wrangler: feat: validate Worker subdomain mixed state (#10770)

Enabling or disabling `workers_dev` is often an indication that
the user is also trying to enable or disable `preview_urls`. Warn the
user when these enter mixed state.

Author: danielrs

.changeset/tiny-yaks-obey.md

@@ -0,0 +1,7 @@
+---
+"wrangler": minor
+---
+
+Enabling or disabling `workers_dev` is often an indication that
+the user is also trying to enable or disable `preview_urls`. Warn the
+user when these enter mixed state.

packages/wrangler/src/__tests__/deploy.test.ts

@@ -6968,6 +6968,154 @@ addEventListener('fetch', event => {});`
 		});
 	});
 
+	describe("workers_dev mixed state warnings", () => {
+		beforeEach(() => {
+			vi.stubEnv("WRANGLER_DISABLE_SUBDOMAIN_MIXED_STATE_CHECK", "false");
+		});
+
+		afterEach(() => {
+			vi.unstubAllEnvs();
+		});
+
+		it("should not warn when config is the same as remote", async () => {
+			writeWranglerConfig({
+				workers_dev: false,
+				preview_urls: true,
+			});
+			writeWorkerSource();
+			mockSubDomainRequest("test-sub-domain", true, false);
+			mockUploadWorkerRequest();
+			mockGetWorkerSubdomain({ enabled: false, previews_enabled: true });
+			await runWrangler("deploy ./index");
+
+			expect(std.out).toMatchInlineSnapshot(`
+				"Total Upload: xx KiB / gzip: xx KiB
+				Worker Startup Time: 100 ms
+				Uploaded test-name (TIMINGS)
+				No deploy targets for test-name (TIMINGS)
+				Current Version ID: Galaxy-Class"
+			`);
+			expect(std.err).toMatchInlineSnapshot(`""`);
+			expect(std.warn).toMatchInlineSnapshot(`""`);
+		});
+
+		it("should not warn when workers_dev=false,preview_urls=false", async () => {
+			writeWranglerConfig({
+				workers_dev: false,
+				preview_urls: false,
+			});
+			writeWorkerSource();
+			mockSubDomainRequest("test-sub-domain", true, false);
+			mockUploadWorkerRequest();
+			mockGetWorkerSubdomain({ enabled: true, previews_enabled: true });
+			mockUpdateWorkerSubdomain({ enabled: false, previews_enabled: false });
+			await runWrangler("deploy ./index");
+
+			expect(std.out).toMatchInlineSnapshot(`
+				"Total Upload: xx KiB / gzip: xx KiB
+				Worker Startup Time: 100 ms
+				Uploaded test-name (TIMINGS)
+				No deploy targets for test-name (TIMINGS)
+				Current Version ID: Galaxy-Class"
+			`);
+			expect(std.err).toMatchInlineSnapshot(`""`);
+			expect(std.warn).toMatchInlineSnapshot(`""`);
+		});
+
+		it("should not warn when workers_dev=true,preview_urls=true", async () => {
+			writeWranglerConfig({
+				workers_dev: true,
+				preview_urls: true,
+			});
+			writeWorkerSource();
+			mockSubDomainRequest("test-sub-domain", true, false);
+			mockUploadWorkerRequest();
+			mockGetWorkerSubdomain({ enabled: false, previews_enabled: false });
+			mockUpdateWorkerSubdomain({ enabled: true, previews_enabled: true });
+			await runWrangler("deploy ./index");
+
+			expect(std.out).toMatchInlineSnapshot(`
+				"Total Upload: xx KiB / gzip: xx KiB
+				Worker Startup Time: 100 ms
+				Uploaded test-name (TIMINGS)
+				Deployed test-name triggers (TIMINGS)
+				  https://test-name.test-sub-domain.workers.dev
+				Current Version ID: Galaxy-Class"
+			`);
+			expect(std.err).toMatchInlineSnapshot(`""`);
+			expect(std.warn).toMatchInlineSnapshot(`""`);
+		});
+
+		it("should warn when workers_dev=false,preview_urls=true", async () => {
+			writeWranglerConfig({
+				workers_dev: false,
+				preview_urls: true,
+			});
+			writeWorkerSource();
+			mockSubDomainRequest("test-sub-domain", true, false);
+			mockUploadWorkerRequest();
+			mockGetWorkerSubdomain({ enabled: true, previews_enabled: true });
+			mockUpdateWorkerSubdomain({ enabled: false, previews_enabled: true });
+			await runWrangler("deploy ./index");
+
+			expect(std.out).toMatchInlineSnapshot(`
+				"Total Upload: xx KiB / gzip: xx KiB
+				Worker Startup Time: 100 ms
+				Uploaded test-name (TIMINGS)
+				No deploy targets for test-name (TIMINGS)
+				Current Version ID: Galaxy-Class"
+			`);
+			expect(std.err).toMatchInlineSnapshot(`""`);
+			expect(std.warn).toMatchInlineSnapshot(`
+				"▲ [WARNING] You are disabling the 'workers.dev' subdomain for this Worker, but Preview URLs are still enabled.
+
+				  Preview URLs will automatically generate a unique, shareable link for each new version which will
+				  be accessible at:
+				    https://<VERSION_PREFIX>-test-name.test-sub-domain.workers.dev
+
+				  To prevent this Worker from being unintentionally public, you may want to disable the Preview URLs
+				  as well by setting \`preview_urls = false\` in your Wrangler config file.
+
+				"
+			`);
+		});
+
+		it("should warn when workers_dev=true,preview_urls=false", async () => {
+			writeWranglerConfig({
+				workers_dev: true,
+				preview_urls: false,
+			});
+			writeWorkerSource();
+			mockSubDomainRequest("test-sub-domain", true, false);
+			mockUploadWorkerRequest();
+			mockGetWorkerSubdomain({ enabled: false, previews_enabled: false });
+			mockUpdateWorkerSubdomain({ enabled: true, previews_enabled: false });
+			await runWrangler("deploy ./index");
+
+			expect(std.out).toMatchInlineSnapshot(`
+				"Total Upload: xx KiB / gzip: xx KiB
+				Worker Startup Time: 100 ms
+				Uploaded test-name (TIMINGS)
+				Deployed test-name triggers (TIMINGS)
+				  https://test-name.test-sub-domain.workers.dev
+				Current Version ID: Galaxy-Class"
+			`);
+			expect(std.err).toMatchInlineSnapshot(`""`);
+			expect(std.warn).toMatchInlineSnapshot(`
+				"▲ [WARNING] You are enabling the 'workers.dev' subdomain for this Worker, but Preview URLs are still disabled.
+
+				  Preview URLs will automatically generate a unique, shareable link for each new version which will
+				  be accessible at:
+				    https://<VERSION_PREFIX>-test-name.test-sub-domain.workers.dev
+
+				  You may want to enable the Preview URLs as well by setting \`preview_urls = true\` in your Wrangler
+				  config file.
+
+				"
+			`);
+		});
+	});
+
 	describe("[define]", () => {
 		it("should be able to define values that will be substituted into top-level identifiers", async () => {
 			writeWranglerConfig({

packages/wrangler/src/__tests__/helpers/mock-workers-subdomain.ts

@@ -4,7 +4,8 @@ import { createFetchResult, msw } from "./msw";
 /** Create a mock handler for the request to get the account's subdomain. */
 export function mockSubDomainRequest(
 	subdomain = "test-sub-domain",
-	registeredWorkersDev = true
+	registeredWorkersDev = true,
+	once = true
 ) {
 	if (registeredWorkersDev) {
 		msw.use(
@@ -13,7 +14,7 @@ export function mockSubDomainRequest(
 				() => {
 					return HttpResponse.json(createFetchResult({ subdomain }));
 				},
-				{ once: true }
+				{ once }
 			)
 		);
 	} else {
@@ -27,7 +28,7 @@ export function mockSubDomainRequest(
 						])
 					);
 				},
-				{ once: true }
+				{ once }
 			)
 		);
 	}

packages/wrangler/src/__tests__/vitest.setup.ts

@@ -222,3 +222,8 @@ vi.mock("../../package.json", () => {
 		version: "x.x.x",
 	};
 });
+
+// Disable subdomain mixed state check for tests (specific test will enable it).
+beforeEach(() => {
+	vi.stubEnv("WRANGLER_DISABLE_SUBDOMAIN_MIXED_STATE_CHECK", "true");
+});

packages/wrangler/src/environment-variables/factory.ts

@@ -38,6 +38,8 @@ type VariableNames =
 	| "CLOUDFLARE_INCLUDE_PROCESS_ENV"
 	/** Include a trace header in all API requests that Wrangler makes (for internal use only) */
 	| "WRANGLER_TRACE_ID"
+	/** Disable the check for mixed state of subdomain flags (`workers_dev`, `preview_urls`, etc.) (default: false). */
+	| "WRANGLER_DISABLE_SUBDOMAIN_MIXED_STATE_CHECK"
 
 	// ## Logging & Output
 

packages/wrangler/src/environment-variables/misc-variables.ts

@@ -272,6 +272,12 @@ export const getDockerPath = getEnvironmentVariableFactory({
 	},
 });
 
+export const getSubdomainMixedStateCheckDisabled =
+	getBooleanEnvironmentVariableFactory({
+		variableName: "WRANGLER_DISABLE_SUBDOMAIN_MIXED_STATE_CHECK",
+		defaultValue: false,
+	});
+
 /**
 /**
  * `CLOUDFLARE_LOAD_DEV_VARS_FROM_DOT_ENV` specifies whether to load vars for local dev from `.env` files.

packages/wrangler/src/triggers/deploy.ts

@@ -9,7 +9,9 @@ import {
 	updateQueueConsumers,
 	validateRoutes,
 } from "../deploy/deploy";
+import { getSubdomainMixedStateCheckDisabled } from "../environment-variables/misc-variables";
 import { UserError } from "../errors";
+import { isNonInteractiveOrCI } from "../is-interactive";
 import { logger } from "../logger";
 import { ensureQueuesExistByConfig } from "../queues/client";
 import { getWorkersDevSubdomain } from "../routes";
@@ -310,6 +312,85 @@ export function getSubdomainValues(
 	};
 }
 
+async function validateSubdomainMixedState(
+	props: Props,
+	accountId: string,
+	scriptName: string,
+	configFlags: { workers_dev?: boolean; preview_urls?: boolean },
+	desired: { workers_dev: boolean; preview_urls: boolean },
+	remote: { workers_dev: boolean; preview_urls: boolean },
+	firstDeploy: boolean
+): Promise<{
+	workers_dev: boolean;
+	preview_urls: boolean;
+}> {
+	const { config } = props;
+
+	const changed =
+		desired.workers_dev !== remote.workers_dev ||
+		desired.preview_urls !== remote.preview_urls;
+
+	// Early return if config values are the same as remote values (so we only warn on change)
+	if (!changed) {
+		return desired;
+	}
+
+	// Early return if check disabled through environment variable.
+	if (getSubdomainMixedStateCheckDisabled()) {
+		return desired;
+	}
+
+	// Early return if non-interactive or CI
+	if (isNonInteractiveOrCI()) {
+		return desired;
+	}
+
+	// Early return if this is the first deploy
+	if (firstDeploy) {
+		return desired;
+	}
+
+	// Early return if config values are the same (e.g. both true or both false, not in mixed state)
+	if (desired.workers_dev === desired.preview_urls) {
+		return desired;
+	}
+
+	const userSubdomain = await getWorkersDevSubdomain(
+		config,
+		accountId,
+		config.configPath
+	);
+	const previewUrl = `https://<VERSION_PREFIX>-${scriptName}.${userSubdomain}`;
+
+	// Scenario 1: User disables workers.dev while having preview URLs enabled
+	if (!desired.workers_dev && desired.preview_urls) {
+		logger.warn(
+			[
+				"You are disabling the 'workers.dev' subdomain for this Worker, but Preview URLs are still enabled.",
+				"Preview URLs will automatically generate a unique, shareable link for each new version which will be accessible at:",
+				`  ${previewUrl}`,
+				"",
+				"To prevent this Worker from being unintentionally public, you may want to disable the Preview URLs as well by setting `preview_urls = false` in your Wrangler config file.",
+			].join("\n")
+		);
+	}
+
+	// Scenario 2: User enables workers.dev when Preview URLs are off
+	if (desired.workers_dev && !desired.preview_urls) {
+		logger.warn(
+			[
+				"You are enabling the 'workers.dev' subdomain for this Worker, but Preview URLs are still disabled.",
+				"Preview URLs will automatically generate a unique, shareable link for each new version which will be accessible at:",
+				`  ${previewUrl}`,
+				"",
+				"You may want to enable the Preview URLs as well by setting `preview_urls = true` in your Wrangler config file.",
+			].join("\n")
+		);
+	}
+
+	return desired;
+}
+
 async function subdomainDeploy(
 	props: Props,
 	accountId: string,
@@ -322,11 +403,6 @@ async function subdomainDeploy(
 ) {
 	const { config } = props;
 
-	// Get desired subdomain enablement status.
-
-	const { workers_dev: wantWorkersDev, preview_urls: wantPreviews } =
-		getSubdomainValues(config.workers_dev, config.preview_urls, routes);
-
 	// Get current subdomain enablement status.
 
 	const { enabled: currWorkersDev, previews_enabled: currPreviews } =
@@ -335,6 +411,25 @@ async function subdomainDeploy(
 			previews_enabled: boolean;
 		}>(config, `${workerUrl}/subdomain`);
 
+	// Get desired subdomain enablement status.
+
+	const desiredSubdomain = await getSubdomainValues(
+		config.workers_dev,
+		config.preview_urls,
+		routes
+	);
+
+	const { workers_dev: wantWorkersDev, preview_urls: wantPreviews } =
+		await validateSubdomainMixedState(
+			props,
+			accountId,
+			scriptName,
+			config,
+			desiredSubdomain,
+			{ workers_dev: currWorkersDev, preview_urls: currPreviews },
+			firstDeploy
+		);
+
 	const workersDevInSync = wantWorkersDev === currWorkersDev;
 	const previewsInSync = wantPreviews === currPreviews;
 	const allInSync = [workersDevInSync, previewsInSync].every((v) => v);