wrangler 0.0.0-e928f94 → 0.0.0-e95bea2

package/src/user.tsx

@@ -1,6 +1,6 @@
 /* Based heavily on code from https://github.com/BitySA/oauth2-auth-code-pkce */
 
-/* 
+/*
 
                                  Apache License
                            Version 2.0, January 2004
@@ -205,25 +205,42 @@
    limitations under the License.
   */
 
-import React from "react";
-import { render } from "ink";
-import Table from "ink-table";
-import SelectInput from "ink-select-input";
-import fetch from "node-fetch";
+import assert from "node:assert";
 import { webcrypto as crypto } from "node:crypto";
-import { TextEncoder } from "node:util";
-import open from "open";
-import url from "node:url";
-import http from "node:http";
 import { readFile, writeFile, rm, mkdir } from "node:fs/promises";
-import path from "node:path";
-import process from "node:process";
+import http from "node:http";
 import os from "node:os";
+import path from "node:path";
+import url from "node:url";
+import { TextEncoder } from "node:util";
 import TOML from "@iarna/toml";
-import assert from "node:assert";
+import { render, Text } from "ink";
+import SelectInput from "ink-select-input";
+import Table from "ink-table";
+import React from "react";
+import { fetch } from "undici";
+import { getCloudflareApiBaseUrl } from "./cfetch";
+import { getEnvironmentVariableFactory } from "./environment-variables";
+import openInBrowser from "./open-in-browser";
+import type { Item as SelectInputItem } from "ink-select-input/build/SelectInput";
 import type { ParsedUrlQuery } from "node:querystring";
-import { CF_API_BASE_URL } from "./cfetch";
-import type { Response } from "node-fetch";
+import type { Response } from "undici";
+
+/**
+ * Try to read the API token from the environment.
+ */
+const getCloudflareAPITokenFromEnv = getEnvironmentVariableFactory({
+  variableName: "CLOUDFLARE_API_TOKEN",
+  deprecatedName: "CF_API_TOKEN",
+});
+
+/**
+ * Try to read the account ID from the environment.
+ */
+const getCloudflareAccountIdFromEnv = getEnvironmentVariableFactory({
+  variableName: "CLOUDFLARE_ACCOUNT_ID",
+  deprecatedName: "CF_ACCOUNT_ID",
+});
 
 /**
  * An implementation of rfc6749#section-4.1 and rfc7636.
@@ -254,38 +271,39 @@ interface AccessToken {
   expiry: string;
 }
 
-type Scope =
-  | "account:read"
-  | "user:read"
-  | "workers:write"
-  | "workers_kv:write"
-  | "workers_routes:write"
-  | "workers_scripts:write"
-  | "workers_tail:read"
-  | "zone:read"
-  | "offline_access"; // this should be included by default
-
-const Scopes: Scope[] = [
-  "account:read",
-  "user:read",
-  "workers:write",
-  "workers_kv:write",
-  "workers_routes:write",
-  "workers_scripts:write",
-  "workers_tail:read",
-  "zone:read",
-];
-
-const ScopeDescriptions = [
-  "See your account info such as account details, analytics, and memberships.",
-  "See your user info such as name, email address, and account memberships.",
-  "See and change Cloudflare Workers data such as zones, KV storage, namespaces, scripts, and routes.",
-  "See and change Cloudflare Workers KV Storage data such as keys and namespaces.",
-  "See and change Cloudflare Workers data such as filters and routes.",
-  "See and change Cloudflare Workers scripts, durable objects, subdomains, triggers, and tail data.",
-  "See Cloudflare Workers tail and script data.",
-  "Grants read level access to account zone.",
-];
+const Scopes = {
+  "account:read":
+    "See your account info such as account details, analytics, and memberships.",
+  "user:read":
+    "See your user info such as name, email address, and account memberships.",
+  "workers:write":
+    "See and change Cloudflare Workers data such as zones, KV storage, namespaces, scripts, and routes.",
+  "workers_kv:write":
+    "See and change Cloudflare Workers KV Storage data such as keys and namespaces.",
+  "workers_routes:write":
+    "See and change Cloudflare Workers data such as filters and routes.",
+  "workers_scripts:write":
+    "See and change Cloudflare Workers scripts, durable objects, subdomains, triggers, and tail data.",
+  "workers_tail:read": "See Cloudflare Workers tail and script data.",
+  "pages:write":
+    "See and change Cloudflare Pages projects, settings and deployments.",
+  "zone:read": "Grants read level access to account zone.",
+} as const;
+
+/**
+ * The possible keys for a Scope.
+ *
+ * "offline_access" is automatically included.
+ */
+type Scope = keyof typeof Scopes;
+
+const ScopeKeys = Object.keys(Scopes) as Scope[];
+
+export function validateScopeKeys(
+  scopes: string[]
+): scopes is typeof ScopeKeys {
+  return scopes.every((scope) => scope in Scopes);
+}
 
 const CLIENT_ID = "54d11594-84e4-41aa-b438-e81b8fa78ee7";
 const AUTH_URL = "https://dash.cloudflare.com/oauth2/auth";
@@ -298,14 +316,15 @@ let initialised = false;
 
 // we do this because we have some async stuff
 // TODO: this should just happen in the top level
-// abd we should fiure out how to do top level await
+// and we should figure out how to do top level await
 export async function initialise(): Promise<void> {
-  // get refreshtoken/accesstoken from fs if exists
+  // get refreshToken/accessToken from fs if exists
   try {
-    // if CF_API_TOKEN available, use that
-    if (process.env.CF_API_TOKEN) {
+    // if the environment variable is available, use that
+    const apiTokenFromEnv = getCloudflareAPITokenFromEnv();
+    if (apiTokenFromEnv) {
       LocalState.accessToken = {
-        value: process.env.CF_API_TOKEN,
+        value: apiTokenFromEnv,
         expiry: "3021-12-31T23:59:59+00:00",
       };
       initialised = true;
@@ -344,11 +363,7 @@ function throwIfNotInitialised() {
   }
 }
 
-export function getAPIToken(): string {
-  if (process.env.CF_API_TOKEN) {
-    return process.env.CF_API_TOKEN;
-  }
-
+export function getAPIToken(): string | undefined {
   throwIfNotInitialised();
   return LocalState.accessToken?.value;
 }
@@ -548,7 +563,7 @@ function isReturningFromAuthServer(query: ParsedUrlQuery): boolean {
   return true;
 }
 
-export async function getAuthURL(scopes?: string[]): Promise<string> {
+export async function getAuthURL(scopes = ScopeKeys): Promise<string> {
   const { codeChallenge, codeVerifier } = await generatePKCECodes();
   const stateQueryParam = generateRandomState(RECOMMENDED_STATE_LENGTH);
 
@@ -558,39 +573,44 @@ export async function getAuthURL(scopes?: string[]): Promise<string> {
     stateQueryParam,
   });
 
-  // TODO: verify that the scopes passed are legit
-
   return (
     AUTH_URL +
     `?response_type=code&` +
     `client_id=${encodeURIComponent(CLIENT_ID)}&` +
     `redirect_uri=${encodeURIComponent(CALLBACK_URL)}&` +
-    `scope=${encodeURIComponent(
-      (scopes || Scopes).concat("offline_access").join(" ")
-    )}&` +
+    // @ts-expect-error we add offline_access manually
+    `scope=${encodeURIComponent(scopes.concat("offline_access").join(" "))}&` +
     `state=${stateQueryParam}&` +
     `code_challenge=${encodeURIComponent(codeChallenge)}&` +
     `code_challenge_method=S256`
   );
 }
 
+type TokenResponse =
+  | {
+      access_token: string;
+      expires_in: number;
+      refresh_token: string;
+      scope: string;
+    }
+  | {
+      error: string;
+    };
+
 /**
  * Refresh an access token from the remote service.
  */
 async function exchangeRefreshTokenForAccessToken(): Promise<AccessContext> {
-  const { refreshToken } = LocalState;
-
-  if (!refreshToken) {
+  if (!LocalState.refreshToken) {
     console.warn("No refresh token is present.");
   }
 
-  const url = TOKEN_URL;
   const body =
     `grant_type=refresh_token&` +
-    `refresh_token=${refreshToken?.value}&` +
+    `refresh_token=${LocalState.refreshToken?.value}&` +
     `client_id=${CLIENT_ID}`;
 
-  const response = await fetch(url, {
+  const response = await fetch(TOKEN_URL, {
     method: "POST",
     body,
     headers: {
@@ -601,13 +621,12 @@ async function exchangeRefreshTokenForAccessToken(): Promise<AccessContext> {
     throw await response.json();
   } else {
     try {
-      const json = await response.json();
-      const { access_token, expires_in, refresh_token, scope } = json as {
-        access_token: string;
-        expires_in: number;
-        refresh_token: string;
-        scope: string;
-      };
+      const json = (await response.json()) as TokenResponse;
+      if ("error" in json) {
+        throw json.error;
+      }
+
+      const { access_token, expires_in, refresh_token, scope } = json;
       let scopes: Scope[] = [];
 
       const accessToken: AccessToken = {
@@ -617,10 +636,9 @@ async function exchangeRefreshTokenForAccessToken(): Promise<AccessContext> {
       LocalState.accessToken = accessToken;
 
       if (refresh_token) {
-        const refreshToken: RefreshToken = {
+        LocalState.refreshToken = {
           value: refresh_token,
         };
-        LocalState.refreshToken = refreshToken;
       }
 
       if (scope) {
@@ -636,20 +654,24 @@ async function exchangeRefreshTokenForAccessToken(): Promise<AccessContext> {
         refreshToken: LocalState.refreshToken,
       };
       return accessContext;
-    } catch (err) {
-      const error = err?.error || "There was a network error.";
+    } catch (error) {
       switch (error) {
         case "invalid_grant":
-          console.log(
+          console.warn(
             "Expired! Auth code or refresh token needs to be renewed."
           );
           // alert("Redirecting to auth server to obtain a new auth grant code.");
           // TODO: return refreshAuthCodeOrRefreshToken();
           break;
         default:
+          console.error(error);
           break;
       }
-      throw toErrorClass(error);
+      if (typeof error === "string") {
+        throw toErrorClass(error);
+      } else {
+        throw error;
+      }
     }
   }
 }
@@ -666,7 +688,6 @@ async function exchangeAuthCodeForAccessToken(): Promise<AccessContext> {
     console.warn("No authorization grant code is being passed.");
   }
 
-  const url = TOKEN_URL;
   const body =
     `grant_type=authorization_code&` +
     `code=${encodeURIComponent(authorizationCode || "")}&` +
@@ -674,7 +695,7 @@ async function exchangeAuthCodeForAccessToken(): Promise<AccessContext> {
     `client_id=${encodeURIComponent(CLIENT_ID)}&` +
     `code_verifier=${codeVerifier}`;
 
-  const response = await fetch(url, {
+  const response = await fetch(TOKEN_URL, {
     method: "POST",
     body,
     headers: {
@@ -691,13 +712,11 @@ async function exchangeAuthCodeForAccessToken(): Promise<AccessContext> {
     }
     throw toErrorClass(error);
   }
-  const json = await response.json();
-  const { access_token, expires_in, refresh_token, scope } = json as {
-    access_token: string;
-    expires_in: number;
-    refresh_token: string;
-    scope: string;
-  };
+  const json = (await response.json()) as TokenResponse;
+  if ("error" in json) {
+    throw new Error(json.error);
+  }
+  const { access_token, expires_in, refresh_token, scope } = json;
   let scopes: Scope[] = [];
   LocalState.hasAuthCodeBeenExchangedForAccessToken = true;
 
@@ -709,10 +728,9 @@ async function exchangeAuthCodeForAccessToken(): Promise<AccessContext> {
   LocalState.accessToken = accessToken;
 
   if (refresh_token) {
-    const refreshToken: RefreshToken = {
+    LocalState.refreshToken = {
       value: refresh_token,
     };
-    LocalState.refreshToken = refreshToken;
   }
 
   if (scope) {
@@ -798,15 +816,18 @@ expiration_time = "${tokenData.token?.expiry}"
 }
 
 type LoginProps = {
-  scopes?: string[];
+  scopes?: Scope[];
 };
 
-export async function loginOrRefreshIfRequired(): Promise<boolean> {
+export async function loginOrRefreshIfRequired(
+  isInteractive = true
+): Promise<boolean> {
   // TODO: if there already is a token, then try refreshing
   // TODO: ask permission before opening browser
   if (!LocalState.accessToken) {
-    // not logged in.
-    return await login();
+    // Not logged in.
+    // If we are not interactive, we cannot ask the user to login
+    return isInteractive && (await login());
   } else if (isAccessTokenExpired()) {
     return await refreshToken();
   } else {
@@ -816,18 +837,18 @@ export async function loginOrRefreshIfRequired(): Promise<boolean> {
 
 export async function login(props?: LoginProps): Promise<boolean> {
   const urlToOpen = await getAuthURL(props?.scopes);
-  open(urlToOpen);
-  // TODO: log url only if on system where it's unreliable/unavailable
-  // console.log(`💁 Opened ${urlToOpen}`);
-  let server;
-  let loginTimeoutHandle;
+  await openInBrowser(urlToOpen);
+  let server: http.Server;
+  let loginTimeoutHandle: NodeJS.Timeout;
   const timerPromise = new Promise<boolean>((resolve) => {
     loginTimeoutHandle = setTimeout(() => {
-      console.error("Timed out waiting for authorization code.");
+      console.error(
+        "Timed out waiting for authorization code, please try again."
+      );
       server.close();
       clearTimeout(loginTimeoutHandle);
       resolve(false);
-    }, 60000); // wait for 30 seconds for the user to authorize
+    }, 60000); // wait for 60 seconds for the user to authorize
   });
 
   const loginPromise = new Promise<boolean>((resolve, reject) => {
@@ -858,8 +879,9 @@ export async function login(props?: LoginProps): Promise<boolean> {
                 finish(false);
               });
               console.log(
-                "Error: Consent denied. You must grant consent to Wrangler in order to login. If you don't want to do this consider passing an API token with CF_API_TOKEN variable"
-              ); // TODO: implement wrangler config lol
+                "Error: Consent denied. You must grant consent to Wrangler in order to login.\n" +
+                  "If you don't want to do this consider passing an API token via the `CLOUDFLARE_API_TOKEN` environment variable"
+              );
 
               return;
             } else {
@@ -921,15 +943,14 @@ export async function refreshToken(): Promise<boolean> {
 
 export async function logout(): Promise<void> {
   throwIfNotInitialised();
-  const { refreshToken } = LocalState;
-  if (!refreshToken) {
+  if (!LocalState.refreshToken) {
     console.log("Not logged in, exiting...");
     return;
   }
   const body =
     `client_id=${encodeURIComponent(CLIENT_ID)}&` +
     `token_type_hint=refresh_token&` +
-    `token=${encodeURIComponent(refreshToken?.value || "")}`;
+    `token=${encodeURIComponent(LocalState.refreshToken?.value || "")}`;
 
   const response = await fetch(REVOKE_URL, {
     method: "POST",
@@ -952,25 +973,28 @@ export async function logout(): Promise<void> {
 export function listScopes(): void {
   throwIfNotInitialised();
   console.log("💁 Available scopes:");
-  const data = Scopes.map((scope, index) => ({
+  const data = ScopeKeys.map((scope: Scope) => ({
     Scope: scope,
-    Description: ScopeDescriptions[index],
+    Description: Scopes[scope],
   }));
   render(<Table data={data} />);
   // TODO: maybe a good idea to show usage here
 }
 
-export async function getAccountId() {
+export async function getAccountId(
+  isInteractive = true
+): Promise<string | undefined> {
   const apiToken = getAPIToken();
   if (!apiToken) return;
 
-  if (process.env.CF_ACCOUNT_ID) {
-    return process.env.CF_ACCOUNT_ID;
+  const accountIdFromEnv = getCloudflareAccountIdFromEnv();
+  if (accountIdFromEnv) {
+    return accountIdFromEnv;
   }
 
   let response: Response;
   try {
-    response = await fetch(`${CF_API_BASE_URL}/memberships`, {
+    response = await fetch(`${getCloudflareApiBaseUrl()}/memberships`, {
       method: "GET",
       headers: {
         Authorization: "Bearer " + apiToken,
@@ -978,19 +1002,19 @@ export async function getAccountId() {
     });
   } catch (err) {
     // probably offline
+    return;
   }
-  if (!response) return;
-  let accountId: string;
-  // @ts-expect-error need to type this response
-  const responseJSON: {
+
+  let accountId: string | undefined;
+  const responseJSON = (await response.json()) as {
     success: boolean;
     result: { id: string; account: { id: string; name: string } }[];
-  } = await response.json();
+  };
 
   if (responseJSON.success === true) {
     if (responseJSON.result.length === 1) {
       accountId = responseJSON.result[0].account.id;
-    } else {
+    } else if (isInteractive) {
       accountId = await new Promise((resolve) => {
         const accounts = responseJSON.result.map((x) => x.account);
         const { unmount } = render(
@@ -1003,6 +1027,15 @@ export async function getAccountId() {
           />
         );
       });
+    } else {
+      throw new Error(
+        "More than one account available but unable to select one in non-interactive mode.\n" +
+          `Please set the appropriate \`account_id\` in your \`wrangler.toml\` file.\n` +
+          `Available accounts are ("<name>" - "<id>"):\n` +
+          responseJSON.result
+            .map((x) => `  "${x.account.name}" - "${x.account.id}")`)
+            .join("\n")
+      );
     }
   }
   return accountId;
@@ -1014,16 +1047,19 @@ type ChooseAccountItem = {
 };
 export function ChooseAccount(props: {
   accounts: ChooseAccountItem[];
-  onSelect: (item) => void;
+  onSelect: (item: SelectInputItem<ChooseAccountItem>) => void;
 }) {
   return (
-    <SelectInput
-      items={props.accounts.map((item) => ({
-        key: item.id,
-        label: item.name,
-        value: item,
-      }))}
-      onSelect={props.onSelect}
-    />
+    <>
+      <Text bold>Select an account from below:</Text>
+      <SelectInput
+        items={props.accounts.map((item) => ({
+          key: item.id,
+          label: item.name,
+          value: item,
+        }))}
+        onSelect={props.onSelect}
+      />
+    </>
   );
 }

package/src/whoami.tsx

@@ -0,0 +1,69 @@
+import { Text, render } from "ink";
+import Table from "ink-table";
+import React from "react";
+import { fetchListResult, fetchResult } from "./cfetch";
+import { getAPIToken } from "./user";
+
+export async function whoami() {
+  console.log("Getting User settings...");
+  const user = await getUserInfo();
+  render(<WhoAmI user={user}></WhoAmI>);
+}
+
+export function WhoAmI({ user }: { user: UserInfo | undefined }) {
+  return user ? (
+    <>
+      <Email tokenType={user.authType} email={user.email}></Email>
+      <Accounts accounts={user.accounts}></Accounts>
+    </>
+  ) : (
+    <Text>You are not authenticated. Please run `wrangler login`.</Text>
+  );
+}
+
+function Email(props: { tokenType: string; email: string }) {
+  return (
+    <Text>
+      👋 You are logged in with an {props.tokenType} Token, associated with the
+      email &apos;{props.email}&apos;!
+    </Text>
+  );
+}
+
+function Accounts(props: { accounts: AccountInfo[] }) {
+  const accounts = props.accounts.map((account) => ({
+    "Account Name": account.name,
+    "Account ID": account.id,
+  }));
+  return <Table data={accounts}></Table>;
+}
+
+export interface UserInfo {
+  apiToken: string;
+  authType: string;
+  email: string;
+  accounts: AccountInfo[];
+}
+
+export async function getUserInfo(): Promise<UserInfo | undefined> {
+  const apiToken = getAPIToken();
+  return apiToken
+    ? {
+        apiToken,
+        authType: "OAuth",
+        email: await getEmail(),
+        accounts: await getAccounts(),
+      }
+    : undefined;
+}
+
+async function getEmail(): Promise<string> {
+  const { email } = await fetchResult<{ email: string }>("/user");
+  return email;
+}
+
+type AccountInfo = { name: string; id: string };
+
+async function getAccounts(): Promise<AccountInfo[]> {
+  return await fetchListResult<AccountInfo>("/accounts");
+}