[workers-auth] Add shared pluggable auth storage and delegated-auth env vars#14444
Draft
penalosa wants to merge 4 commits into
Draft
[workers-auth] Add shared pluggable auth storage and delegated-auth env vars#14444penalosa wants to merge 4 commits into
penalosa wants to merge 4 commits into
Conversation
Add CLOUDFLARE_CONFIG_DIR, which pins the global config directory for the whole process tree via getGlobalConfigPath so a top-level CLI and the tools it delegates to resolve the same stored OAuth token. Also register the delegated-auth variable names CLOUDFLARE_AUTH_CONFIG_FILE, CLOUDFLARE_OAUTH_CLIENT_ID, CLOUDFLARE_ALLOW_GLOBAL_API_KEY and CLOUDFLARE_LOGIN_COMMAND.
🦋 Changeset detectedLatest commit: c8616c1 The changes in this PR will be included in the next version bump. This PR includes changesets to release 5 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
|
✅ All changesets look good |
5 tasks
Contributor
|
All exports resolve correctly. My review summary: The PR is additive, well-tested, and the exports all resolve. I examined for logic bugs, security, backward-compat, and API behavior:
No logic bugs, security issues, backward-compatibility violations, or incorrect API behavior found. LGTM |
@cloudflare/autoconfig
create-cloudflare
@cloudflare/deploy-helpers
@cloudflare/kv-asset-handler
miniflare
@cloudflare/pages-shared
@cloudflare/unenv-preset
@cloudflare/vite-plugin
@cloudflare/vitest-pool-workers
@cloudflare/workers-auth
@cloudflare/workers-editor-shared
@cloudflare/workers-utils
wrangler
commit: |
penalosa
force-pushed
the
penalosa/remote-bindings-auth-foundation
branch
from
cc2f4bc to
0540500
Compare
Replace the injected AuthConfigStorage object at the DI boundary with a
ConfigFileLocation ({ getPath, format }); workers-auth now owns all file I/O
(parsing, serialization, owner-only permissions). createOAuthFlow and
readStoredAuthState take a location; createFileStorage(location) is exported for
direct read/write. Because a location is plain values, it can be configured
entirely from environment variables (e.g. CLOUDFLARE_AUTH_CONFIG_FILE, whose
extension selects TOML/JSON/JSONC). getClientIdFromEnv now prefers the
CLI-neutral CLOUDFLARE_OAUTH_CLIENT_ID over WRANGLER_CLIENT_ID.
Add createEnvApiTokenResolver: resolves env credentials or the stored OAuth token (refreshed when expired), discovering the file location/format via CLOUDFLARE_AUTH_CONFIG_FILE / CLOUDFLARE_CONFIG_DIR and honouring CLOUDFLARE_ALLOW_GLOBAL_API_KEY and CLOUDFLARE_LOGIN_COMMAND. Refresh-only — it never starts an interactive login. Shared so delegated tools (e.g. @cloudflare/remote-bindings) don't reimplement env/OAuth token resolution.
Wire createOAuthFlow / readStoredAuthState with a ConfigFileLocation (defaultAuthConfigLocation) instead of constructing a storage object, and back writeAuthConfigFile/readAuthConfigFile with the shared createFileStorage. Source getClientIdFromEnv from workers-auth so wrangler honours CLOUDFLARE_OAUTH_CLIENT_ID.
penalosa
force-pushed
the
penalosa/remote-bindings-auth-foundation
branch
from
0540500 to
c8616c1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Foundational auth/storage work for Cloudflare CLIs and the tools they delegate to. This is PR 1 of a 2-PR stack; PR 2 (the
@cloudflare/remote-bindingsextraction) builds on it: #14443.The headline change:
@cloudflare/workers-authnow configures auth storage by location (path + format), not by an injected storage object — workers-auth owns the file I/O. Because a location is just plain values, a CLI (wrangler, orcf) can configure it entirely from environment variables, with no code injection.What changed
@cloudflare/workers-utilsCLOUDFLARE_CONFIG_DIRpins the global config directory for the whole process tree (getGlobalConfigPath), so a top-level CLI and its delegated tools resolve the same stored OAuth token.CLOUDFLARE_AUTH_CONFIG_FILE,CLOUDFLARE_OAUTH_CLIENT_ID,CLOUDFLARE_ALLOW_GLOBAL_API_KEY,CLOUDFLARE_LOGIN_COMMAND.@cloudflare/workers-authcreateOAuthFlow,readStoredAuthState) takes aConfigFileLocation({ getPath, format }) instead of anAuthConfigStorageimplementation. workers-auth owns parsing, serialization, and owner-only (0o600) permissions.createFileStorage(location)is exported for consumers needing direct read/write. Format istoml|json|jsonc(inferred from the file extension viaCLOUDFLARE_AUTH_CONFIG_FILE).createEnvApiTokenResolver: an environment-driven API-token resolver (env credentials, or the stored OAuth token refreshed on expiry; refresh-only, never interactive). Discovers the file location/format from the environment and honoursCLOUDFLARE_ALLOW_GLOBAL_API_KEY/CLOUDFLARE_LOGIN_COMMAND.getClientIdFromEnvprefers the CLI-neutralCLOUDFLARE_OAUTH_CLIENT_IDoverWRANGLER_CLIENT_ID.wranglercreateOAuthFlow/readStoredAuthStatewithdefaultAuthConfigLocation()and backswriteAuthConfigFile/readAuthConfigFilewith the sharedcreateFileStorage. SourcesgetClientIdFromEnvfrom workers-auth so it honoursCLOUDFLARE_OAUTH_CLIENT_ID. No user-facing behaviour change.Why this shape
A delegated tool deep in a
cf dev → vite dev → @cloudflare/remote-bindingschain (PR 2) can refresh the correct OAuth token purely from inherited environment variables — including a CLI likecfthat stores its token as JSON/JSONC in a different location — without injecting any storage code.cf → vite → remote-bindingschain.