Replies: 2 comments 5 replies
-
|
Love this, direnv auth. One thing I’d like to clarify is what “nearest activated ancestor directory” is relative to. Two coherent models: always resolve from the effective cwd, or for config-loading commands resolve from the selected config file’s directory. I think the least surprising Wrangler-specific behavior would be:
For example: If the bindings are: I would expect this command to use For the user-facing CLI, would the help output look something like this? Thank you for your work! |
Beta Was this translation helpful? Give feedback.
-
Just for clarification: would we be able to set the account_id in OAuth allows adding permission to all accounts that I have access within cloudflare when generating the token. Will be possible for the same Token deploy to all this accounts choosing via |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Motivation
Wrangler authenticates one user at a time. Developers working across several accounts – personal, employer, multiple clients, staging versus production – re-run wrangler login to switch and lose the previous session each time. Workarounds abound: swapping ~/.wrangler config files by hand (community thread #189290), third-party tools such as CFMan and wrangler-accounts, and keeping separate Cloudflare users with narrowly-scoped roles. Two contributors have independently opened profile PRs (#11780, #12217), both citing AWS CLI profiles.
An OAuth login historically reached every account the user could touch, which is why #11513 asked for account-scoped tokens and why many people fell back to dashboard API keys (#13744). A login can now be scoped to specific accounts, so a profile can carry that narrower scope rather than reaching everything. Users can now authenticate to specific accounts on a user, but still have to run the login command every time they want to change what scopes they have access to, or use API keys. We want to make this easier to set up.
Proposal
A profile is a named login scoped to a chosen set of accounts, under
wrangler auth:create [name] / delete [name]manage profiles. Creating or activating a missing or expired profile starts that profile's login, where you choose which accounts it may reach.activate [name] [dir=.]use a profile in a directory and its subdirectories.deactivateremove the profile from a directory and return to the next level up or the default, with a warning.login / logoutoperate on the default profile, as today; disallowed inside an activated directory.whoami / listshow the active profile, its account, and where it was set; list profiles.Resolution, highest first:
CLOUDFLARE_API_TOKENin the environment (effectively overrides profiles and uses that key), then an explicit--profile flag; then the nearest activated ancestor directory; then the default profile, which applies at the filesystem root and to anything not overridden. A subdirectory can override the profile above it by usingactivateon a different profile.Within a profile, the account is chosen by the existing rule: the
account_idin the Wrangler config, otherwise the user's locked selection. A command targeting an account outside the active profile fails with a clear, machine-readable error naming the account and profile, rather than falling back to another account. The same holds in an activated directory with an expired token: re-authenticate the profile, never silently switch.The directory→profile binding is stored in a central per-machine registry.
Prior art
Directory-scoped credential selection is novel among cloud CLIs (AWS, gcloud and kubectl use one global context). Our motivation here is to enhance the ability for users to set up environments on their machine for agents to operate without having to actively switch profiles or provide such capabilities to their agent.
Non-goals
CLOUDFLARE_API_TOKEN.Note
We will not be removing
wrangler login/logoutat this stage nor any of the other top level scoped auth comments (eg.wrangler whoami) though this is the future direction forcfto nest authentication commands underauth.Beta Was this translation helpful? Give feedback.
All reactions