wrangler 2.0.23 → 2.0.24

package/src/publish.ts

@@ -11,6 +11,7 @@ import { createWorkerUploadForm } from "./create-worker-upload-form";
 import { confirm } from "./dialogs";
 import { getMigrationsToUpload } from "./durable";
 import { logger } from "./logger";
+import { getMetricsUsageHeaders } from "./metrics";
 import { ParseError } from "./parse";
 import { syncAssets } from "./sites";
 import { getZoneForRoute } from "./zones";
@@ -51,6 +52,27 @@ type Props = {
 
 type RouteObject = ZoneIdRoute | ZoneNameRoute | CustomDomainRoute;
 
+export type CustomDomain = {
+	id: string;
+	zone_id: string;
+	zone_name: string;
+	hostname: string;
+	service: string;
+	environment: string;
+};
+type UpdatedCustomDomain = CustomDomain & { modified: boolean };
+type ConflictingCustomDomain = CustomDomain & {
+	external_dns_record_id?: string;
+	external_cert_id?: string;
+};
+
+export type CustomDomainChangeset = {
+	added: CustomDomain[];
+	removed: CustomDomain[];
+	updated: UpdatedCustomDomain[];
+	conflicting: ConflictingCustomDomain[];
+};
+
 function sleep(ms: number) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -79,58 +101,27 @@ function renderRoute(route: Route): string {
 	return result;
 }
 
-// this function takes a string with quotes in it
-// (i.e. `hello "world", if that really is your name`)
-// and peels out the first instance of a substring
-// bounded by quotes (so, in the example above, `world`)
-//
-// this is useful because the /domains api will return
-// which domains conflicted in an error message, bounded
-// by a string, which we can use to provide helpful
-// messages to a user
-function getQuoteBoundedSubstring(content: string) {
-	const matches = content.split('"');
-	return matches[1] ?? "";
-}
-
-function isOriginConflictError(
-	e: unknown
-): e is { code: 100116; message: string; notes: Array<{ text: string }> } {
-	return (
-		typeof e === "object" &&
-		e !== null &&
-		(e as { code: number }).code === 100116
-	);
-}
-
-function isDNSConflictError(
-	e: unknown
-): e is { code: 100117; message: string; notes: Array<{ text: string }> } {
-	return (
-		typeof e === "object" &&
-		e !== null &&
-		(e as { code: number }).code === 100117
-	);
-}
-
-// empty error class to throw and then explicitly catch via `instanceof`
-class CustomDomainOverrideRejected extends Error {}
-
 // publishing to custom domains involves a few more steps than just updating
 // the routing table, and thus the api implementing it is fairly defensive -
 // it will error eagerly on conflicts against existing domains or existing
 // managed DNS records
-//
-// however, you can pass params to override the errors. we start on the
-// defensive path, and if one of these errors occur, we prompt the user
-// for confirmation that they do indeed want to override the conflicts, and
-// then retry the request with the right override added
+
+// however, you can pass params to override the errors. to know if we should
+// override the current state, we generate a "changeset" of required actions
+// to get to the state we want (specified by the list of custom domains). the
+// changeset returns an "updated" collection (existing custom domains
+// connected to other scripts) and a "conflicting" collection (the requested
+// custom domains that have a managed, conflicting DNS record preventing the
+// host's use as a custom domain). with this information, we can prompt to
+// the user what will occur if we create the custom domains requested, and
+// add the override param if they confirm the action
 //
 // if a user does not confirm that they want to override, we skip publishing
 // to these custom domains, but continue on through the rest of the
 // publish stage
-function publishCustomDomains(
+async function publishCustomDomains(
 	workerUrl: string,
+	accountId: string,
 	domains: Array<RouteObject>
 ): Promise<string[]> {
 	const config = {
@@ -146,79 +137,81 @@ function publishCustomDomains(
 		};
 	});
 
+	const fail = () => {
+		return [
+			domains.length > 1
+				? `Publishing to ${domains.length} Custom Domains was skipped, fix conflicts and try again`
+				: `Publishing to Custom Domain "${domains[0].pattern}" was skipped, fix conflict and try again`,
+		];
+	};
+
 	if (!process.stdout.isTTY) {
 		// running in non-interactive mode.
 		// existing origins / dns records are not indicative of errors,
 		// so we aggressively update rather than aggressively fail
 		config.override_existing_origin = true;
 		config.override_existing_dns_record = true;
+	} else {
+		// get a changeset for operations required to achieve a state with the requested domains
+		const changeset = await fetchResult<CustomDomainChangeset>(
+			`${workerUrl}/domains/changeset?replace_state=true`,
+			{
+				method: "POST",
+				body: JSON.stringify(origins),
+				headers: {
+					"Content-Type": "application/json",
+				},
+			}
+		);
+
+		const updatesRequired = changeset.updated.filter(
+			(domain) => domain.modified
+		);
+		if (updatesRequired.length > 0) {
+			// find out which scripts the conflict domains are already attached to
+			// so we can provide that in the confirmation prompt
+			const existing = await Promise.all(
+				updatesRequired.map((domain) =>
+					fetchResult<CustomDomain>(
+						`/accounts/${accountId}/workers/domains/records/${domain.id}`
+					)
+				)
+			);
+			const existingRendered = existing
+				.map(
+					(domain) =>
+						`\t• ${domain.hostname} (used as a domain for "${domain.service}")`
+				)
+				.join("\n");
+			const message = `Custom Domains already exist for these domains:
+${existingRendered}
+Update them to point to this script instead?`;
+			if (!(await confirm(message))) return fail();
+			config.override_existing_origin = true;
+		}
+
+		if (changeset.conflicting.length > 0) {
+			const conflicitingRendered = changeset.conflicting
+				.map((domain) => `\t• ${domain.hostname}`)
+				.join("\n");
+			const message = `You already have DNS records that conflict for these Custom Domains:
+${conflicitingRendered}
+Update them to point to this script instead?`;
+			if (!(await confirm(message))) return fail();
+			config.override_existing_dns_record = true;
+		}
 	}
 
-	// Mixing promise chains with async/await is funky, but it allows us to keep related
-	// logic synchronous-looking (i.e. prompting for confirmation and then re-requesting)
-	// while retaining the flexibility of promise chain fall-throughs. We can group error
-	// handling logic in dedicated catch calls, and all we have to do is re-throw an
-	// error and it will pass down to the next catch call
-	return fetchResult(`${workerUrl}/domains`, {
+	// publish to domains
+	await fetchResult(`${workerUrl}/domains/records`, {
 		method: "PUT",
 		body: JSON.stringify({ ...config, origins }),
 		headers: {
 			"Content-Type": "application/json",
 		},
-	})
-		.catch(async (err) => {
-			if (isOriginConflictError(err)) {
-				const conflictingOrigins = getQuoteBoundedSubstring(err.notes[0].text);
-				const shouldContinue = await confirm(
-					`Custom Domains already exist for these domains: "${conflictingOrigins}"\nUpdate them to point to this script instead?`
-				);
-				if (!shouldContinue) {
-					throw new CustomDomainOverrideRejected();
-				}
-				config.override_existing_origin = true;
-				await fetchResult(`${workerUrl}/domains`, {
-					method: "PUT",
-					body: JSON.stringify({ ...config, origins }),
-					headers: {
-						"Content-Type": "application/json",
-					},
-				});
-			} else {
-				throw err;
-			}
-		})
-		.catch(async (err) => {
-			if (isDNSConflictError(err)) {
-				const conflictingOrigins = getQuoteBoundedSubstring(err.notes[0].text);
-				const shouldContinue = await confirm(
-					`You already have conflicting DNS records for these domains: "${conflictingOrigins}"\nUpdate them to point to this script instead?`
-				);
-				if (!shouldContinue) {
-					throw new CustomDomainOverrideRejected();
-				}
-				config.override_existing_dns_record = true;
-				await fetchResult(`${workerUrl}/domains`, {
-					method: "PUT",
-					body: JSON.stringify({ ...config, origins }),
-					headers: {
-						"Content-Type": "application/json",
-					},
-				});
-			} else {
-				throw err;
-			}
-		})
-		.then(() => domains.map((domain) => renderRoute(domain)))
-		.catch((err) => {
-			if (err instanceof CustomDomainOverrideRejected) {
-				return [
-					domains.length > 1
-						? `Publishing to ${domains.length} Custom Domains was skipped, fix conflicts and try again`
-						: `Publishing to Custom Domain "${domains[0].pattern}" was skipped, fix conflict and try again`,
-				];
-			}
-			throw err;
-		});
+	});
+
+	return domains.map((domain) => renderRoute(domain));
 }
 
 export default async function publish(props: Props): Promise<void> {
@@ -391,6 +384,17 @@ See https://developers.cloudflare.com/workers/platform/compatibility-dates for m
 						nodeCompat,
 						define: config.define,
 						checkFetch: false,
+						assets: config.assets && {
+							...config.assets,
+							// enable the cache when publishing
+							bypassCache: false,
+						},
+						services: config.services,
+						// We don't set workerDefinitions here,
+						// because we don't want to apply the dev-time
+						// facades on top of it
+						workerDefinitions: undefined,
+						firstPartyWorkerDevFacade: false,
 					}
 			  );
 
@@ -440,6 +444,7 @@ See https://developers.cloudflare.com/workers/platform/compatibility-dates for m
 			r2_buckets: config.r2_buckets,
 			services: config.services,
 			worker_namespaces: config.worker_namespaces,
+			logfwdr: config.logfwdr,
 			unsafe: config.unsafe?.bindings,
 		};
 
@@ -492,6 +497,7 @@ See https://developers.cloudflare.com/workers/platform/compatibility-dates for m
 				{
 					method: "PUT",
 					body: createWorkerUploadForm(worker),
+					headers: await getMetricsUsageHeaders(config.send_metrics),
 				},
 				new URLSearchParams({
 					include_subdomain_availability: "true",
@@ -503,13 +509,15 @@ See https://developers.cloudflare.com/workers/platform/compatibility-dates for m
 
 			available_on_subdomain = result.available_on_subdomain;
 
-			// Print some useful information returned after publishing
-			// Not all fields will be populated for every worker
-			// These fields are likely to be scraped by tools, so do not rename
-			if (result.id) logger.log("Worker ID: ", result.id);
-			if (result.etag) logger.log("Worker ETag: ", result.etag);
-			if (result.pipeline_hash)
-				logger.log("Worker PipelineHash: ", result.pipeline_hash);
+			if (config.first_party_worker) {
+				// Print some useful information returned after publishing
+				// Not all fields will be populated for every worker
+				// These fields are likely to be scraped by tools, so do not rename
+				if (result.id) logger.log("Worker ID: ", result.id);
+				if (result.etag) logger.log("Worker ETag: ", result.etag);
+				if (result.pipeline_hash)
+					logger.log("Worker PipelineHash: ", result.pipeline_hash);
+			}
 		}
 	} finally {
 		if (typeof destination !== "string") {
@@ -590,7 +598,9 @@ See https://developers.cloudflare.com/workers/platform/compatibility-dates for m
 
 	// Update custom domains for the script
 	if (customDomainsOnly.length > 0) {
-		deployments.push(publishCustomDomains(workerUrl, customDomainsOnly));
+		deployments.push(
+			publishCustomDomains(workerUrl, accountId, customDomainsOnly)
+		);
 	}
 
 	// Configure any schedules for the script.
@@ -614,7 +624,11 @@ See https://developers.cloudflare.com/workers/platform/compatibility-dates for m
 	if (deployments.length > 0) {
 		logger.log("Published", workerName, formatTime(deployMs));
 		for (const target of targets.flat()) {
-			logger.log(" ", target);
+			// Append protocol only on workers.dev domains
+			logger.log(
+				" ",
+				(target.endsWith("workers.dev") ? "https://" : "") + target
+			);
 		}
 	} else {
 		logger.log("No publish targets for", workerName, formatTime(deployMs));

package/src/r2.ts

@@ -1,4 +1,7 @@
+import { Readable } from "node:stream";
 import { fetchResult } from "./cfetch";
+import { fetchR2Objects } from "./cfetch/internal";
+import type { HeadersInit } from "undici";
 
 /**
  * Information about a bucket, returned from `listR2Buckets()`.
@@ -48,3 +51,68 @@ export async function deleteR2Bucket(
 		{ method: "DELETE" }
 	);
 }
+
+export function bucketAndKeyFromObjectPath(objectPath = ""): {
+	bucket: string;
+	key: string;
+} {
+	const match = /^([^/]+)\/(.*)/.exec(objectPath);
+	if (match === null) {
+		throw new Error(
+			`The object path must be in the form of {bucket}/{key} you provided ${objectPath}`
+		);
+	}
+
+	return { bucket: match[1], key: match[2] };
+}
+
+/**
+ * Downloads an object
+ */
+export async function getR2Object(
+	accountId: string,
+	bucketName: string,
+	objectName: string
+): Promise<Readable> {
+	const response = await fetchR2Objects(
+		`/accounts/${accountId}/r2/buckets/${bucketName}/objects/${objectName}`,
+		{ method: "GET" }
+	);
+
+	return Readable.from(response.body);
+}
+
+/**
+ * Uploads an object
+ */
+export async function putR2Object(
+	accountId: string,
+	bucketName: string,
+	objectName: string,
+	object: Readable | Buffer,
+	options: Record<string, unknown>
+): Promise<void> {
+	const headerKeys = [
+		"content-length",
+		"content-type",
+		"content-disposition",
+		"content-encoding",
+		"content-language",
+		"cache-control",
+		"expires",
+	];
+	const headers: HeadersInit = {};
+	for (const key of headerKeys) {
+		const value = options[key] || "";
+		if (value && typeof value === "string") headers[key] = value;
+	}
+
+	await fetchR2Objects(
+		`/accounts/${accountId}/r2/buckets/${bucketName}/objects/${objectName}`,
+		{
+			body: object,
+			headers,
+			method: "PUT",
+		}
+	);
+}

package/src/user/user.tsx

@@ -262,6 +262,7 @@ interface State extends AuthTokens {
 interface AuthTokens {
 	accessToken?: AccessToken;
 	refreshToken?: RefreshToken;
+	scopes?: Scope[];
 	/** @deprecated - this field was only provided by the deprecated `wrangler1 config` command. */
 	apiToken?: string;
 }
@@ -279,6 +280,7 @@ export interface UserAuthConfig {
 	oauth_token?: string;
 	refresh_token?: string;
 	expiration_time?: string;
+	scopes?: string[];
 	/** @deprecated - this field was only provided by the deprecated `wrangler1 config` command. */
 	api_token?: string;
 }
@@ -355,7 +357,7 @@ function getAuthTokens(config?: UserAuthConfig): AuthTokens | undefined {
 		if (getAuthFromEnv()) return;
 
 		// otherwise try loading from the user auth config file.
-		const { oauth_token, refresh_token, expiration_time, api_token } =
+		const { oauth_token, refresh_token, expiration_time, scopes, api_token } =
 			config || readAuthConfigFile();
 
 		if (oauth_token) {
@@ -366,6 +368,7 @@ function getAuthTokens(config?: UserAuthConfig): AuthTokens | undefined {
 					expiry: expiration_time ?? "2000-01-01:00:00:00+00:00",
 				},
 				refreshToken: { value: refresh_token ?? "" },
+				scopes: scopes as Scope[],
 			};
 		} else if (api_token) {
 			logger.warn(
@@ -959,6 +962,7 @@ export async function login(props?: LoginProps): Promise<boolean> {
 							oauth_token: exchange.token?.value ?? "",
 							expiration_time: exchange.token?.expiry,
 							refresh_token: exchange.refreshToken?.value,
+							scopes: exchange.scopes,
 						});
 						res.writeHead(307, {
 							Location:
@@ -1003,8 +1007,14 @@ async function refreshToken(): Promise<boolean> {
 				expiry: "",
 			},
 			refreshToken: { value: refresh_token } = {},
+			scopes,
 		} = await exchangeRefreshTokenForAccessToken();
-		writeAuthConfigFile({ oauth_token, expiration_time, refresh_token });
+		writeAuthConfigFile({
+			oauth_token,
+			expiration_time,
+			refresh_token,
+			scopes,
+		});
 		return true;
 	} catch (err) {
 		return false;
@@ -1169,3 +1179,11 @@ export function getAccountFromCache():
 		"wrangler-account.json"
 	).account;
 }
+
+/**
+ * Get the scopes of the following token, will only return scopes
+ * if the token is an OAuth token.
+ */
+export function getScopes(): Scope[] | undefined {
+	return LocalState.scopes;
+}

package/src/whoami.tsx

@@ -3,7 +3,7 @@ import Table from "ink-table";
 import React from "react";
 import { fetchListResult, fetchResult } from "./cfetch";
 import { logger } from "./logger";
-import { getAPIToken, getAuthFromEnv } from "./user";
+import { getAPIToken, getAuthFromEnv, getScopes } from "./user";
 
 export async function whoami() {
 	logger.log("Getting User settings...");
@@ -17,6 +17,10 @@ export function WhoAmI({ user }: { user: UserInfo | undefined }) {
 		<>
 			<Email tokenType={user.authType} email={user.email}></Email>
 			<Accounts accounts={user.accounts}></Accounts>
+			<Permissions
+				tokenType={user.authType}
+				tokenPermissions={user.tokenPermissions}
+			/>
 		</>
 	) : (
 		<Text>You are not authenticated. Please run `wrangler login`.</Text>
@@ -46,17 +50,51 @@ function Accounts(props: { accounts: AccountInfo[] }) {
 	return <Table data={accounts}></Table>;
 }
 
+function Permissions(props: {
+	tokenPermissions: string[] | undefined;
+	tokenType: string;
+}) {
+	const permissions =
+		props.tokenPermissions?.map((scope) => scope.split(":")) || [];
+	return props.tokenType === "OAuth Token" ? (
+		props.tokenPermissions ? (
+			<>
+				<Text>
+					🔓 Token Permissions: If scopes are missing, you may need to logout
+					and re-login.
+				</Text>
+				<Text>Scope (Access)</Text>
+				{permissions.map(([type, name]) => (
+					<>
+						<Text>
+							- {type} {name && `(${name})`}
+						</Text>
+					</>
+				))}
+			</>
+		) : null
+	) : (
+		<Text>
+			🔓 To see token permissions visit
+			https://dash.cloudflare.com/profile/api-tokens
+		</Text>
+	);
+}
+
 export interface UserInfo {
 	apiToken: string;
 	authType: string;
 	email: string | undefined;
 	accounts: AccountInfo[];
+	tokenPermissions: string[] | undefined;
 }
 
 export async function getUserInfo(): Promise<UserInfo | undefined> {
 	const apiToken = getAPIToken();
 	if (!apiToken) return;
 
+	const tokenPermissions = await getTokenPermissions();
+
 	const usingEnvAuth = !!getAuthFromEnv();
 	const usingGlobalAuthKey = "authKey" in apiToken;
 	return {
@@ -68,6 +106,7 @@ export async function getUserInfo(): Promise<UserInfo | undefined> {
 			: "OAuth Token",
 		email: "authEmail" in apiToken ? apiToken.authEmail : await getEmail(),
 		accounts: await getAccounts(),
+		tokenPermissions,
 	};
 }
 
@@ -89,3 +128,42 @@ type AccountInfo = { name: string; id: string };
 async function getAccounts(): Promise<AccountInfo[]> {
 	return await fetchListResult<AccountInfo>("/accounts");
 }
+
+async function getTokenPermissions(): Promise<string[] | undefined> {
+	// Tokens can either be API tokens or Oauth tokens.
+	// Here we only extract permissions from OAuth tokens.
+
+	return getScopes() as string[];
+
+	// In future we may be able to get the token permissions on an API token,
+	// but currently we cannot as that permission is not able to be added to
+	// an API token.
+
+	// try {
+	// 	// First we get the token identifier (only returned on API tokens)
+	// 	const { id } = await fetchResult<{ id: string }>("/user/tokens/verify");
+
+	// 	// Get the token permissions for the current token
+	// 	const { policies } = await fetchResult<{
+	// 		policies: { id: string; name: string }[];
+	// 	}>(`/user/tokens/${id}`);
+
+	// 	return policies.map((p) => p.name);
+	// } catch (e) {
+	// 	if ((e as { code?: number }).code === 1000) {
+	// 		// Invalid token - Oauth token
+
+	// 		// Get scopes
+	// 		const scopes = getScopes() as string[];
+	// 		// We may not get scopes back if they are not currently cached,
+	// 		// however next time an access token is requested,
+	// 		// the scopes will be added to the cache.
+	// 		return scopes;
+	// 	} else if ((e as { code?: number }).code === 9109) {
+	// 		// Token cannot view its permissions
+	// 		return undefined;
+	// 	} else {
+	// 		throw e;
+	// 	}
+	// }
+}

package/src/worker.ts

@@ -127,6 +127,16 @@ interface CfWorkerNamespace {
 	namespace: string;
 }
 
+interface CfLogfwdr {
+	schema: string | undefined;
+	bindings: CfLogfwdrBinding[];
+}
+
+interface CfLogfwdrBinding {
+	name: string;
+	destination: string;
+}
+
 interface CfUnsafeBinding {
 	name: string;
 	type: string;
@@ -174,6 +184,7 @@ export interface CfWorkerInit {
 		r2_buckets: CfR2Bucket[] | undefined;
 		services: CfService[] | undefined;
 		worker_namespaces: CfWorkerNamespace[] | undefined;
+		logfwdr: CfLogfwdr | undefined;
 		unsafe: CfUnsafeBinding[] | undefined;
 	};
 	migrations: CfDurableObjectMigrations | undefined;
@@ -188,4 +199,5 @@ export interface CfWorkerContext {
 	zone: string | undefined;
 	host: string | undefined;
 	routes: Route[] | undefined;
+	sendMetrics: boolean | undefined;
 }

package/templates/first-party-worker-module-facade.ts

@@ -0,0 +1,18 @@
+// @ts-ignore entry point will get replaced
+import worker from "__ENTRY_POINT__";
+// @ts-ignore entry point will get replaced
+export * from "__ENTRY_POINT__";
+
+type Env = {
+	// TODO: type this
+};
+
+/**
+ * Setup globals/vars as required
+ */
+
+export default {
+	async fetch(request: Request, env: Env, ctx: ExecutionContext) {
+		return worker.fetch(request, env, ctx);
+	},
+};

package/templates/format-dev-errors.ts

@@ -0,0 +1,32 @@
+// @ts-expect-error We'll swap in the entry point during build
+import Worker from "__ENTRY_POINT__";
+
+// @ts-expect-error
+export * from "__ENTRY_POINT__";
+
+export default {
+	async fetch(req: Request, env: unknown, ctx: ExecutionContext) {
+		try {
+			return await Worker.fetch(req, env, ctx);
+		} catch (err) {
+			return new Response(
+				`<!DOCTYPE html>
+<html>
+	<head>
+		<meta charset="utf-8" />
+		<title>Error</title>
+	</head>
+	<body>
+		<pre>${(err as Error).stack}</pre>
+	</body>
+</html>`,
+				{
+					status: 500,
+					headers: {
+						"Content-Type": "text/html",
+					},
+				}
+			);
+		}
+	},
+};