[wrangler] Add Access Service Token support for CI/non-interactive environment#13031
[wrangler] Add Access Service Token support for CI/non-interactive environment#13031
Conversation
…vironments Support authenticating with Cloudflare Access-protected domains via CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET env vars. This enables wrangler dev with remote bindings in CI where cloudflared access login is not possible. When running in a non-interactive environment without these credentials, throw a clear, actionable error instead of hanging on cloudflared. Fixes #11881
🦋 Changeset detectedLatest commit: a6bb5a2 The changes in this PR will be included in the next version bump. Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
WalshyDev
changed the title
|
Codeowners approval required for this PR:
Show detailed file reviewers
|
|
APIError: Not Found: Not found |
|
@WalshyDev Bonk workflow failed. Check the logs for details. View workflow run · To retry, trigger Bonk again. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
create-cloudflare
@cloudflare/kv-asset-handler
miniflare
@cloudflare/pages-shared
@cloudflare/unenv-preset
@cloudflare/vite-plugin
@cloudflare/vitest-pool-workers
@cloudflare/workers-editor-shared
wrangler
commit: |
| ```sh | ||
| export CLOUDFLARE_ACCESS_CLIENT_ID="<your-client-id>.access" | ||
| export CLOUDFLARE_ACCESS_CLIENT_SECRET="<your-client-secret>" | ||
| wrangler dev --remote |
There was a problem hiding this comment.
| wrangler dev --remote | |
| wrangler dev |
remote binding works without --remote (but I guess that the env vars still apply to --remote as well?)
| // Warn if only one of the two env vars is set | ||
| if (clientId || clientSecret) { |
There was a problem hiding this comment.
this check doesn't seem correct, doesn't it mean that we show the warning even when both variables are set? (true || true) === true
| // Non-interactive so it will throw after the warning | ||
| setIsTTY(false); | ||
|
|
||
| await expect(getAccessToken("access-protected.com")).rejects.toThrow( |
There was a problem hiding this comment.
What about toThrowErrorMatchingInlineSnapshot to include the whole error message instead of just non-interactive? 🙂
There was a problem hiding this comment.
This applies to all the other rejects.toThrow below, also I think the rejects.toEquals could be updated to just be toThrowErrorMatchingInlineSnapshot calls
| ); | ||
| }); | ||
|
|
||
| it("should warn when only CLOUDFLARE_ACCESS_CLIENT_ID is set", async ({ |
There was a problem hiding this comment.
this and the following test, are saying should warn but then are not actually testing the warning message 😅
3 participants
Fixes #11881.
When running
wrangler devwith remote bindings (orvitest-pool-workerswith remote bindings) behind a Cloudflare Access-protected domain, Wrangler spawnscloudflared access loginwhich opens a browser for interactive authentication. This is impossible in CI/CD environments.This PR adds support for Cloudflare Access Service Token authentication via two new environment variables:
CLOUDFLARE_ACCESS_CLIENT_ID-- the Access Service Token Client IDCLOUDFLARE_ACCESS_CLIENT_SECRET-- the Access Service Token Client SecretWhen both are set, Wrangler authenticates by sending
CF-Access-Client-IdandCF-Access-Client-Secretheaders to the Access-protected domain, extracting theCF_AuthorizationJWT from the response, and using it for subsequent requests -- completely bypassing the interactivecloudflaredflow.Additionally, when running in a non-interactive environment (no TTY or CI detected) without these credentials, Wrangler now throws a clear, actionable
UserErrorinstead of hanging oncloudflared access login:The domain "example.workers.dev" is behind Cloudflare Access, but no Access Service Token
credentials were found and the current environment is non-interactive.
Set the CLOUDFLARE_ACCESS_CLIENT_ID and CLOUDFLARE_ACCESS_CLIENT_SECRET environment variables
to authenticate with an Access Service Token.
See https://developers.cloudflare.com/cloudflare-one/access-controls/service-credentials/service-tokens/
Usage
CLOUDFLARE_ACCESS_CLIENT_IDandCLOUDFLARE_ACCESS_CLIENT_SECRETsystem environment variables cloudflare-docs#29256