cloudflare-toolkit

Appearance

@adrianhall/cloudflare-toolkit

@adrianhall/cloudflare-toolkit / lib/vite / CloudflareAccessPluginOptions

Interface: CloudflareAccessPluginOptions ​

Defined in: src/lib/vite/plugin.ts:67

Configuration for cloudflareAccessPlugin.

Properties ​

devSecret? ​

optional devSecret?: string

Defined in: src/lib/vite/plugin.ts:95

HMAC secret used to sign the dev JWT.

Must match the devSecret passed to cloudflareAccess in the Worker (if overridden there). Defaults to the same well-known development key.

loginPath? ​

optional loginPath?: string

Defined in: src/lib/vite/plugin.ts:104

Pathname for the login form (default "/cdn-cgi/access/login").

policies? ​

optional policies?: PathPolicy[]

Defined in: src/lib/vite/plugin.ts:87

Path policies evaluated in order (first match wins).

Pass the same array you give to cloudflareAccess in the Worker (../hono/cloudflare-access.ts) so dev and prod agree on which paths are protected.

  • authenticate: false — public (no gating, no header injection).
  • authenticate: true — protected. Unauthenticated navigations are redirected to the login form; API routes with redirect: false receive a 401.

When omitted, all non-internal paths are treated as protected.

A policy's own audience (see PathPolicy.audience, ../auth-internal/types.js) is enforced here too: an existing session cookie whose dev token doesn't carry the matched path's audience is treated as unauthenticated for that request, mirroring cloudflareAccess in the Worker (#181). The dev login form issues one session token whose aud claim covers every audience referenced across policies, so a single local sign-in can still reach every role-specific page rather than requiring a separate login per audience.

tokenLifetime? ​

optional tokenLifetime?: number

Defined in: src/lib/vite/plugin.ts:107

Dev JWT lifetime in seconds (default 86400 / 24 h).

users? ​

optional users?: DevLoginUser[]

Defined in: src/lib/vite/plugin.ts:101

Selectable identities rendered on the dev login form. When omitted the form shows a single free-text email input.