[workers-auth] Make OAuth identity and token storage injectable for reuse by other CLIs#14185
Draft
penalosa wants to merge 1 commit into
Draft
[workers-auth] Make OAuth identity and token storage injectable for reuse by other CLIs#14185penalosa wants to merge 1 commit into
penalosa wants to merge 1 commit into
Conversation
…env-credential resolver - workers-auth: add optional clientId / consent / callback / storage to OAuthFlowContext (default to Wrangler's behaviour); thread them through the flow, callback server, token exchange, and auth-url builder. - workers-auth: hoist getAuthFromEnv / getAPIToken / requireApiToken and the credential env getters here, with an allowGlobalAuthKey toggle and injectable storage, so any Cloudflare CLI shares one resolver. - workers-utils: parameterize getGlobalWranglerConfigPath(appName, useLegacyHomeDir); inject a createRequire-backed require shim via tsup banner (Node build only) so bundled CJS deps work under ESM without a downstream patch. - wrangler: delegate getAuthFromEnv/getAPIToken/requireApiToken to workers-auth; re-export the credential env getters. No behaviour change. - tests + changesets.
🦋 Changeset detectedLatest commit: 51c34b6 The changes in this PR will be included in the next version bump. This PR includes changesets to release 8 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
|
✅ All changesets look good |
Contributor
|
@penalosa Bonk workflow was cancelled. View workflow run · To retry, trigger Bonk again. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Makes the OAuth flow in
@cloudflare/workers-authbrandable so a secondCloudflare CLI (
cf) can reuse it with its own OAuth identity, instead ofre-implementing the PKCE flow. All new surface is optional and defaults to
Wrangler's current behaviour, so Wrangler is functionally unchanged.
@cloudflare/workers-authcreateOAuthFlow's context gains optionalclientId,consent(granted/denied redirect pages),
callback(host/port + registeredredirect_uri), andstorage(a pluggableAuthConfigStorage). Threadedthrough the flow, callback server, token exchange, and auth-URL builder.
getAuthFromEnv,getAPIToken,requireApiToken, and the credential env getters(
getCloudflareAPITokenFromEnv,getCloudflareGlobalAuthKeyFromEnv,getCloudflareGlobalAuthEmailFromEnv).getAuthFromEnv/getAPITokenacceptallowGlobalAuthKey(so a CLI can opt out of global API key + email) andgetAPITokenaccepts injectedstorage.@cloudflare/workers-utilsgetGlobalWranglerConfigPath(appName = "wrangler", useLegacyHomeDir = true)is now parameterized so other first-party CLIs can resolve their own
XDG-compliant config directory. Existing callers are unaffected.
createRequire-backedglobalThis.requirevia atsup banner so bundled CJS deps (e.g.
xdg-app-paths) resolve under pureESM — baking in the fix consumers previously applied via a pnpm patch. The
browser build is intentionally excluded.
wranglergetAuthFromEnv/getAPIToken/requireApiTokennow delegate to theshared implementations; the credential env getters are re-exported from
@cloudflare/workers-auth. No behaviour change — resolution order (globalAPI key + email →
CLOUDFLARE_API_TOKEN→ stored OAuth token) is preserved.@cloudflare/workers-authis an internal package (not for external use) and Wrangler's user-facing behaviour is unchanged.