[workers-auth] Update cf OAuth device flow and scopes

[petebacondarwin]

Supports https://github.com/cloudflare/cf/issues/7.

What changed

• Adds a per-CLI CliDescriptor.useDeviceFlowByDefault setting. The cf descriptor enables it for explicit login and implicit login during account resolution; explicit device: false still opts out, and Wrangler keeps its localhost callback default.
• Authenticates once before the parallel /accounts and /memberships discovery requests, preventing an unresolved account from starting two device codes.
• Expands cf's explicit-scope validator to the 474 requestable scopes in the deployed production registration while preserving the existing 88 default scopes exactly. This accepts OAuth labels such as dns.read; the API-token role label dns_read remains invalid.
• Adds drift guards for the production catalog, unchanged defaults, uniqueness, and non-production exclusions.

This belongs in workers-auth because account resolution can initiate OAuth through loginOrRefreshIfRequired without passing through cf's login-command facade. Registration and default permissions remain separate: broader scopes are available only when a caller explicitly supplies them.

Verification

• Full workers-auth suite: 184 passed, 3 platform-specific skipped
• Typecheck, build, lint, format, and generated-diff checks pass
• Preview integration in cf: focused auth tests, full pnpm check, and build pass

---

• Tests
  • Tests included/updated
  • Automated tests not possible - manual testing has been completed as follows:
  • Additional testing not necessary because:
• Public documentation
  • Cloudflare docs PR(s):
  • Documentation not necessary because: this is package-level CLI behavior documented in source, package AGENTS guidance, changesets, and the consuming cf CLI's public help and release notes.

A picture of a cute animal (not mandatory, but encouraged)

[changeset-bot]

🦋 Changeset detected

Latest commit: b2bf60e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@cloudflare/workers-auth	Minor
@cloudflare/remote-bindings	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[workers-devprod]

Codeowners approval required for this PR:

• ✅ @cloudflare/wrangler

Show detailed file reviewers

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[ask-bonk]

LGTM

github run

[pkg-pr-new]

@cloudflare/autoconfig

npm i https://pkg.pr.new/@cloudflare/autoconfig@15623

@cloudflare/build-output-utils

npm i https://pkg.pr.new/@cloudflare/build-output-utils@15623

@cloudflare/codemods

npm i https://pkg.pr.new/@cloudflare/codemods@15623

@cloudflare/config

npm i https://pkg.pr.new/@cloudflare/config@15623

@cloudflare/containers-shared

npm i https://pkg.pr.new/@cloudflare/containers-shared@15623

create-cloudflare

npm i https://pkg.pr.new/create-cloudflare@15623

@cloudflare/deploy-helpers

npm i https://pkg.pr.new/@cloudflare/deploy-helpers@15623

@cloudflare/kv-asset-handler

npm i https://pkg.pr.new/@cloudflare/kv-asset-handler@15623

miniflare

npm i https://pkg.pr.new/miniflare@15623

@cloudflare/pages-functions

npm i https://pkg.pr.new/@cloudflare/pages-functions@15623

@cloudflare/pages-shared

npm i https://pkg.pr.new/@cloudflare/pages-shared@15623

@cloudflare/unenv-preset

npm i https://pkg.pr.new/@cloudflare/unenv-preset@15623

@cloudflare/vite-plugin

npm i https://pkg.pr.new/@cloudflare/vite-plugin@15623

@cloudflare/vitest-plugin

npm i https://pkg.pr.new/@cloudflare/vitest-plugin@15623

@cloudflare/workers-auth

npm i https://pkg.pr.new/@cloudflare/workers-auth@15623

@cloudflare/workers-editor-shared

npm i https://pkg.pr.new/@cloudflare/workers-editor-shared@15623

@cloudflare/workers-utils

npm i https://pkg.pr.new/@cloudflare/workers-utils@15623

wrangler

npm i https://pkg.pr.new/wrangler@15623

commit: b2bf60e

[petebacondarwin]

Follow-up in 9644e79 strengthens the implicit-login path: fetchAllAccounts() now authenticates once before its parallel /accounts and /memberships requests, so an unauthenticated account lookup cannot start two device codes. The regression test exercises getOrSelectAccountId() directly and verifies a single login with device: true.

[petebacondarwin]

Scope follow-up in c2f5ba2 uses the deployed production registration as an explicit-request allowlist while preserving the existing 88 default scopes exactly. This makes new OAuth labels such as dns.read available through caller-supplied scopes; the API-token role label dns_read remains invalid. Drift guards pin the 474-entry production catalog, the exact default set, uniqueness, and non-production exclusions. Full workers-auth verification: 184 passed, 3 platform-specific skipped; typecheck, build, lint, and format pass.

[petebacondarwin]

CI is now fully green at db27608c6 (the unrelated macOS playground setup timeout passed on rerun). This is ready for code-owner review; downstream cloudflare/cf#228 is waiting on the workers-auth release before it can leave draft.

[workers-devprod]

Codeowners reviews satisfied