wrangler 0.0.0-e043479 → 0.0.0-e0b9366

package/src/selfsigned.d.ts

@@ -0,0 +1,29 @@
+declare module "selfsigned" {
+  import type { pki } from "node-forge";
+
+  export type Attributes = pki.CertificateField[];
+
+  export interface Options {
+    days?: number;
+    keySize?: number;
+    extensions?: unknown[];
+    algorithm?: string;
+    pkcs7?: boolean;
+    clientCertificate?: boolean;
+    clientCertificateCN?: string;
+  }
+
+  export interface Certificate {
+    private: string;
+    public: string;
+    cert: string;
+    fingerprint: string;
+  }
+
+  export function generate(attrs?: Attributes, options?: Options): Certificate;
+  export function generate(
+    attrs: Attributes,
+    options: Options,
+    callback: (err: Error, certificate: Certificate) => void
+  ): void;
+}

package/src/sites.tsx

@@ -4,32 +4,31 @@ import ignore from "ignore";
 import xxhash from "xxhash-wasm";
 import {
   createNamespace,
+  getKeyValue,
   listNamespaceKeys,
   listNamespaces,
   putBulkKeyValue,
 } from "./kv";
 import type { Config } from "./config";
-import type { KeyValue } from "./kv";
+import type { KeyValue, NamespaceKeyInfo } from "./kv";
 import type { XXHashAPI } from "xxhash-wasm";
 
 /** Paths to always ignore. */
-const ALWAYS_IGNORE = ["node_modules"];
-const HIDDEN_FILES_TO_INCLUDE = [
+const ALWAYS_IGNORE = new Set(["node_modules"]);
+const HIDDEN_FILES_TO_INCLUDE = new Set([
   ".well-known", // See https://datatracker.ietf.org/doc/html/rfc8615
-];
+]);
+const FIVE_MINUTES = 60 * 5; // expressed in seconds, since that's what the api expects
 
 async function* getFilesInFolder(dirPath: string): AsyncIterable<string> {
   const files = await readdir(dirPath, { withFileTypes: true });
   for (const file of files) {
     // Skip files that we never want to process.
-    if (ALWAYS_IGNORE.some((p) => file.name === p)) {
+    if (ALWAYS_IGNORE.has(file.name)) {
       continue;
     }
     // Skip hidden files (starting with .) except for some special ones
-    if (
-      file.name.startsWith(".") &&
-      !HIDDEN_FILES_TO_INCLUDE.some((p) => file.name === p)
-    ) {
+    if (file.name.startsWith(".") && !HIDDEN_FILES_TO_INCLUDE.has(file.name)) {
       continue;
     }
     // TODO: follow symlinks??
@@ -126,16 +125,18 @@ export async function syncAssets(
 
   // let's get all the keys in this namespace
   const result = await listNamespaceKeys(accountId, namespace);
-  const keys = new Set(result.map((x) => x.name));
+  const keyMap = result.reduce<Record<string, NamespaceKeyInfo>>(
+    (km, key) => Object.assign(km, { [key.name]: key }),
+    {}
+  );
 
   const manifest: Record<string, string> = {};
-  const upload: KeyValue[] = [];
+  const toUpload: KeyValue[] = [];
 
   const include = createPatternMatcher(siteAssets.includePatterns, false);
   const exclude = createPatternMatcher(siteAssets.excludePatterns, true);
   const hasher = await xxhash();
 
-  // TODO: this can be more efficient by parallelising
   for await (const file of getFilesInFolder(siteAssets.baseDirectory)) {
     if (!include(file)) {
       continue;
@@ -148,13 +149,13 @@ export async function syncAssets(
     console.log(`reading ${file}...`);
     const content = await readFile(file, "base64");
 
-    const assetKey = await hashAsset(hasher, file, content);
+    const assetKey = hashAsset(hasher, file, content);
     validateAssetKey(assetKey);
 
     // now put each of the files into kv
-    if (!keys.has(assetKey)) {
+    if (!(assetKey in keyMap) || keyMap[assetKey].expiration) {
       console.log(`uploading as ${assetKey}...`);
-      upload.push({
+      toUpload.push({
         key: assetKey,
         value: content,
         base64: true,
@@ -162,9 +163,43 @@ export async function syncAssets(
     } else {
       console.log(`skipping - already uploaded`);
     }
+    // remove the key from the set so we know we've seen it
+    delete keyMap[assetKey];
     manifest[path.relative(siteAssets.baseDirectory, file)] = assetKey;
   }
-  await putBulkKeyValue(accountId, namespace, upload, () => {});
+
+  // `keyMap` now contains the assets that we need to expire
+
+  let toExpire: KeyValue[] = [];
+  for (const asset of Object.values(keyMap)) {
+    if (!asset.expiration) {
+      console.log(`expiring unused ${asset.name}...`);
+      toExpire.push({
+        key: asset.name,
+        value: "", // we'll fill all the values in one go
+        // we use expiration_ttl, since we can't trust the time
+        // that a deploy source might provide (eg - https://github.com/cloudflare/wrangler/issues/2224)
+        expiration_ttl: FIVE_MINUTES,
+        base64: true,
+      });
+    }
+  }
+
+  // TODO: batch these in groups if it causes problems
+  toExpire = await Promise.all(
+    toExpire.map(async (asset) => ({
+      ...asset,
+      // it would be great if we didn't have to do this fetch at all
+      value: await getKeyValue(accountId, namespace, asset.key),
+    }))
+  );
+
+  await putBulkKeyValue(
+    accountId,
+    namespace,
+    toUpload.concat(toExpire),
+    () => {}
+  );
   return { manifest, namespace };
 }
 

package/src/user.tsx

@@ -207,7 +207,7 @@
 
 import assert from "node:assert";
 import { webcrypto as crypto } from "node:crypto";
-import { readFile, writeFile, rm, mkdir } from "node:fs/promises";
+import { writeFileSync, mkdirSync, rmSync } from "node:fs";
 import http from "node:http";
 import os from "node:os";
 import path from "node:path";
@@ -222,6 +222,7 @@ import { fetch } from "undici";
 import { getCloudflareApiBaseUrl } from "./cfetch";
 import { getEnvironmentVariableFactory } from "./environment-variables";
 import openInBrowser from "./open-in-browser";
+import { readFileSync } from "./parse";
 import type { Item as SelectInputItem } from "ink-select-input/build/SelectInput";
 import type { ParsedUrlQuery } from "node:querystring";
 import type { Response } from "undici";
@@ -251,17 +252,45 @@ interface PKCECodes {
   codeVerifier: string;
 }
 
-interface State {
-  accessToken?: AccessToken; // persist
+/**
+ * The module level state of the authentication flow.
+ */
+interface State extends AuthTokens {
   authorizationCode?: string;
   codeChallenge?: string;
   codeVerifier?: string;
   hasAuthCodeBeenExchangedForAccessToken?: boolean;
-  refreshToken?: RefreshToken; // persist
   stateQueryParam?: string;
   scopes?: Scope[];
 }
 
+/**
+ * The tokens related to authentication.
+ */
+interface AuthTokens {
+  accessToken?: AccessToken;
+  refreshToken?: RefreshToken;
+  /** @deprecated - this field was only provided by the deprecated `wrangler1 config` command. */
+  apiToken?: string;
+}
+
+/**
+ * The path to the config file that holds user authentication data,
+ * relative to the user's home directory.
+ */
+export const USER_AUTH_CONFIG_FILE = ".wrangler/config/default.toml";
+
+/**
+ * The data that may be read from the `USER_CONFIG_FILE`.
+ */
+export interface UserAuthConfig {
+  oauth_token?: string;
+  refresh_token?: string;
+  expiration_time?: string;
+  /** @deprecated - this field was only provided by the deprecated `wrangler1 config` command. */
+  api_token?: string;
+}
+
 interface RefreshToken {
   value: string;
 }
@@ -285,6 +314,8 @@ const Scopes = {
   "workers_scripts:write":
     "See and change Cloudflare Workers scripts, durable objects, subdomains, triggers, and tail data.",
   "workers_tail:read": "See Cloudflare Workers tail and script data.",
+  "pages:write":
+    "See and change Cloudflare Pages projects, settings and deployments.",
   "zone:read": "Grants read level access to account zone.",
 } as const;
 
@@ -309,60 +340,63 @@ const TOKEN_URL = "https://dash.cloudflare.com/oauth2/token";
 const CALLBACK_URL = "http://localhost:8976/oauth/callback";
 const REVOKE_URL = "https://dash.cloudflare.com/oauth2/revoke";
 
-const LocalState: State = {};
-let initialised = false;
+let LocalState: State = getAuthTokens();
 
-// we do this because we have some async stuff
-// TODO: this should just happen in the top level
-// and we should figure out how to do top level await
-export async function initialise(): Promise<void> {
+/**
+ * Compute the current auth tokens.
+ */
+function getAuthTokens(): AuthTokens {
   // get refreshToken/accessToken from fs if exists
   try {
     // if the environment variable is available, use that
     const apiTokenFromEnv = getCloudflareAPITokenFromEnv();
     if (apiTokenFromEnv) {
-      LocalState.accessToken = {
-        value: apiTokenFromEnv,
-        expiry: "3021-12-31T23:59:59+00:00",
+      return {
+        accessToken: {
+          value: apiTokenFromEnv,
+          expiry: "3021-12-31T23:59:59+00:00",
+        },
       };
-      initialised = true;
-      return;
     }
 
-    const toml = TOML.parse(
-      await readFile(path.join(os.homedir(), ".wrangler/config/default.toml"), {
-        encoding: "utf-8",
-      })
-    );
-    const { oauth_token, refresh_token, expiration_time } = toml as {
-      oauth_token: string;
-      refresh_token: string;
-      expiration_time: string;
-    };
+    // otherwise try loading from the user auth config file.
+    const { oauth_token, refresh_token, expiration_time, api_token } =
+      readAuthConfigFile();
+
     if (oauth_token) {
-      LocalState.accessToken = { value: oauth_token, expiry: expiration_time };
-    }
-    if (refresh_token) {
-      LocalState.refreshToken = { value: refresh_token };
+      return {
+        accessToken: {
+          value: oauth_token,
+          // If there is no `expiration_time` field then set it to an old date, to cause it to expire immediately.
+          expiry: expiration_time ?? "2000-01-01:00:00:00+00:00",
+        },
+        refreshToken: { value: refresh_token ?? "" },
+      };
+    } else if (api_token) {
+      return { apiToken: api_token };
+    } else {
+      return {};
     }
-  } catch (err) {
-    // no config yet, let's chill
-    // console.error(err);
+  } catch {
+    return {};
   }
-  initialised = true;
 }
 
-// ugh. TODO: see fix from above.
-function throwIfNotInitialised() {
-  if (initialised === false) {
-    throw new Error(
-      "did you forget to call initialise() from the user module?"
-    );
-  }
+/**
+ * Run the initialisation of the auth state, in the case that something changed.
+ */
+export function reinitialiseAuthTokens(): void {
+  LocalState = getAuthTokens();
 }
 
 export function getAPIToken(): string | undefined {
-  throwIfNotInitialised();
+  if (LocalState.apiToken) {
+    console.warn(
+      "It looks like you have used Wrangler 1's `config` command to login with an API token.\n" +
+        "This is no longer supported in the current version of Wrangler.\n" +
+        "If you wish to authenticate via an API token then please set the `CLOUDFLARE_API_TOKEN` environment variable."
+    );
+  }
   return LocalState.accessToken?.value;
 }
 
@@ -798,21 +832,24 @@ function generateRandomState(lengthOfState: number): string {
     .join("");
 }
 
-async function writeToConfigFile(tokenData: AccessContext) {
-  await mkdir(path.join(os.homedir(), ".wrangler/config/"), {
+export function writeAuthConfigFile(config: UserAuthConfig) {
+  mkdirSync(path.join(os.homedir(), ".wrangler/config/"), {
     recursive: true,
   });
-  await writeFile(
-    path.join(os.homedir(), ".wrangler/config/default.toml"),
-    `
-oauth_token = "${tokenData.token?.value || ""}"
-refresh_token = "${tokenData.refreshToken?.value}"
-expiration_time = "${tokenData.token?.expiry}"
-`,
+  writeFileSync(
+    path.join(os.homedir(), USER_AUTH_CONFIG_FILE),
+    TOML.stringify(config as TOML.JsonMap),
     { encoding: "utf-8" }
   );
 }
 
+function readAuthConfigFile(): UserAuthConfig {
+  const toml = TOML.parse(
+    readFileSync(path.join(os.homedir(), USER_AUTH_CONFIG_FILE))
+  );
+  return toml;
+}
+
 type LoginProps = {
   scopes?: Scope[];
 };
@@ -822,7 +859,7 @@ export async function loginOrRefreshIfRequired(
 ): Promise<boolean> {
   // TODO: if there already is a token, then try refreshing
   // TODO: ask permission before opening browser
-  if (!LocalState.accessToken) {
+  if (!getAPIToken()) {
     // Not logged in.
     // If we are not interactive, we cannot ask the user to login
     return isInteractive && (await login());
@@ -834,6 +871,7 @@ export async function loginOrRefreshIfRequired(
 }
 
 export async function login(props?: LoginProps): Promise<boolean> {
+  console.log("Attempting to login via OAuth...");
   const urlToOpen = await getAuthURL(props?.scopes);
   await openInBrowser(urlToOpen);
   let server: http.Server;
@@ -892,8 +930,12 @@ export async function login(props?: LoginProps): Promise<boolean> {
             finish(false, new ErrorNoAuthCode());
             return;
           } else {
-            const tokenData = await exchangeAuthCodeForAccessToken();
-            await writeToConfigFile(tokenData);
+            const exchange = await exchangeAuthCodeForAccessToken();
+            writeAuthConfigFile({
+              oauth_token: exchange.token?.value ?? "",
+              expiration_time: exchange.token?.expiry,
+              refresh_token: exchange.refreshToken?.value,
+            });
             res.writeHead(307, {
               Location:
                 "https://welcome.developers.workers.dev/wrangler-oauth-consent-granted",
@@ -901,9 +943,7 @@ export async function login(props?: LoginProps): Promise<boolean> {
             res.end(() => {
               finish(true);
             });
-            console.log(
-              `Successfully configured. You can find your configuration file at: ${os.homedir()}/.wrangler/config/default.toml`
-            );
+            console.log(`Successfully logged in.`);
 
             return;
           }
@@ -920,18 +960,22 @@ export async function login(props?: LoginProps): Promise<boolean> {
 /**
  * Checks to see if the access token has expired.
  */
-export function isAccessTokenExpired(): boolean {
-  throwIfNotInitialised();
+function isAccessTokenExpired(): boolean {
   const { accessToken } = LocalState;
   return Boolean(accessToken && new Date() >= new Date(accessToken.expiry));
 }
 
-export async function refreshToken(): Promise<boolean> {
-  throwIfNotInitialised();
+async function refreshToken(): Promise<boolean> {
   // refresh
   try {
-    const refreshed = await exchangeRefreshTokenForAccessToken();
-    await writeToConfigFile(refreshed);
+    const {
+      token: { value: oauth_token, expiry: expiration_time } = {
+        value: "",
+        expiry: "",
+      },
+      refreshToken: { value: refresh_token } = {},
+    } = await exchangeRefreshTokenForAccessToken();
+    writeAuthConfigFile({ oauth_token, expiration_time, refresh_token });
     return true;
   } catch (err) {
     console.error(err);
@@ -940,10 +984,28 @@ export async function refreshToken(): Promise<boolean> {
 }
 
 export async function logout(): Promise<void> {
-  throwIfNotInitialised();
-  if (!LocalState.refreshToken) {
-    console.log("Not logged in, exiting...");
-    return;
+  if (!LocalState.accessToken) {
+    if (!LocalState.refreshToken) {
+      console.log("Not logged in, exiting...");
+      return;
+    }
+
+    const body =
+      `client_id=${encodeURIComponent(CLIENT_ID)}&` +
+      `token_type_hint=refresh_token&` +
+      `token=${encodeURIComponent(LocalState.refreshToken?.value || "")}`;
+
+    const response = await fetch(REVOKE_URL, {
+      method: "POST",
+      body,
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+      },
+    });
+    await response.text(); // blank text? would be nice if it was something meaningful
+    console.log(
+      "💁  Wrangler is configured with an OAuth token. The token has been successfully revoked"
+    );
   }
   const body =
     `client_id=${encodeURIComponent(CLIENT_ID)}&` +
@@ -958,19 +1020,12 @@ export async function logout(): Promise<void> {
     },
   });
   await response.text(); // blank text? would be nice if it was something meaningful
-  console.log(
-    "💁  Wrangler is configured with an OAuth token. The token has been successfully revoked"
-  );
-  // delete the file
-  await rm(path.join(os.homedir(), ".wrangler/config/default.toml"));
-  console.log(
-    `Removing ${os.homedir()}/.wrangler/config/default.toml.. success!`
-  );
+  rmSync(path.join(os.homedir(), USER_AUTH_CONFIG_FILE));
+  console.log(`Successfully logged out.`);
 }
 
-export function listScopes(): void {
-  throwIfNotInitialised();
-  console.log("💁 Available scopes:");
+export function listScopes(message = "💁 Available scopes:"): void {
+  console.log(message);
   const data = ScopeKeys.map((scope: Scope) => ({
     Scope: scope,
     Description: Scopes[scope],

package/src/{api/worker.ts → worker.ts}

@@ -1,7 +1,3 @@
-import { fetch } from "undici";
-import { previewToken } from "./preview";
-import type { CfPreviewToken } from "./preview";
-
 /**
  * A Cloudflare account.
  */
@@ -165,22 +161,3 @@ export interface CfWorkerContext {
   legacyEnv: boolean | undefined;
   zone: { id: string; host: string } | undefined;
 }
-
-/**
- * A stub to create a Cloudflare Worker preview.
- *
- * @example
- * const {value, host} = await createWorker(init, acct);
- */
-export async function createWorker(
-  init: CfWorkerInit,
-  account: CfAccount,
-  ctx: CfWorkerContext
-): Promise<CfPreviewToken> {
-  const token = await previewToken(account, init, ctx);
-  const response = await fetch(token.prewarmUrl.href, { method: "POST" });
-  if (!response.ok) {
-    // console.error("worker failed to prewarm: ", response.statusText);
-  }
-  return token;
-}