wrangler 0.0.0-bf67bf2 → 0.0.0-bfbb0be

package/src/{user.tsx → user/user.tsx}

@@ -1,6 +1,6 @@
 /* Based heavily on code from https://github.com/BitySA/oauth2-auth-code-pkce */
 
-/* 
+/*
 
                                  Apache License
                            Version 2.0, January 2004
@@ -205,25 +205,29 @@
    limitations under the License.
   */
 
-import React from "react";
-import { render } from "ink";
-import Table from "ink-table";
-import SelectInput from "ink-select-input";
-import fetch from "node-fetch";
+import assert from "node:assert";
 import { webcrypto as crypto } from "node:crypto";
-import { TextEncoder } from "node:util";
-import open from "open";
-import url from "node:url";
+import { writeFileSync, mkdirSync, rmSync } from "node:fs";
 import http from "node:http";
-import { readFile, writeFile, rm, mkdir } from "node:fs/promises";
-import path from "node:path";
-import process from "node:process";
 import os from "node:os";
+import path from "node:path";
+import url from "node:url";
+import { TextEncoder } from "node:util";
 import TOML from "@iarna/toml";
-import assert from "node:assert";
+import { HostURL } from "@webcontainer/env";
+import { render } from "ink";
+import Table from "ink-table";
+import React from "react";
+import { fetch } from "undici";
+import { purgeConfigCaches } from "../config-cache";
+import { logger } from "../logger";
+import openInBrowser from "../open-in-browser";
+import { parseTOML, readFileSync } from "../parse";
+import { ChooseAccount, getAccountChoices } from "./choose-account";
+import { getCloudflareAPITokenFromEnv } from "./env-vars";
+import { generateAuthUrl } from "./generate-auth-url";
+import { generateRandomState } from "./generate-random-state";
 import type { ParsedUrlQuery } from "node:querystring";
-import { CF_API_BASE_URL } from "./cfetch";
-import type { Response } from "node-fetch";
 
 /**
  * An implementation of rfc6749#section-4.1 and rfc7636.
@@ -234,17 +238,45 @@ interface PKCECodes {
   codeVerifier: string;
 }
 
-interface State {
-  accessToken?: AccessToken; // persist
+/**
+ * The module level state of the authentication flow.
+ */
+interface State extends AuthTokens {
   authorizationCode?: string;
   codeChallenge?: string;
   codeVerifier?: string;
   hasAuthCodeBeenExchangedForAccessToken?: boolean;
-  refreshToken?: RefreshToken; // persist
   stateQueryParam?: string;
   scopes?: Scope[];
 }
 
+/**
+ * The tokens related to authentication.
+ */
+interface AuthTokens {
+  accessToken?: AccessToken;
+  refreshToken?: RefreshToken;
+  /** @deprecated - this field was only provided by the deprecated `wrangler1 config` command. */
+  apiToken?: string;
+}
+
+/**
+ * The path to the config file that holds user authentication data,
+ * relative to the user's home directory.
+ */
+export const USER_AUTH_CONFIG_FILE = ".wrangler/config/default.toml";
+
+/**
+ * The data that may be read from the `USER_CONFIG_FILE`.
+ */
+export interface UserAuthConfig {
+  oauth_token?: string;
+  refresh_token?: string;
+  expiration_time?: string;
+  /** @deprecated - this field was only provided by the deprecated `wrangler1 config` command. */
+  api_token?: string;
+}
+
 interface RefreshToken {
   value: string;
 }
@@ -254,103 +286,137 @@ interface AccessToken {
   expiry: string;
 }
 
-type Scope =
-  | "account:read"
-  | "user:read"
-  | "workers:write"
-  | "workers_kv:write"
-  | "workers_routes:write"
-  | "workers_scripts:write"
-  | "workers_tail:read"
-  | "zone:read"
-  | "offline_access"; // this should be included by default
-
-const Scopes: Scope[] = [
-  "account:read",
-  "user:read",
-  "workers:write",
-  "workers_kv:write",
-  "workers_routes:write",
-  "workers_scripts:write",
-  "workers_tail:read",
-  "zone:read",
-];
-
-const ScopeDescriptions = [
-  "See your account info such as account details, analytics, and memberships.",
-  "See your user info such as name, email address, and account memberships.",
-  "See and change Cloudflare Workers data such as zones, KV storage, namespaces, scripts, and routes.",
-  "See and change Cloudflare Workers KV Storage data such as keys and namespaces.",
-  "See and change Cloudflare Workers data such as filters and routes.",
-  "See and change Cloudflare Workers scripts, durable objects, subdomains, triggers, and tail data.",
-  "See Cloudflare Workers tail and script data.",
-  "Grants read level access to account zone.",
-];
+const Scopes = {
+  "account:read":
+    "See your account info such as account details, analytics, and memberships.",
+  "user:read":
+    "See your user info such as name, email address, and account memberships.",
+  "workers:write":
+    "See and change Cloudflare Workers data such as zones, KV storage, namespaces, scripts, and routes.",
+  "workers_kv:write":
+    "See and change Cloudflare Workers KV Storage data such as keys and namespaces.",
+  "workers_routes:write":
+    "See and change Cloudflare Workers data such as filters and routes.",
+  "workers_scripts:write":
+    "See and change Cloudflare Workers scripts, durable objects, subdomains, triggers, and tail data.",
+  "workers_tail:read": "See Cloudflare Workers tail and script data.",
+  "pages:write":
+    "See and change Cloudflare Pages projects, settings and deployments.",
+  "zone:read": "Grants read level access to account zone.",
+} as const;
+
+/**
+ * The possible keys for a Scope.
+ *
+ * "offline_access" is automatically included.
+ */
+type Scope = keyof typeof Scopes;
+
+const ScopeKeys = Object.keys(Scopes) as Scope[];
+
+export function validateScopeKeys(
+  scopes: string[]
+): scopes is typeof ScopeKeys {
+  return scopes.every((scope) => scope in Scopes);
+}
 
 const CLIENT_ID = "54d11594-84e4-41aa-b438-e81b8fa78ee7";
 const AUTH_URL = "https://dash.cloudflare.com/oauth2/auth";
 const TOKEN_URL = "https://dash.cloudflare.com/oauth2/token";
-const CALLBACK_URL = "http://localhost:8976/oauth/callback";
 const REVOKE_URL = "https://dash.cloudflare.com/oauth2/revoke";
 
-const LocalState: State = {};
-let initialised = false;
+/**
+ * To allow OAuth callbacks in environments such as WebContainer we need to
+ * create a host URL which only resolves `localhost` to a WebContainer
+ * hostname if the process is running in a WebContainer. On local this will
+ * be a no-op and it leaves the URL unmodified.
+ *
+ * @see https://www.npmjs.com/package/@webcontainer/env
+ */
+const CALLBACK_URL = HostURL.parse("http://localhost:8976/oauth/callback").href;
+
+let LocalState: State = getAuthTokens();
 
-// we do this because we have some async stuff
-// TODO: this should just happen in the top level
-// abd we should fiure out how to do top level await
-export async function initialise(): Promise<void> {
-  // get refreshtoken/accesstoken from fs if exists
+/**
+ * Compute the current auth tokens.
+ */
+function getAuthTokens(config?: UserAuthConfig): AuthTokens {
+  // get refreshToken/accessToken from fs if exists
   try {
-    // if CF_API_TOKEN available, use that
-    if (process.env.CF_API_TOKEN) {
-      LocalState.accessToken = {
-        value: process.env.CF_API_TOKEN,
-        expiry: "3021-12-31T23:59:59+00:00",
+    // if the environment variable is available, use that
+    const apiTokenFromEnv = getCloudflareAPITokenFromEnv();
+    if (apiTokenFromEnv) {
+      return {
+        accessToken: {
+          value: apiTokenFromEnv,
+          expiry: "3021-12-31T23:59:59+00:00",
+        },
       };
-      initialised = true;
-      return;
     }
 
-    const toml = TOML.parse(
-      await readFile(path.join(os.homedir(), ".wrangler/config/default.toml"), {
-        encoding: "utf-8",
-      })
-    );
-    const { oauth_token, refresh_token, expiration_time } = toml as {
-      oauth_token: string;
-      refresh_token: string;
-      expiration_time: string;
-    };
+    // otherwise try loading from the user auth config file.
+    const { oauth_token, refresh_token, expiration_time, api_token } =
+      config || readAuthConfigFile();
+
     if (oauth_token) {
-      LocalState.accessToken = { value: oauth_token, expiry: expiration_time };
-    }
-    if (refresh_token) {
-      LocalState.refreshToken = { value: refresh_token };
+      return {
+        accessToken: {
+          value: oauth_token,
+          // If there is no `expiration_time` field then set it to an old date, to cause it to expire immediately.
+          expiry: expiration_time ?? "2000-01-01:00:00:00+00:00",
+        },
+        refreshToken: { value: refresh_token ?? "" },
+      };
+    } else if (api_token) {
+      return { apiToken: api_token };
+    } else {
+      return {};
     }
-  } catch (err) {
-    // no config yet, let's chill
-    // console.error(err);
+  } catch {
+    return {};
   }
-  initialised = true;
 }
 
-// ugh. TODO: see fix from above.
-function throwIfNotInitialised() {
-  if (initialised === false) {
-    throw new Error(
-      "did you forget to call initialise() from the user module?"
+/**
+ * Run the initialisation of the auth state, in the case that something changed.
+ *
+ * This runs automatically whenever `writeAuthConfigFile` is run, so generally
+ * you won't need to call it yourself.
+ */
+export function reinitialiseAuthTokens(): void;
+
+/**
+ * Reinitialise auth state from an in-memory config, skipping
+ * over the part where we write a file and then read it back into memory
+ */
+export function reinitialiseAuthTokens(config: UserAuthConfig): void;
+
+export function reinitialiseAuthTokens(config?: UserAuthConfig): void {
+  LocalState = getAuthTokens(config);
+}
+
+export function getAPIToken(): string | undefined {
+  if (LocalState.apiToken) {
+    logger.warn(
+      "It looks like you have used Wrangler 1's `config` command to login with an API token.\n" +
+        "This is no longer supported in the current version of Wrangler.\n" +
+        "If you wish to authenticate via an API token then please set the `CLOUDFLARE_API_TOKEN` environment variable."
     );
   }
-}
 
-export function getAPIToken(): string {
-  if (process.env.CF_API_TOKEN) {
-    return process.env.CF_API_TOKEN;
+  const localAPIToken = getCloudflareAPITokenFromEnv();
+
+  if (
+    !process.stdout.isTTY &&
+    !localAPIToken &&
+    !LocalState.accessToken?.value
+  ) {
+    throw new Error(
+      "In a non-interactive environment, it's necessary to set a CLOUDFLARE_API_TOKEN environment variable for wrangler to work. Please go to https://developers.cloudflare.com/api/tokens/create/ for instructions on how to create an api token, and assign its value to CLOUDFLARE_API_TOKEN."
+    );
   }
 
-  throwIfNotInitialised();
-  return LocalState.accessToken?.value;
+  return localAPIToken ?? LocalState.accessToken?.value;
 }
 
 interface AccessContext {
@@ -508,7 +574,7 @@ const RECOMMENDED_STATE_LENGTH = 32;
 /**
  * Character set to generate code verifier defined in rfc7636.
  */
-const PKCE_CHARSET =
+export const PKCE_CHARSET =
   "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
 
 /**
@@ -537,8 +603,8 @@ function isReturningFromAuthServer(query: ParsedUrlQuery): boolean {
 
   const stateQueryParam = query.state;
   if (stateQueryParam !== state.stateQueryParam) {
-    console.warn(
-      "state query string parameter doesn't match the one sent! Possible malicious activity somewhere."
+    logger.warn(
+      "Received query string parameter doesn't match the one sent! Possible malicious activity somewhere."
     );
     throw new ErrorInvalidReturnedStateParam();
   }
@@ -548,7 +614,7 @@ function isReturningFromAuthServer(query: ParsedUrlQuery): boolean {
   return true;
 }
 
-export async function getAuthURL(scopes?: string[]): Promise<string> {
+export async function getAuthURL(scopes = ScopeKeys): Promise<string> {
   const { codeChallenge, codeVerifier } = await generatePKCECodes();
   const stateQueryParam = generateRandomState(RECOMMENDED_STATE_LENGTH);
 
@@ -558,56 +624,76 @@ export async function getAuthURL(scopes?: string[]): Promise<string> {
     stateQueryParam,
   });
 
-  // TODO: verify that the scopes passed are legit
-
-  return (
-    AUTH_URL +
-    `?response_type=code&` +
-    `client_id=${encodeURIComponent(CLIENT_ID)}&` +
-    `redirect_uri=${encodeURIComponent(CALLBACK_URL)}&` +
-    `scope=${encodeURIComponent(
-      (scopes || Scopes).concat("offline_access").join(" ")
-    )}&` +
-    `state=${stateQueryParam}&` +
-    `code_challenge=${encodeURIComponent(codeChallenge)}&` +
-    `code_challenge_method=S256`
-  );
+  return generateAuthUrl({
+    authUrl: AUTH_URL,
+    clientId: CLIENT_ID,
+    callbackUrl: CALLBACK_URL,
+    scopes,
+    stateQueryParam,
+    codeChallenge,
+  });
 }
 
+type TokenResponse =
+  | {
+      access_token: string;
+      expires_in: number;
+      refresh_token: string;
+      scope: string;
+    }
+  | {
+      error: string;
+    };
+
 /**
  * Refresh an access token from the remote service.
  */
 async function exchangeRefreshTokenForAccessToken(): Promise<AccessContext> {
-  const { refreshToken } = LocalState;
-
-  if (!refreshToken) {
-    console.warn("No refresh token is present.");
+  if (!LocalState.refreshToken) {
+    logger.warn("No refresh token is present.");
   }
 
-  const url = TOKEN_URL;
   const body =
     `grant_type=refresh_token&` +
-    `refresh_token=${refreshToken?.value}&` +
+    `refresh_token=${LocalState.refreshToken?.value}&` +
     `client_id=${CLIENT_ID}`;
 
-  const response = await fetch(url, {
+  const response = await fetch(TOKEN_URL, {
     method: "POST",
     body,
     headers: {
       "Content-Type": "application/x-www-form-urlencoded",
     },
   });
+
   if (response.status >= 400) {
-    throw await response.json();
+    let tokenExchangeResErr = undefined;
+
+    try {
+      tokenExchangeResErr = await response.text();
+      tokenExchangeResErr = JSON.parse(tokenExchangeResErr);
+    } catch (e) {
+      // If it can't parse to JSON ignore the error
+    }
+
+    if (tokenExchangeResErr !== undefined) {
+      // We will throw the parsed error if it parsed correctly, otherwise we throw an unknown error.
+      throw typeof tokenExchangeResErr === "string"
+        ? new Error(tokenExchangeResErr)
+        : tokenExchangeResErr;
+    } else {
+      throw new ErrorUnknown(
+        "Failed to parse Error from exchangeRefreshTokenForAccessToken"
+      );
+    }
   } else {
     try {
-      const json = await response.json();
-      const { access_token, expires_in, refresh_token, scope } = json as {
-        access_token: string;
-        expires_in: number;
-        refresh_token: string;
-        scope: string;
-      };
+      const json = (await response.json()) as TokenResponse;
+      if ("error" in json) {
+        throw json.error;
+      }
+
+      const { access_token, expires_in, refresh_token, scope } = json;
       let scopes: Scope[] = [];
 
       const accessToken: AccessToken = {
@@ -617,10 +703,9 @@ async function exchangeRefreshTokenForAccessToken(): Promise<AccessContext> {
       LocalState.accessToken = accessToken;
 
       if (refresh_token) {
-        const refreshToken: RefreshToken = {
+        LocalState.refreshToken = {
           value: refresh_token,
         };
-        LocalState.refreshToken = refreshToken;
       }
 
       if (scope) {
@@ -636,20 +721,12 @@ async function exchangeRefreshTokenForAccessToken(): Promise<AccessContext> {
         refreshToken: LocalState.refreshToken,
       };
       return accessContext;
-    } catch (err) {
-      const error = err?.error || "There was a network error.";
-      switch (error) {
-        case "invalid_grant":
-          console.log(
-            "Expired! Auth code or refresh token needs to be renewed."
-          );
-          // alert("Redirecting to auth server to obtain a new auth grant code.");
-          // TODO: return refreshAuthCodeOrRefreshToken();
-          break;
-        default:
-          break;
+    } catch (error) {
+      if (typeof error === "string") {
+        throw toErrorClass(error);
+      } else {
+        throw error;
       }
-      throw toErrorClass(error);
     }
   }
 }
@@ -661,12 +738,11 @@ async function exchangeAuthCodeForAccessToken(): Promise<AccessContext> {
   const { authorizationCode, codeVerifier = "" } = LocalState;
 
   if (!codeVerifier) {
-    console.warn("No code verifier is being sent.");
+    logger.warn("No code verifier is being sent.");
   } else if (!authorizationCode) {
-    console.warn("No authorization grant code is being passed.");
+    logger.warn("No authorization grant code is being passed.");
   }
 
-  const url = TOKEN_URL;
   const body =
     `grant_type=authorization_code&` +
     `code=${encodeURIComponent(authorizationCode || "")}&` +
@@ -674,7 +750,7 @@ async function exchangeAuthCodeForAccessToken(): Promise<AccessContext> {
     `client_id=${encodeURIComponent(CLIENT_ID)}&` +
     `code_verifier=${codeVerifier}`;
 
-  const response = await fetch(url, {
+  const response = await fetch(TOKEN_URL, {
     method: "POST",
     body,
     headers: {
@@ -685,19 +761,17 @@ async function exchangeAuthCodeForAccessToken(): Promise<AccessContext> {
     const { error } = (await response.json()) as { error: string };
     // .catch((_) => ({ error: "invalid_json" }));
     if (error === "invalid_grant") {
-      console.log("Expired! Auth code or refresh token needs to be renewed.");
+      logger.log("Expired! Auth code or refresh token needs to be renewed.");
       // alert("Redirecting to auth server to obtain a new auth grant code.");
       // TODO: return refreshAuthCodeOrRefreshToken();
     }
     throw toErrorClass(error);
   }
-  const json = await response.json();
-  const { access_token, expires_in, refresh_token, scope } = json as {
-    access_token: string;
-    expires_in: number;
-    refresh_token: string;
-    scope: string;
-  };
+  const json = (await response.json()) as TokenResponse;
+  if ("error" in json) {
+    throw new Error(json.error);
+  }
+  const { access_token, expires_in, refresh_token, scope } = json;
   let scopes: Scope[] = [];
   LocalState.hasAuthCodeBeenExchangedForAccessToken = true;
 
@@ -709,10 +783,9 @@ async function exchangeAuthCodeForAccessToken(): Promise<AccessContext> {
   LocalState.accessToken = accessToken;
 
   if (refresh_token) {
-    const refreshToken: RefreshToken = {
+    LocalState.refreshToken = {
       value: refresh_token,
     };
-    LocalState.refreshToken = refreshToken;
   }
 
   if (scope) {
@@ -771,63 +844,70 @@ async function generatePKCECodes(): Promise<PKCECodes> {
 }
 
 /**
- * Generates random state to be passed for anti-csrf.
+ * Writes a a wrangler config file (auth credentials) to disk,
+ * and updates the user auth state with the new credentials.
  */
-function generateRandomState(lengthOfState: number): string {
-  const output = new Uint32Array(lengthOfState);
-  // @ts-expect-error crypto's types aren't there yet
-  crypto.getRandomValues(output);
-  return Array.from(output)
-    .map((num: number) => PKCE_CHARSET[num % PKCE_CHARSET.length])
-    .join("");
-}
-
-async function writeToConfigFile(tokenData: AccessContext) {
-  await mkdir(path.join(os.homedir(), ".wrangler/config/"), {
+export function writeAuthConfigFile(config: UserAuthConfig) {
+  mkdirSync(path.join(os.homedir(), ".wrangler/config/"), {
     recursive: true,
   });
-  await writeFile(
-    path.join(os.homedir(), ".wrangler/config/default.toml"),
-    `
-oauth_token = "${tokenData.token?.value || ""}"
-refresh_token = "${tokenData.refreshToken?.value}"
-expiration_time = "${tokenData.token?.expiry}"
-`,
+  writeFileSync(
+    path.join(os.homedir(), USER_AUTH_CONFIG_FILE),
+    TOML.stringify(config as TOML.JsonMap),
     { encoding: "utf-8" }
   );
+
+  reinitialiseAuthTokens();
+}
+
+export function readAuthConfigFile(): UserAuthConfig {
+  const toml = parseTOML(
+    readFileSync(path.join(os.homedir(), USER_AUTH_CONFIG_FILE))
+  );
+  return toml;
 }
 
 type LoginProps = {
-  scopes?: string[];
+  scopes?: Scope[];
 };
 
 export async function loginOrRefreshIfRequired(): Promise<boolean> {
   // TODO: if there already is a token, then try refreshing
   // TODO: ask permission before opening browser
-  if (!LocalState.accessToken) {
-    // not logged in.
-    return await login();
+  if (!getAPIToken()) {
+    // Not logged in.
+    // If we are not interactive, we cannot ask the user to login
+    return isInteractive() && (await login());
   } else if (isAccessTokenExpired()) {
-    return await refreshToken();
+    // We're logged in, but the refresh token seems to have expired,
+    // so let's try to refresh it
+    const didRefresh = await refreshToken();
+    if (didRefresh) {
+      // The token was refreshed, so we're done here
+      return true;
+    } else {
+      // If the refresh token isn't valid, then we ask the user to login again
+      return isInteractive() && (await login());
+    }
   } else {
     return true;
   }
 }
 
 export async function login(props?: LoginProps): Promise<boolean> {
+  logger.log("Attempting to login via OAuth...");
   const urlToOpen = await getAuthURL(props?.scopes);
-  open(urlToOpen);
-  // TODO: log url only if on system where it's unreliable/unavailable
-  // console.log(`💁 Opened ${urlToOpen}`);
-  let server;
-  let loginTimeoutHandle;
+  let server: http.Server;
+  let loginTimeoutHandle: NodeJS.Timeout;
   const timerPromise = new Promise<boolean>((resolve) => {
     loginTimeoutHandle = setTimeout(() => {
-      console.error("Timed out waiting for authorization code.");
+      logger.error(
+        "Timed out waiting for authorization code, please try again."
+      );
       server.close();
       clearTimeout(loginTimeoutHandle);
       resolve(false);
-    }, 60000); // wait for 30 seconds for the user to authorize
+    }, 60000); // wait for 60 seconds for the user to authorize
   });
 
   const loginPromise = new Promise<boolean>((resolve, reject) => {
@@ -857,9 +937,10 @@ export async function login(props?: LoginProps): Promise<boolean> {
               res.end(() => {
                 finish(false);
               });
-              console.log(
-                "Error: Consent denied. You must grant consent to Wrangler in order to login. If you don't want to do this consider passing an API token with CF_API_TOKEN variable"
-              ); // TODO: implement wrangler config lol
+              logger.error(
+                "Error: Consent denied. You must grant consent to Wrangler in order to login.\n" +
+                  "If you don't want to do this consider passing an API token via the `CLOUDFLARE_API_TOKEN` environment variable"
+              );
 
               return;
             } else {
@@ -872,8 +953,12 @@ export async function login(props?: LoginProps): Promise<boolean> {
             finish(false, new ErrorNoAuthCode());
             return;
           } else {
-            const tokenData = await exchangeAuthCodeForAccessToken();
-            await writeToConfigFile(tokenData);
+            const exchange = await exchangeAuthCodeForAccessToken();
+            writeAuthConfigFile({
+              oauth_token: exchange.token?.value ?? "",
+              expiration_time: exchange.token?.expiry,
+              refresh_token: exchange.refreshToken?.value,
+            });
             res.writeHead(307, {
               Location:
                 "https://welcome.developers.workers.dev/wrangler-oauth-consent-granted",
@@ -881,9 +966,9 @@ export async function login(props?: LoginProps): Promise<boolean> {
             res.end(() => {
               finish(true);
             });
-            console.log(
-              `Successfully configured. You can find your configuration file at: ${os.homedir()}/.wrangler/config/default.toml`
-            );
+            logger.log(`Successfully logged in.`);
+
+            purgeConfigCaches();
 
             return;
           }
@@ -894,42 +979,65 @@ export async function login(props?: LoginProps): Promise<boolean> {
     server.listen(8976);
   });
 
+  logger.log(`Opening a link in your default browser: ${urlToOpen}`);
+  await openInBrowser(urlToOpen);
+
   return Promise.race([timerPromise, loginPromise]);
 }
 
 /**
  * Checks to see if the access token has expired.
  */
-export function isAccessTokenExpired(): boolean {
-  throwIfNotInitialised();
+function isAccessTokenExpired(): boolean {
   const { accessToken } = LocalState;
   return Boolean(accessToken && new Date() >= new Date(accessToken.expiry));
 }
 
-export async function refreshToken(): Promise<boolean> {
-  throwIfNotInitialised();
+async function refreshToken(): Promise<boolean> {
   // refresh
   try {
-    const refreshed = await exchangeRefreshTokenForAccessToken();
-    await writeToConfigFile(refreshed);
+    const {
+      token: { value: oauth_token, expiry: expiration_time } = {
+        value: "",
+        expiry: "",
+      },
+      refreshToken: { value: refresh_token } = {},
+    } = await exchangeRefreshTokenForAccessToken();
+    writeAuthConfigFile({ oauth_token, expiration_time, refresh_token });
     return true;
   } catch (err) {
-    console.error(err);
     return false;
   }
 }
 
 export async function logout(): Promise<void> {
-  throwIfNotInitialised();
-  const { refreshToken } = LocalState;
-  if (!refreshToken) {
-    console.log("Not logged in, exiting...");
-    return;
+  if (!LocalState.accessToken) {
+    if (!LocalState.refreshToken) {
+      logger.log("Not logged in, exiting...");
+      return;
+    }
+
+    const body =
+      `client_id=${encodeURIComponent(CLIENT_ID)}&` +
+      `token_type_hint=refresh_token&` +
+      `token=${encodeURIComponent(LocalState.refreshToken?.value || "")}`;
+
+    const response = await fetch(REVOKE_URL, {
+      method: "POST",
+      body,
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+      },
+    });
+    await response.text(); // blank text? would be nice if it was something meaningful
+    logger.log(
+      "💁  Wrangler is configured with an OAuth token. The token has been successfully revoked"
+    );
   }
   const body =
     `client_id=${encodeURIComponent(CLIENT_ID)}&` +
     `token_type_hint=refresh_token&` +
-    `token=${encodeURIComponent(refreshToken?.value || "")}`;
+    `token=${encodeURIComponent(LocalState.refreshToken?.value || "")}`;
 
   const response = await fetch(REVOKE_URL, {
     method: "POST",
@@ -939,91 +1047,87 @@ export async function logout(): Promise<void> {
     },
   });
   await response.text(); // blank text? would be nice if it was something meaningful
-  console.log(
-    "💁  Wrangler is configured with an OAuth token. The token has been successfully revoked"
-  );
-  // delete the file
-  await rm(path.join(os.homedir(), ".wrangler/config/default.toml"));
-  console.log(
-    `Removing ${os.homedir()}/.wrangler/config/default.toml.. success!`
-  );
+  rmSync(path.join(os.homedir(), USER_AUTH_CONFIG_FILE));
+  logger.log(`Successfully logged out.`);
 }
 
-export function listScopes(): void {
-  throwIfNotInitialised();
-  console.log("💁 Available scopes:");
-  const data = Scopes.map((scope, index) => ({
+export function listScopes(message = "💁 Available scopes:"): void {
+  logger.log(message);
+  const data = ScopeKeys.map((scope: Scope) => ({
     Scope: scope,
-    Description: ScopeDescriptions[index],
+    Description: Scopes[scope],
   }));
   render(<Table data={data} />);
   // TODO: maybe a good idea to show usage here
 }
 
-export async function getAccountId() {
+export async function getAccountId(): Promise<string | undefined> {
   const apiToken = getAPIToken();
   if (!apiToken) return;
 
-  if (process.env.CF_ACCOUNT_ID) {
-    return process.env.CF_ACCOUNT_ID;
+  const accounts = await getAccountChoices();
+  if (accounts.length === 1) {
+    return accounts[0].id;
   }
 
-  let response: Response;
-  try {
-    response = await fetch(`${CF_API_BASE_URL}/memberships`, {
-      method: "GET",
-      headers: {
-        Authorization: "Bearer " + apiToken,
-      },
+  if (isInteractive()) {
+    return await new Promise((resolve, reject) => {
+      const { unmount } = render(
+        <ChooseAccount
+          accounts={accounts}
+          onSelect={async (selected) => {
+            resolve(selected);
+            unmount();
+          }}
+          onError={(err) => {
+            reject(err);
+            unmount();
+          }}
+        />
+      );
     });
-  } catch (err) {
-    // probably offline
   }
-  if (!response) return;
-  let accountId: string;
-  // @ts-expect-error need to type this response
-  const responseJSON: {
-    success: boolean;
-    result: { id: string; account: { id: string; name: string } }[];
-  } = await response.json();
-
-  if (responseJSON.success === true) {
-    if (responseJSON.result.length === 1) {
-      accountId = responseJSON.result[0].account.id;
-    } else {
-      accountId = await new Promise((resolve) => {
-        const accounts = responseJSON.result.map((x) => x.account);
-        const { unmount } = render(
-          <ChooseAccount
-            accounts={accounts}
-            onSelect={async (selected) => {
-              resolve(selected.value.id);
-              unmount();
-            }}
-          />
-        );
-      });
-    }
+
+  throw new Error(
+    "More than one account available but unable to select one in non-interactive mode.\n" +
+      `Please set the appropriate \`account_id\` in your \`wrangler.toml\` file.\n` +
+      `Available accounts are ("<name>" - "<id>"):\n` +
+      accounts
+        .map((account) => `  "${account.name}" - "${account.id}")`)
+        .join("\n")
+  );
+}
+
+/**
+ * Ensure that a user is logged in, and a valid account_id is available.
+ */
+export async function requireAuth(config: {
+  account_id?: string;
+}): Promise<string> {
+  const loggedIn = await loginOrRefreshIfRequired();
+  if (!loggedIn) {
+    // didn't login, let's just quit
+    throw new Error("Did not login, quitting...");
+  }
+  const accountId = config.account_id || (await getAccountId());
+  if (!accountId) {
+    throw new Error("No account id found, quitting...");
   }
+
   return accountId;
 }
 
-type ChooseAccountItem = {
-  id: string;
-  name: string;
-};
-export function ChooseAccount(props: {
-  accounts: ChooseAccountItem[];
-  onSelect: (item) => void;
-}) {
-  return (
-    <SelectInput
-      items={props.accounts.map((item) => ({
-        key: item.id,
-        label: item.name,
-        value: item,
-      }))}
-      onSelect={props.onSelect}
-    />
-  );
+/**
+ * Throw an error if there is no API token available.
+ */
+export function requireApiToken(): string {
+  const authToken = getAPIToken();
+  if (!authToken) {
+    throw new Error("No API token found.");
+  }
+  return authToken;
+}
+
+function isInteractive(): boolean {
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY);
 }