wrangler 0.0.0-e178d6fb → 0.0.0-e1c2f5b9

package/src/user/user.tsx

@@ -224,17 +224,52 @@ import {
 	saveToConfigCache,
 } from "../config-cache";
 import { getGlobalWranglerConfigPath } from "../global-wrangler-config-path";
+import { CI } from "../is-ci";
 import isInteractive from "../is-interactive";
 import { logger } from "../logger";
 import openInBrowser from "../open-in-browser";
 import { parseTOML, readFileSync } from "../parse";
+import { domainUsesAccess } from "./access";
+import {
+	getAuthDomainFromEnv,
+	getAuthUrlFromEnv,
+	getClientIdFromEnv,
+	getCloudflareAccessToken,
+	getCloudflareAPITokenFromEnv,
+	getCloudflareGlobalAuthEmailFromEnv,
+	getCloudflareGlobalAuthKeyFromEnv,
+	getRevokeUrlFromEnv,
+	getTokenUrlFromEnv,
+} from "./auth-variables";
 import { ChooseAccount, getAccountChoices } from "./choose-account";
-import { getAuthFromEnv } from "./env-vars";
 import { generateAuthUrl } from "./generate-auth-url";
 import { generateRandomState } from "./generate-random-state";
-import type { ApiCredentials } from "./env-vars";
 import type { ParsedUrlQuery } from "node:querystring";
 
+export type ApiCredentials =
+	| {
+			apiToken: string;
+	  }
+	| {
+			authKey: string;
+			authEmail: string;
+	  };
+
+/**
+ * Try to read an API token or Global Auth from the environment.
+ */
+export function getAuthFromEnv(): ApiCredentials | undefined {
+	const globalApiKey = getCloudflareGlobalAuthKeyFromEnv();
+	const globalApiEmail = getCloudflareGlobalAuthEmailFromEnv();
+	const apiToken = getCloudflareAPITokenFromEnv();
+
+	if (globalApiKey && globalApiEmail) {
+		return { authKey: globalApiKey, authEmail: globalApiEmail };
+	} else if (apiToken) {
+		return { apiToken };
+	}
+}
+
 /**
  * An implementation of rfc6749#section-4.1 and rfc7636.
  */
@@ -262,6 +297,7 @@ interface State extends AuthTokens {
 interface AuthTokens {
 	accessToken?: AccessToken;
 	refreshToken?: RefreshToken;
+	scopes?: Scope[];
 	/** @deprecated - this field was only provided by the deprecated `wrangler1 config` command. */
 	apiToken?: string;
 }
@@ -279,6 +315,7 @@ export interface UserAuthConfig {
 	oauth_token?: string;
 	refresh_token?: string;
 	expiration_time?: string;
+	scopes?: string[];
 	/** @deprecated - this field was only provided by the deprecated `wrangler1 config` command. */
 	api_token?: string;
 }
@@ -306,6 +343,7 @@ const Scopes = {
 	"workers_scripts:write":
 		"See and change Cloudflare Workers scripts, durable objects, subdomains, triggers, and tail data.",
 	"workers_tail:read": "See Cloudflare Workers tail and script data.",
+	"d1:write": "See and change D1 Databases.",
 	"pages:write":
 		"See and change Cloudflare Pages projects, settings and deployments.",
 	"zone:read": "Grants read level access to account zone.",
@@ -326,11 +364,6 @@ export function validateScopeKeys(
 	return scopes.every((scope) => scope in Scopes);
 }
 
-const CLIENT_ID = "54d11594-84e4-41aa-b438-e81b8fa78ee7";
-const AUTH_URL = "https://dash.cloudflare.com/oauth2/auth";
-const TOKEN_URL = "https://dash.cloudflare.com/oauth2/token";
-const REVOKE_URL = "https://dash.cloudflare.com/oauth2/revoke";
-
 /**
  * To allow OAuth callbacks in environments such as WebContainer we need to
  * create a host URL which only resolves `localhost` to a WebContainer
@@ -355,7 +388,7 @@ function getAuthTokens(config?: UserAuthConfig): AuthTokens | undefined {
 		if (getAuthFromEnv()) return;
 
 		// otherwise try loading from the user auth config file.
-		const { oauth_token, refresh_token, expiration_time, api_token } =
+		const { oauth_token, refresh_token, expiration_time, scopes, api_token } =
 			config || readAuthConfigFile();
 
 		if (oauth_token) {
@@ -366,6 +399,7 @@ function getAuthTokens(config?: UserAuthConfig): AuthTokens | undefined {
 					expiry: expiration_time ?? "2000-01-01:00:00:00+00:00",
 				},
 				refreshToken: { value: refresh_token ?? "" },
+				scopes: scopes as Scope[],
 			};
 		} else if (api_token) {
 			logger.warn(
@@ -381,7 +415,7 @@ function getAuthTokens(config?: UserAuthConfig): AuthTokens | undefined {
 }
 
 /**
- * Run the initialisation of the auth state, in the case that something changed.
+ * Run the initialization of the auth state, in the case that something changed.
  *
  * This runs automatically whenever `writeAuthConfigFile` is run, so generally
  * you won't need to call it yourself.
@@ -620,8 +654,8 @@ export async function getAuthURL(scopes = ScopeKeys): Promise<string> {
 	});
 
 	return generateAuthUrl({
-		authUrl: AUTH_URL,
-		clientId: CLIENT_ID,
+		authUrl: getAuthUrlFromEnv(),
+		clientId: getClientIdFromEnv(),
 		callbackUrl: CALLBACK_URL,
 		scopes,
 		stateQueryParam,
@@ -648,19 +682,14 @@ async function exchangeRefreshTokenForAccessToken(): Promise<AccessContext> {
 		logger.warn("No refresh token is present.");
 	}
 
-	const body =
-		`grant_type=refresh_token&` +
-		`refresh_token=${LocalState.refreshToken?.value}&` +
-		`client_id=${CLIENT_ID}`;
-
-	const response = await fetch(TOKEN_URL, {
-		method: "POST",
-		body,
-		headers: {
-			"Content-Type": "application/x-www-form-urlencoded",
-		},
+	const params = new URLSearchParams({
+		grant_type: "refresh_token",
+		refresh_token: LocalState.refreshToken?.value ?? "",
+		client_id: getClientIdFromEnv(),
 	});
 
+	const response = await fetchAuthToken(params);
+
 	if (response.status >= 400) {
 		let tokenExchangeResErr = undefined;
 
@@ -738,20 +767,15 @@ async function exchangeAuthCodeForAccessToken(): Promise<AccessContext> {
 		logger.warn("No authorization grant code is being passed.");
 	}
 
-	const body =
-		`grant_type=authorization_code&` +
-		`code=${encodeURIComponent(authorizationCode || "")}&` +
-		`redirect_uri=${encodeURIComponent(CALLBACK_URL)}&` +
-		`client_id=${encodeURIComponent(CLIENT_ID)}&` +
-		`code_verifier=${codeVerifier}`;
-
-	const response = await fetch(TOKEN_URL, {
-		method: "POST",
-		body,
-		headers: {
-			"Content-Type": "application/x-www-form-urlencoded",
-		},
+	const params = new URLSearchParams({
+		grant_type: `authorization_code`,
+		code: authorizationCode ?? "",
+		redirect_uri: CALLBACK_URL,
+		client_id: getClientIdFromEnv(),
+		code_verifier: codeVerifier,
 	});
+
+	const response = await fetchAuthToken(params);
 	if (!response.ok) {
 		const { error } = (await response.json()) as { error: string };
 		// .catch((_) => ({ error: "invalid_json" }));
@@ -870,15 +894,17 @@ export function readAuthConfigFile(): UserAuthConfig {
 
 type LoginProps = {
 	scopes?: Scope[];
+	browser: boolean;
 };
 
 export async function loginOrRefreshIfRequired(): Promise<boolean> {
 	// TODO: if there already is a token, then try refreshing
 	// TODO: ask permission before opening browser
+	const { isCI } = CI;
 	if (!getAPIToken()) {
 		// Not logged in.
 		// If we are not interactive, we cannot ask the user to login
-		return isInteractive() && (await login());
+		return isInteractive() && !isCI() && (await login());
 	} else if (isAccessTokenExpired()) {
 		// We're logged in, but the refresh token seems to have expired,
 		// so let's try to refresh it
@@ -888,14 +914,16 @@ export async function loginOrRefreshIfRequired(): Promise<boolean> {
 			return true;
 		} else {
 			// If the refresh token isn't valid, then we ask the user to login again
-			return isInteractive() && (await login());
+			return isInteractive() && !isCI() && (await login());
 		}
 	} else {
 		return true;
 	}
 }
 
-export async function login(props?: LoginProps): Promise<boolean> {
+export async function login(
+	props: LoginProps = { browser: true }
+): Promise<boolean> {
 	logger.log("Attempting to login via OAuth...");
 	const urlToOpen = await getAuthURL(props?.scopes);
 	let server: http.Server;
@@ -908,7 +936,7 @@ export async function login(props?: LoginProps): Promise<boolean> {
 			server.close();
 			clearTimeout(loginTimeoutHandle);
 			resolve(false);
-		}, 60000); // wait for 60 seconds for the user to authorize
+		}, 120000); // wait for 120 seconds for the user to authorize
 	});
 
 	const loginPromise = new Promise<boolean>((resolve, reject) => {
@@ -959,6 +987,7 @@ export async function login(props?: LoginProps): Promise<boolean> {
 							oauth_token: exchange.token?.value ?? "",
 							expiration_time: exchange.token?.expiry,
 							refresh_token: exchange.refreshToken?.value,
+							scopes: exchange.scopes,
 						});
 						res.writeHead(307, {
 							Location:
@@ -979,9 +1008,12 @@ export async function login(props?: LoginProps): Promise<boolean> {
 
 		server.listen(8976);
 	});
-
-	logger.log(`Opening a link in your default browser: ${urlToOpen}`);
-	await openInBrowser(urlToOpen);
+	if (props?.browser) {
+		logger.log(`Opening a link in your default browser: ${urlToOpen}`);
+		await openInBrowser(urlToOpen);
+	} else {
+		logger.log(`Visit this link to authenticate: ${urlToOpen}`);
+	}
 
 	return Promise.race([timerPromise, loginPromise]);
 }
@@ -1003,8 +1035,14 @@ async function refreshToken(): Promise<boolean> {
 				expiry: "",
 			},
 			refreshToken: { value: refresh_token } = {},
+			scopes,
 		} = await exchangeRefreshTokenForAccessToken();
-		writeAuthConfigFile({ oauth_token, expiration_time, refresh_token });
+		writeAuthConfigFile({
+			oauth_token,
+			expiration_time,
+			refresh_token,
+			scopes,
+		});
 		return true;
 	} catch (err) {
 		return false;
@@ -1019,11 +1057,11 @@ export async function logout(): Promise<void> {
 		}
 
 		const body =
-			`client_id=${encodeURIComponent(CLIENT_ID)}&` +
+			`client_id=${encodeURIComponent(getClientIdFromEnv())}&` +
 			`token_type_hint=refresh_token&` +
 			`token=${encodeURIComponent(LocalState.refreshToken?.value || "")}`;
 
-		const response = await fetch(REVOKE_URL, {
+		const response = await fetch(getRevokeUrlFromEnv(), {
 			method: "POST",
 			body,
 			headers: {
@@ -1036,11 +1074,11 @@ export async function logout(): Promise<void> {
 		);
 	}
 	const body =
-		`client_id=${encodeURIComponent(CLIENT_ID)}&` +
+		`client_id=${encodeURIComponent(getClientIdFromEnv())}&` +
 		`token_type_hint=refresh_token&` +
 		`token=${encodeURIComponent(LocalState.refreshToken?.value || "")}`;
 
-	const response = await fetch(REVOKE_URL, {
+	const response = await fetch(getRevokeUrlFromEnv(), {
 		method: "POST",
 		body,
 		headers: {
@@ -1078,7 +1116,7 @@ export async function getAccountId(): Promise<string | undefined> {
 		return accounts[0].id;
 	}
 
-	if (isInteractive()) {
+	if (isInteractive() && !CI.isCI()) {
 		const account = await new Promise<{ id: string; name: string }>(
 			(resolve, reject) => {
 				const { unmount } = render(
@@ -1118,7 +1156,7 @@ export async function requireAuth(config: {
 }): Promise<string> {
 	const loggedIn = await loginOrRefreshIfRequired();
 	if (!loggedIn) {
-		if (!isInteractive()) {
+		if (!isInteractive() || CI.isCI()) {
 			throw new Error(
 				"In a non-interactive environment, it's necessary to set a CLOUDFLARE_API_TOKEN environment variable for wrangler to work. Please go to https://developers.cloudflare.com/api/tokens/create/ for instructions on how to create an api token, and assign its value to CLOUDFLARE_API_TOKEN."
 			);
@@ -1169,3 +1207,32 @@ export function getAccountFromCache():
 		"wrangler-account.json"
 	).account;
 }
+
+/**
+ * Get the scopes of the following token, will only return scopes
+ * if the token is an OAuth token.
+ */
+export function getScopes(): Scope[] | undefined {
+	return LocalState.scopes;
+}
+
+/**
+ * Make a request to the Cloudflare OAuth endpoint to get a token.
+ *
+ * Note that the `body` of the POST request is form-urlencoded so
+ * can be represented by a URLSearchParams object.
+ */
+async function fetchAuthToken(body: URLSearchParams) {
+	const headers: Record<string, string> = {
+		"Content-Type": "application/x-www-form-urlencoded",
+	};
+	if (await domainUsesAccess(getAuthDomainFromEnv())) {
+		// We are trying to access the staging API so we need an "access token".
+		headers["Cookie"] = `CF_Authorization=${await getCloudflareAccessToken()}`;
+	}
+	return await fetch(getTokenUrlFromEnv(), {
+		method: "POST",
+		body: body.toString(),
+		headers,
+	});
+}

package/src/utils/collectKeyValues.ts

@@ -0,0 +1,14 @@
+/**
+ * a function that takes an array of strings in `key:value` format
+ * (typically from yargs or config) and returns back
+ * a neat object with the keys and values
+ */
+export function collectKeyValues(array?: string[]) {
+	return (
+		array?.reduce<Record<string, string>>((recordsToCollect, v) => {
+			const [key, ...value] = v.split(":");
+			recordsToCollect[key] = value.join(":");
+			return recordsToCollect;
+		}, {}) || {}
+	);
+}

package/src/whoami.tsx

@@ -1,9 +1,9 @@
 import { Text, render } from "ink";
 import Table from "ink-table";
-import React from "react";
+import React, { Fragment } from "react";
 import { fetchListResult, fetchResult } from "./cfetch";
 import { logger } from "./logger";
-import { getAPIToken, getAuthFromEnv } from "./user";
+import { getAPIToken, getAuthFromEnv, getScopes } from "./user";
 
 export async function whoami() {
 	logger.log("Getting User settings...");
@@ -17,6 +17,10 @@ export function WhoAmI({ user }: { user: UserInfo | undefined }) {
 		<>
 			<Email tokenType={user.authType} email={user.email}></Email>
 			<Accounts accounts={user.accounts}></Accounts>
+			<Permissions
+				tokenType={user.authType}
+				tokenPermissions={user.tokenPermissions}
+			/>
 		</>
 	) : (
 		<Text>You are not authenticated. Please run `wrangler login`.</Text>
@@ -46,17 +50,51 @@ function Accounts(props: { accounts: AccountInfo[] }) {
 	return <Table data={accounts}></Table>;
 }
 
+function Permissions(props: {
+	tokenPermissions: string[] | undefined;
+	tokenType: string;
+}) {
+	const permissions =
+		props.tokenPermissions?.map((scope) => scope.split(":")) || [];
+	return props.tokenType === "OAuth Token" ? (
+		props.tokenPermissions ? (
+			<>
+				<Text>
+					🔓 Token Permissions: If scopes are missing, you may need to logout
+					and re-login.
+				</Text>
+				<Text>Scope (Access)</Text>
+				{permissions.map(([scope, access], index) => (
+					<Fragment key={`${scope}${index}`}>
+						<Text>
+							- {scope} {access && `(${access})`}
+						</Text>
+					</Fragment>
+				))}
+			</>
+		) : null
+	) : (
+		<Text>
+			🔓 To see token permissions visit
+			https://dash.cloudflare.com/profile/api-tokens
+		</Text>
+	);
+}
+
 export interface UserInfo {
 	apiToken: string;
 	authType: string;
 	email: string | undefined;
 	accounts: AccountInfo[];
+	tokenPermissions: string[] | undefined;
 }
 
 export async function getUserInfo(): Promise<UserInfo | undefined> {
 	const apiToken = getAPIToken();
 	if (!apiToken) return;
 
+	const tokenPermissions = await getTokenPermissions();
+
 	const usingEnvAuth = !!getAuthFromEnv();
 	const usingGlobalAuthKey = "authKey" in apiToken;
 	return {
@@ -68,6 +106,7 @@ export async function getUserInfo(): Promise<UserInfo | undefined> {
 			: "OAuth Token",
 		email: "authEmail" in apiToken ? apiToken.authEmail : await getEmail(),
 		accounts: await getAccounts(),
+		tokenPermissions,
 	};
 }
 
@@ -89,3 +128,42 @@ type AccountInfo = { name: string; id: string };
 async function getAccounts(): Promise<AccountInfo[]> {
 	return await fetchListResult<AccountInfo>("/accounts");
 }
+
+async function getTokenPermissions(): Promise<string[] | undefined> {
+	// Tokens can either be API tokens or Oauth tokens.
+	// Here we only extract permissions from OAuth tokens.
+
+	return getScopes() as string[];
+
+	// In future we may be able to get the token permissions on an API token,
+	// but currently we cannot as that permission is not able to be added to
+	// an API token.
+
+	// try {
+	// 	// First we get the token identifier (only returned on API tokens)
+	// 	const { id } = await fetchResult<{ id: string }>("/user/tokens/verify");
+
+	// 	// Get the token permissions for the current token
+	// 	const { policies } = await fetchResult<{
+	// 		policies: { id: string; name: string }[];
+	// 	}>(`/user/tokens/${id}`);
+
+	// 	return policies.map((p) => p.name);
+	// } catch (e) {
+	// 	if ((e as { code?: number }).code === 1000) {
+	// 		// Invalid token - Oauth token
+
+	// 		// Get scopes
+	// 		const scopes = getScopes() as string[];
+	// 		// We may not get scopes back if they are not currently cached,
+	// 		// however next time an access token is requested,
+	// 		// the scopes will be added to the cache.
+	// 		return scopes;
+	// 	} else if ((e as { code?: number }).code === 9109) {
+	// 		// Token cannot view its permissions
+	// 		return undefined;
+	// 	} else {
+	// 		throw e;
+	// 	}
+	// }
+}

package/src/worker.ts

@@ -1,9 +1,11 @@
+import type { Environment } from "./config";
 import type { Route } from "./config/environment";
 import type { ApiCredentials } from "./user";
 
 /**
  * A Cloudflare account.
  */
+
 export interface CfAccount {
 	/**
 	 * An API token.
@@ -65,14 +67,14 @@ export interface CfModule {
 /**
  * A map of variable names to values.
  */
-interface CfVars {
+export interface CfVars {
 	[key: string]: unknown;
 }
 
 /**
  * A KV namespace.
  */
-interface CfKvNamespace {
+export interface CfKvNamespace {
 	binding: string;
 	id: string;
 }
@@ -81,7 +83,7 @@ interface CfKvNamespace {
  * A binding to a wasm module (in service-worker format)
  */
 
-interface CfWasmModuleBindings {
+export interface CfWasmModuleBindings {
 	[key: string]: string;
 }
 
@@ -89,7 +91,7 @@ interface CfWasmModuleBindings {
  * A binding to a text blob (in service-worker format)
  */
 
-interface CfTextBlobBindings {
+export interface CfTextBlobBindings {
 	[key: string]: string;
 }
 
@@ -97,36 +99,71 @@ interface CfTextBlobBindings {
  * A binding to a data blob (in service-worker format)
  */
 
-interface CfDataBlobBindings {
+export interface CfDataBlobBindings {
 	[key: string]: string;
 }
 
 /**
  * A Durable Object.
  */
-interface CfDurableObject {
+export interface CfDurableObject {
 	name: string;
 	class_name: string;
 	script_name?: string;
 	environment?: string;
 }
 
-interface CfR2Bucket {
+export interface CfQueue {
+	binding: string;
+	queue_name: string;
+}
+
+export interface CfR2Bucket {
 	binding: string;
 	bucket_name: string;
 }
 
+export const D1_BETA_PREFIX = `__D1_BETA__` as const;
+export type D1PrefixedBinding = `${typeof D1_BETA_PREFIX}${string}`;
+
+// TODO: figure out if this is duplicated in packages/wrangler/src/config/environment.ts
+export interface CfD1Database {
+	// For now, all D1 bindings are alpha
+	binding: D1PrefixedBinding;
+	database_id: string;
+	database_name?: string;
+	preview_database_id?: string;
+	database_internal_env?: string;
+	migrations_table?: string;
+	migrations_dir?: string;
+}
+
 interface CfService {
 	binding: string;
 	service: string;
 	environment?: string;
 }
 
-interface CfWorkerNamespace {
+interface CfAnalyticsEngineDataset {
+	binding: string;
+	dataset?: string;
+}
+
+interface CfDispatchNamespace {
 	binding: string;
 	namespace: string;
 }
 
+interface CfLogfwdr {
+	schema: string | undefined;
+	bindings: CfLogfwdrBinding[];
+}
+
+interface CfLogfwdrBinding {
+	name: string;
+	destination: string;
+}
+
 interface CfUnsafeBinding {
 	name: string;
 	type: string;
@@ -171,15 +208,21 @@ export interface CfWorkerInit {
 		text_blobs: CfTextBlobBindings | undefined;
 		data_blobs: CfDataBlobBindings | undefined;
 		durable_objects: { bindings: CfDurableObject[] } | undefined;
+		queues: CfQueue[] | undefined;
 		r2_buckets: CfR2Bucket[] | undefined;
+		d1_databases: CfD1Database[] | undefined;
 		services: CfService[] | undefined;
-		worker_namespaces: CfWorkerNamespace[] | undefined;
+		analytics_engine_datasets: CfAnalyticsEngineDataset[] | undefined;
+		dispatch_namespaces: CfDispatchNamespace[] | undefined;
+		logfwdr: CfLogfwdr | undefined;
 		unsafe: CfUnsafeBinding[] | undefined;
 	};
 	migrations: CfDurableObjectMigrations | undefined;
 	compatibility_date: string | undefined;
 	compatibility_flags: string[] | undefined;
 	usage_model: "bundled" | "unbound" | undefined;
+	keepVars: boolean | undefined;
+	logpush: boolean | undefined;
 }
 
 export interface CfWorkerContext {
@@ -188,4 +231,21 @@ export interface CfWorkerContext {
 	zone: string | undefined;
 	host: string | undefined;
 	routes: Route[] | undefined;
+	sendMetrics: boolean | undefined;
+}
+
+// Prefix binding with identifier which will then get picked up by the D1 shim.
+// Once the D1 Api is out of beta, this function can be removed.
+export function identifyD1BindingsAsBeta(
+	dbs: Environment["d1_databases"]
+): CfD1Database[] | undefined {
+	return dbs?.map((db) => ({
+		...db,
+		binding: `${D1_BETA_PREFIX}${db.binding}`,
+	}));
+}
+
+// Remove beta prefix
+export function removeD1BetaPrefix(binding: D1PrefixedBinding): string {
+	return binding.slice(D1_BETA_PREFIX.length);
 }

package/src/yargs-types.ts

@@ -0,0 +1,24 @@
+import type { ArgumentsCamelCase, Argv } from "yargs";
+
+/**
+ * Yargs options included in every wrangler command.
+ */
+export interface CommonYargsOptions {
+	v: boolean | undefined;
+	config: string | undefined;
+	env: string | undefined;
+}
+
+export type YargvToInterface<T> = T extends Argv<infer P>
+	? ArgumentsCamelCase<P>
+	: never;
+
+/**
+ * Given some Yargs Options function factory, extract the interface
+ * that corresponds to the yargs arguments
+ */
+export type YargsOptionsToInterface<
+	T extends (yargs: Argv<CommonYargsOptions>) => Argv
+> = T extends (yargs: Argv<CommonYargsOptions>) => Argv<infer P>
+	? ArgumentsCamelCase<P>
+	: never;