add auth profiles to wrangler (#14200)

Author: emily-shen

.changeset/auth-profiles.md

@@ -0,0 +1,27 @@
+---
+"wrangler": minor
+---
+
+Add auth profiles for managing multiple OAuth logins
+
+Auth profiles let you maintain separate OAuth logins and bind them to directories, so you can switch between different accounts for different projects without having to re-login.
+
+For example:
+
+```sh
+wrangler auth create work
+wrangler auth activate work ~/projects/work
+
+wrangler auth create personal
+wrangler auth activate personal ~/projects/personal
+```
+
+New commands under `wrangler auth`:
+
+- `wrangler auth create <name>` — create or re-authenticate a named profile via OAuth
+- `wrangler auth delete <name>` — delete a profile and all its directory bindings
+- `wrangler auth activate <name> [dir]` — bind a profile to a directory (defaults to cwd). Sub-directories will inherit this profile.
+- `wrangler auth deactivate [dir]` — remove a directory binding
+- `wrangler auth list` — list all profiles and their corresponding directories
+
+There is also a new global `--profile` flag, which you can use to activate a profile for just that command run. Note that if you have `CLOUDFLARE_API_TOKEN` set, that will still take precedence over all profiles. Any account id settings (via `CLOUDFLARE_ACCOUNT_ID` or wrangler config) will also still be respected.

packages/workers-auth/src/context.ts

@@ -104,9 +104,15 @@ export interface OAuthFlowContext {
 	redirectUri: string;
 
 	/**
-	 * Persistence backend for the stored auth config.
+	 * Factory that returns a persistence backend for the given auth profile.
+	 *
+	 * Called with the active profile name (e.g. `"default"`) on every storage
+	 * access so the flow always reads/writes the correct backing store.
+	 * The consumer is responsible for mapping profile names to concrete storage
+	 * backends (e.g. wrangler maps each profile to a separate TOML file under
+	 * the global config directory).
 	 */
-	storage: AuthConfigStorage;
+	storageFactory: (profile?: string) => AuthConfigStorage;
 
 	/**
 	 * Whether the flow's credential resolvers (`getAPIToken` / `requireApiToken`)

packages/workers-auth/src/flow.ts

@@ -26,6 +26,7 @@ import { generateRandomState as defaultGenerateRandomState } from "./generate-ra
 import { readStoredAuthState, type OAuthFlowState } from "./state";
 import { getOrCreateTemporaryPreviewAccount } from "./temporary";
 import { exchangeRefreshTokenForAccessToken } from "./token-exchange";
+import type { AuthConfigStorage } from "./config-file/auth";
 import type { TemporaryPreviewAccount } from "./config-file/temporary";
 import type { OAuthFlowContext } from "./context";
 import type {
@@ -77,12 +78,28 @@ export interface LoginProps {
 	callbackHost?: string;
 	/** Port the local callback server listens on. Defaults to `8976`. */
 	callbackPort?: number;
+	/**
+	 * Named auth profile to store the token under. When omitted, the default
+	 * profile (`default.toml`) is used.
+	 * Only for use by 'auth create', not exposed to the user
+	 */
+	profile?: string;
 }
 
 /**
  * Public surface returned by {@link createOAuthFlow}.
  */
 export interface OAuthFlowAPI {
+	/**
+	 * Set the active auth profile for all subsequent storage lookups.
+	 *
+	 * Called once at top of command dispatch by the consumer after resolving the
+	 * active profile. `"default"` if never called.
+	 */
+	setProfile(profile: string): void;
+
+	getActiveProfile(): string;
+
 	/**
 	 * Open the authorize URL in the user's browser, wait for the callback to be
 	 * hit on the local HTTP server, exchange the code for an access token, and
@@ -91,6 +108,9 @@ export interface OAuthFlowAPI {
 	 * Refuses to start when `ctx.hasEnvCredentials()` returns `true`.
 	 * Refuses to start when the compliance region is `fedramp_high`.
 	 *
+	 * When `props.profile` is set, the token is stored under that profile
+	 * instead of the active one. This is used by `auth create <name>`.
+	 *
 	 * @returns `true` on success, `false` when env credentials are present.
 	 */
 	login(props: LoginProps): Promise<boolean>;
@@ -101,8 +121,11 @@ export interface OAuthFlowAPI {
 	 *
 	 * No-op when `ctx.hasEnvCredentials()` returns `true` (env credentials
 	 * cannot be revoked).
+	 *
+	 * When `profile` is passed, operates on that profile instead of the
+	 * active one. This is used by `auth delete <name>`.
 	 */
-	logout(): Promise<void>;
+	logout(profile?: string): Promise<void>;
 
 	/**
 	 * If the user has no stored OAuth token, attempt an interactive login.
@@ -144,6 +167,12 @@ export interface OAuthFlowAPI {
 	 */
 	requireApiToken(): ApiCredentials;
 
+	/**
+	 * Return the scopes granted to the stored OAuth token for the active
+	 * profile, or `undefined` when no OAuth token is stored.
+	 */
+	getScopes(): string[] | undefined;
+
 	/**
 	 * Establish whether `--temporary` is permitted for this invocation. Called
 	 * once at command dispatch by the consumer. Also drops any temporary account
@@ -190,7 +219,12 @@ export function createOAuthFlow(ctx: OAuthFlowContext): OAuthFlowAPI {
 		generateRandomState: ctx.generateRandomState ?? defaultGenerateRandomState,
 	};
 
-	const storage = ctx.storage;
+	let activeProfile = "default";
+
+	function getStorage(profile?: string): AuthConfigStorage {
+		return ctx.storageFactory(profile ?? activeProfile);
+	}
+
 	const getClientId = () =>
 		typeof ctx.clientId === "function" ? ctx.clientId() : ctx.clientId;
 	const consent = ctx.consent;
@@ -249,7 +283,7 @@ export function createOAuthFlow(ctx: OAuthFlowContext): OAuthFlowAPI {
 			generators
 		);
 
-		storage.write({
+		getStorage(props.profile).write({
 			oauth_token: oauth.token?.value ?? "",
 			expiration_time: oauth.token?.expiry,
 			refresh_token: oauth.refreshToken?.value,
@@ -264,23 +298,24 @@ export function createOAuthFlow(ctx: OAuthFlowContext): OAuthFlowAPI {
 		return true;
 	}
 
-	function isRefreshNeeded(): boolean {
+	function isRefreshNeeded(profile?: string): boolean {
 		if (ctx.hasEnvCredentials()) {
 			return false;
 		}
 		const { accessToken } = readStoredAuthState({
 			warningLogger: ctx.logger,
-			storage,
+			storage: getStorage(profile),
 		});
 		return Boolean(accessToken && new Date() >= new Date(accessToken.expiry));
 	}
 
-	async function refreshToken(): Promise<boolean> {
+	async function refreshToken(profile?: string): Promise<boolean> {
 		// `exchangeRefreshTokenForAccessToken` reads the refresh token fresh from
 		// disk on every call, so we always pick up the latest rotation written by a
 		// sibling Wrangler process. Refresh tokens are single-use, so a long-lived
 		// process such as `wrangler dev` would otherwise send a stale value and get
 		// a 401 from the token endpoint.
+		const storage = getStorage(profile);
 
 		try {
 			const {
@@ -323,7 +358,7 @@ export function createOAuthFlow(ctx: OAuthFlowContext): OAuthFlowAPI {
 		// TODO: ask permission before opening browser
 		const stored = readStoredAuthState({
 			warningLogger: ctx.logger,
-			storage,
+			storage: getStorage(props.profile),
 		});
 		if (!stored.accessToken && !stored.deprecatedApiToken) {
 			// Not logged in.
@@ -338,10 +373,10 @@ export function createOAuthFlow(ctx: OAuthFlowContext): OAuthFlowAPI {
 				return { loggedIn: true };
 			}
 			return { loggedIn: false, reason: "no-credentials-login-failed" };
-		} else if (isRefreshNeeded()) {
+		} else if (isRefreshNeeded(props.profile)) {
 			// We're logged in, but the refresh token seems to have expired,
 			// so let's try to refresh it
-			const didRefresh = await refreshToken();
+			const didRefresh = await refreshToken(props.profile);
 			if (didRefresh) {
 				// The token was refreshed, so we're done here
 				return { loggedIn: true };
@@ -362,7 +397,7 @@ export function createOAuthFlow(ctx: OAuthFlowContext): OAuthFlowAPI {
 		}
 	}
 
-	async function logout(): Promise<void> {
+	async function logout(profile?: string): Promise<void> {
 		const clearedTemporary = clearTemporaryAccount();
 
 		if (ctx.hasEnvCredentials()) {
@@ -376,7 +411,7 @@ export function createOAuthFlow(ctx: OAuthFlowContext): OAuthFlowAPI {
 
 		const storedRefreshToken = readStoredAuthState({
 			warningLogger: ctx.logger,
-			storage,
+			storage: getStorage(profile),
 		}).refreshToken;
 		if (!storedRefreshToken) {
 			ctx.logger.log(
@@ -400,14 +435,17 @@ export function createOAuthFlow(ctx: OAuthFlowContext): OAuthFlowAPI {
 			},
 		});
 		await response.text(); // blank text? would be nice if it was something meaningful
-		storage.clear();
+		getStorage(profile).clear();
 		ctx.logger.log(`Successfully logged out.`);
 		ctx.purgeOnLoginOrLogout?.();
 	}
 
 	async function getOAuthTokenFromLocalState(): Promise<string | undefined> {
 		// Check if we have an OAuth token
-		let stored = readStoredAuthState({ warningLogger: ctx.logger, storage });
+		let stored = readStoredAuthState({
+			warningLogger: ctx.logger,
+			storage: getStorage(),
+		});
 		if (!stored.accessToken) {
 			return undefined;
 		}
@@ -425,7 +463,10 @@ export function createOAuthFlow(ctx: OAuthFlowContext): OAuthFlowAPI {
 				return undefined;
 			}
 			// Re-read after the refresh has persisted the new token to disk.
-			stored = readStoredAuthState({ warningLogger: ctx.logger, storage });
+			stored = readStoredAuthState({
+				warningLogger: ctx.logger,
+				storage: getStorage(),
+			});
 		}
 
 		return stored.accessToken?.value;
@@ -437,7 +478,7 @@ export function createOAuthFlow(ctx: OAuthFlowContext): OAuthFlowAPI {
 		}
 
 		return getAPIToken({
-			storage,
+			storage: getStorage(),
 			warningLogger: ctx.logger,
 			allowGlobalAuthKey: ctx.allowGlobalAuthKey,
 		});
@@ -449,7 +490,7 @@ export function createOAuthFlow(ctx: OAuthFlowContext): OAuthFlowAPI {
 		}
 
 		return requireApiToken({
-			storage,
+			storage: getStorage(),
 			warningLogger: ctx.logger,
 			allowGlobalAuthKey: ctx.allowGlobalAuthKey,
 		});
@@ -492,13 +533,31 @@ export function createOAuthFlow(ctx: OAuthFlowContext): OAuthFlowAPI {
 		return ctx.temporary?.storage.clear() ?? false;
 	}
 
+	function setProfile(profile: string): void {
+		activeProfile = profile;
+	}
+
+	function getActiveProfile(): string {
+		return activeProfile;
+	}
+
+	function getScopes(): string[] | undefined {
+		return readStoredAuthState({
+			warningLogger: ctx.logger,
+			storage: getStorage(),
+		}).scopes;
+	}
+
 	return {
+		setProfile,
+		getActiveProfile,
 		login,
 		logout,
 		loginOrRefreshIfRequired,
 		getOAuthTokenFromLocalState,
 		getAPIToken: getAPITokenInternal,
 		requireApiToken: requireApiTokenInternal,
+		getScopes,
 		setTemporaryAllowed,
 		isTemporaryAllowed,
 		getActiveTemporaryAccount,

packages/workers-auth/src/index.ts

@@ -37,6 +37,15 @@ export { generateRandomState } from "./generate-random-state";
 export { TEMPORARY_TERMS_NOTICE, TEMPORARY_TERMS_PROMPT } from "./temporary";
 export { PKCE_CHARSET } from "./pkce";
 
+export { createProfileStore, validateProfileName } from "./profiles";
+export type {
+	DeactivateDirectoryResult,
+	DirectoryBindingOperations,
+	DirectoryBindingsStorage,
+	ProfileConfigOperations,
+	ProfileStore,
+} from "./profiles";
+
 export { readStoredAuthState } from "./state";
 
 export type { TemporaryPreviewAccount } from "./config-file/temporary";