[Cloudflare] OAuth + API Worker deployment PoC (#76)

CHANGELOG.md

@@ -3,6 +3,7 @@
 All notable user-facing changes are listed here. Detailed notes for older releases: [docs/releases/](docs/releases/).
 
 ## Unreleased
+- Added an experimental Cloudflare OAuth + API Worker deployment PoC with PKCE, multiple independent Cloudflare logins/accounts, encrypted access-token storage, deploy/update/delete, workers.dev smoke testing, and automatic Worker Pool registration.
 
 ## 1.11.0 - 2026-09-19
 - Promoted the userspace `awg_warp` backend to the stable channel. Telegram traffic can use AmneziaWG/WARP inside the app without Android `VpnService`, root, or a system TUN interface.

app/build.gradle.kts

@@ -6,6 +6,21 @@ plugins {
 val releaseVersionCode = 54
 val releaseVersionName = "1.11.0"
 
+fun asBuildConfigString(value: String): String {
+    val escaped = value.replace("\\", "\\\\").replace("\"", "\\\"")
+    return "\"$escaped\""
+}
+
+val cloudflareOAuthClientId = providers.gradleProperty("TGWSPROXY_CF_OAUTH_CLIENT_ID")
+    .orElse(providers.environmentVariable("TGWSPROXY_CF_OAUTH_CLIENT_ID"))
+    .getOrElse("")
+val cloudflareOAuthScopes = providers.gradleProperty("TGWSPROXY_CF_OAUTH_SCOPES")
+    .orElse(providers.environmentVariable("TGWSPROXY_CF_OAUTH_SCOPES"))
+    .getOrElse("memberships.read workers-scripts.read workers-scripts.write")
+val cloudflareOAuthRedirectUri = "tgwsproxy://oauth/cloudflare"
+val generatedCloudflareWorkerAssets = layout.buildDirectory.dir("generated/cloudflare-worker-assets")
+
+
 val buildNativeAndroid by tasks.registering(org.gradle.api.tasks.Exec::class) {
     val script = rootProject.file("scripts/build-native-android.ps1")
     val nativeDir = rootProject.file("native/tgwsproxy")
@@ -36,8 +51,16 @@ val generateAppIcons by tasks.registering(org.gradle.api.tasks.Exec::class) {
     }
 }
 
+val syncCloudflareWorkerAssets by tasks.registering(org.gradle.api.tasks.Copy::class) {
+    from(rootProject.file("scripts/cloudflare-worker")) {
+        include("worker.js", "chunk-relay-worker.js", "chunk-relay-status-worker.js")
+        into("cloudflare-worker")
+    }
+    into(generatedCloudflareWorkerAssets)
+}
+
 tasks.named("preBuild") {
-    dependsOn(buildNativeAndroid, generateAppIcons)
+    dependsOn(buildNativeAndroid, generateAppIcons, syncCloudflareWorkerAssets)
 }
 
 android {
@@ -51,6 +74,10 @@ android {
         versionCode = releaseVersionCode
         versionName = releaseVersionName
 
+        buildConfigField("String", "CLOUDFLARE_OAUTH_CLIENT_ID", asBuildConfigString(cloudflareOAuthClientId))
+        buildConfigField("String", "CLOUDFLARE_OAUTH_SCOPES", asBuildConfigString(cloudflareOAuthScopes))
+        buildConfigField("String", "CLOUDFLARE_OAUTH_REDIRECT_URI", asBuildConfigString(cloudflareOAuthRedirectUri))
+
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
         vectorDrawables {
             useSupportLibrary = true
@@ -103,6 +130,7 @@ android {
     }
     buildFeatures {
         compose = true
+        buildConfig = true
     }
     composeOptions {
         kotlinCompilerExtensionVersion = "1.5.8"
@@ -115,6 +143,7 @@ android {
     sourceSets {
         getByName("main") {
             jniLibs.srcDir("src/main/jniLibs")
+            assets.srcDir(generatedCloudflareWorkerAssets)
         }
     }
 }

app/src/main/AndroidManifest.xml

@@ -42,6 +42,22 @@
             android:exported="false"
             android:theme="@android:style/Theme.NoTitleBar" />
 
+        <activity
+            android:name="com.amurcanov.tgwsproxy.cloudflare.CloudflareOAuthActivity"
+            android:exported="true"
+            android:launchMode="singleTop"
+            android:theme="@android:style/Theme.NoTitleBar">
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data
+                    android:scheme="tgwsproxy"
+                    android:host="oauth"
+                    android:path="/cloudflare" />
+            </intent-filter>
+        </activity>
+
         <service
             android:name="com.amurcanov.tgwsproxy.ProxyService"
             android:exported="false"

app/src/main/java/com/amurcanov/tgwsproxy/CloudflareSettingsUi.kt

@@ -1,5 +1,6 @@
 package com.amurcanov.tgwsproxy
 
+import android.content.Intent
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.ColumnScope
@@ -52,6 +53,7 @@ import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.ui.graphics.vector.ImageVector
 import androidx.compose.ui.unit.dp
+import com.amurcanov.tgwsproxy.cloudflare.CloudflareOAuthActivity
 import com.amurcanov.tgwsproxy.worker.WorkerEndpoint
 import com.amurcanov.tgwsproxy.worker.WorkerPoolSettingsScreen
 import com.amurcanov.tgwsproxy.worker.WorkerUrlSanitizer
@@ -439,6 +441,23 @@ private fun CloudflareOverviewScreen(
 
         Spacer(modifier = Modifier.height(10.dp))
 
+        CfSectionCard(titleRes = R.string.cf_oauth_overview_title) {
+            Text(
+                stringResource(R.string.cf_oauth_overview_hint),
+                style = MaterialTheme.typography.bodySmall,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+            )
+            TextButton(
+                onClick = {
+                    context.startActivity(Intent(context, CloudflareOAuthActivity::class.java))
+                },
+            ) {
+                Text(stringResource(R.string.cf_oauth_overview_open))
+            }
+        }
+
+        Spacer(modifier = Modifier.height(10.dp))
+
         CfSectionCard(titleRes = R.string.cf_proxy_domains_title) {
             MetricLine(
                 stringResource(R.string.cf_proxy_domains_active_count),