-token"] && usableToken(headers["cf-access-token"])) return;
+	const account = platformCredentialAccount(origin);
+	if (!keyringTokens.has(origin)) {
+		if (keyringTokens.size >= 64) keyringTokens.delete(keyringTokens.keys().next().value);
+		keyringTokens.set(origin, readKeyringPassword(ACCESS_KEYRING_SERVICE, account));
+	}
+	const stored = keyringTokens.get(origin);
+	if (!challenged && stored && usableToken(stored)) {
+		rememberOriginToken(origin, stored);
+		return;
+	}
+	if (!challenged && !required && !stored && !headers["cf-access-token"]) return;
+	const rejectedTokens = new Set([
+		headers["cf-access-token"],
+		stored,
+		rejectedToken
+	].filter((token) => typeof token === "string" && token.length > 0));
+	if (challenged && rejectedTokens.size > 0) {
+		forgetOriginToken(origin);
+		keyringTokens.set(origin, null);
+		if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error(`platform: Cloudflare Access rejected the cached credential for ${origin}. Re-run this command in an interactive terminal to renew it.`);
+		console.error(`Renew Cloudflare Access authentication for ${origin}.`);
+		runCloudflared([
+			"access",
+			"login",
+			origin
+		], {
+			inherit: true,
+			timeoutMs: 12e4
+		});
+	}
+	let token = runCloudflared([
+		"access",
+		"token",
+		`-app=${origin}`
+	]);
+	if (token && rejectedTokens.has(token)) token = null;
+	if ((!token || !usableToken(token)) && process.stdin.isTTY && process.stdout.isTTY) {
+		console.error(`Authenticate to Cloudflare Access for ${origin}.`);
+		runCloudflared([
+			"access",
+			"login",
+			origin
+		], {
+			inherit: true,
+			timeoutMs: 12e4
+		});
+		token = runCloudflared([
+			"access",
+			"token",
+			`-app=${origin}`
+		]);
+	}
+	if (!token || !usableToken(token)) throw new Error("platform: Cloudflare Access authentication is required. Install cloudflared and sign in interactively, or set VOID_ACCESS_ORIGIN with scoped CF_ACCESS_CLIENT_ID/CF_ACCESS_CLIENT_SECRET credentials for CI.");
+	rememberOriginToken(origin, token);
+	keyringTokens.set(origin, token);
+	writeKeyringPassword(ACCESS_KEYRING_SERVICE, account, token);
+}
+const probedHosts = /* @__PURE__ */ new Set();
+/**
+* If the CLI is about to talk to a Cloudflare-Access-gated staging host,
+* probe the locally-installed `cloudflared` binary for a cached user JWT
+* and export it as `CF_ACCESS_TOKEN`. On interactive shells with no cached
+* token, open a browser login flow to populate the cache, then re-read it.
+*
+* Cached per-host so that an early non-gated call (e.g. prod) does not
+* permanently disable the probe for a later gated call (e.g. staging) in
+* the same process. Noop when:
+*   - a service-token pair is already set (CI path)
+*   - `CF_ACCESS_TOKEN` is already set (manual override or prior probe)
+*   - the target host is not gated
+*   - `cloudflared` is not installed
+*/
+function ensureCloudflaredToken(apiUrl) {
+	if (!isVoidAccessGatedUrl(apiUrl) || process.env.VOID_ACCESS_ORIGIN || process.env.VOID_ACCESS_CREDENTIALS) {
+		ensurePlatformAccessToken(apiUrl);
+		return;
+	}
+	if (process.env.CF_ACCESS_CLIENT_ID && process.env.CF_ACCESS_CLIENT_SECRET) return;
+	if (process.env.CF_ACCESS_TOKEN) return;
+	if (!isVoidAccessGatedUrl(apiUrl)) return;
+	const host = new URL(apiUrl).hostname;
+	if (probedHosts.has(host)) return;
+	probedHosts.add(host);
+	let token = runCloudflared([
+		"access",
+		"token",
+		`-app=${apiUrl}`
+	]);
+	if (!token && process.stdin.isTTY && process.stdout.isTTY) {
+		runCloudflared([
+			"access",
+			"login",
+			apiUrl
+		], {
+			inherit: true,
+			timeoutMs: 12e4
+		});
+		token = runCloudflared([
+			"access",
+			"token",
+			`-app=${apiUrl}`
+		]);
+	}
+	if (token) process.env.CF_ACCESS_TOKEN = token;
+}
+function runCloudflared(args, opts) {
+	try {
+		const result = spawnSync("cloudflared", args, {
+			encoding: "utf-8",
+			stdio: opts?.inherit ? "inherit" : [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			timeout: opts?.timeoutMs ?? 5e3
+		});
+		if (result.error || result.status !== 0) return null;
+		const out = (result.stdout ?? "").trim();
+		return out.length > 0 ? out : null;
+	} catch {
+		return null;
+	}
+}
+/** A protected API and proxy have separate audiences and separately scoped credentials. */
+function ensurePlatformProxyAccess(apiUrl, proxyUrl) {
+	ensurePlatformAccessToken(apiUrl);
+	ensurePlatformAccessToken(proxyUrl, false, Object.keys(cfAccessHeaders(process.env, apiUrl)).length > 0);
+}
+//#endregion
+export { isCloudflareAccessChallenge as i, ensurePlatformAccessToken as n, ensurePlatformProxyAccess as r, ensureCloudflaredToken as t };