nhi: add Cloudflare ZT Access service token syncer (STATIC_SECRET) - #24
nhi: add Cloudflare ZT Access service token syncer (STATIC_SECRET)#24c1-squire-dev[bot] wants to merge 2 commits into
Conversation
Connector PR Review: nhi: add Cloudflare ZT Access service token syncer (STATIC_SECRET)Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0 Review SummaryThe new commit adds the missing "Service tokens" row to the capabilities table in Security IssuesNone found. Correctness IssuesNone found. Suggestions
Prompt for AI agents |
|
The |
NHI Phase-1 Class-B (RFC v6 §5.8.6, §6 row 22). Adds a read-only syncer for
Cloudflare Zero Trust Access service tokens, emitting a SecretTrait with
credential_type STATIC_SECRET and detail cloudflare.zt.service_token (§2.8).
- resource_types.go: add service_token resource type (TRAIT_SECRET).
- service_tokens.go (new): newServiceTokenBuilder + List over
cloudflare-go ListAccessServiceTokens (GET /accounts/{id}/access/service_tokens,
read-only). Entitlements/Grants empty.
- service_tokens_test.go (new): mapper test for the secret trait + detail.
- connector.go: register newServiceTokenBuilder.
- go.mod: bump baton-sdk v0.3.35 -> v0.11.1 (D-345 forward self-bump; go
directive 1.23.4 -> 1.25.2 pulled by the SDK); go mod vendor committed.
Needs v0.11.1 for NonHumanIdentityTrait / WithSecretType. Rebased onto main
post-#25 (managed verify.yaml@v4 + v2 golangci + go1.25 CI alignment).
Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
53329f3 to
e6c2cd1
Compare
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| return nil, "", nil, ErrMissingAccountID | ||
| } | ||
|
|
||
| tokens, _, err := s.client.ListAccessServiceTokens(ctx, cloudflare.AccountIdentifier(s.accountId), cloudflare.ListAccessServiceTokensParams{}) |
There was a problem hiding this comment.
🟡 Suggestion: This new endpoint (GET /accounts/{id}/access/service_tokens) may require an API scope beyond what docs/connector.mdx currently lists (e.g., a dedicated "Access: Service Auth Tokens" read permission). Verify the existing scopes cover this call and update the credential requirements in docs if a new scope is needed (B8, D3).
Documents the sync-only Access service token resource (STATIC_SECRET) added in this PR. Addresses review finding D1. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
|
Addressed review finding D1: added a Re D3/B8 (API scopes): no new scope is required — Note: The red |
1 participant
NHI Phase-1 — Cloudflare ZT Access service tokens (RFC v6 §5.8.6, §6 row 22)
Adds a new read-only syncer for Zero Trust Access service tokens — textbook
NHI (automated-service credentials). A Class-B under-syncing fix: the connector
synced
user/group/role/memberbut never modeled service tokens.Grounding (real HEAD)
user/group/role/member(pkg/connector/resource_types.go); no service-token resource.cloudflare-gov0.83.0 already shipsListAccessServiceTokens(access_service_tokens.go); the syncer calls it withAccountIdentifier(accountId)→GET /accounts/{account_id}/access/service_tokens.Enumerability (scope-guard)
✅ Enumerable.
GET /accounts/{account_id}/access/service_tokens("List service tokens", Zero Trust → Access → Service Tokens) returns each token'sid,client_id,name,created_at,expires_at, etc. Theclient_secretis only returned at creation, never on list — so the syncer carries no secret material. cloudflare-go's helper returns the full set in one call (its params type is empty), so there is no page token to thread.Changes
resource_types.go— addservice_tokenresource type (TRAIT_SECRET).service_tokens.go(new) —newServiceTokenBuilder,ListoverListAccessServiceTokens; emitsSecretTraitviaWithSecretType(CREDENTIAL_TYPE_STATIC_SECRET)+WithSecretDetail("cloudflare.zt.service_token")(§2.8).Entitlements/Grantsempty.service_tokens_test.go(new) — mapper test asserting the secret trait, detail string, and created/expires timestamps.connector.go— registernewServiceTokenBuilder.go.mod— bumpbaton-sdkv0.3.35 → v0.11.0 (D-345). Thegodirective moves 1.23.4 → 1.25.2 (required by the SDK), and the vendored tree updates accordingly (large delta — the cost of the version jump). The existing syncers compile unchanged against v0.11.0 (V1ResourceSyncerinterface is still supported);go mod vendorcommitted.Verification
go build ./...✅ ·go vet ./pkg/connector/...✅ ·go test ./pkg/connector/...✅ ·gofmt -lclean ·go mod verify✅.golangci.ymlis golangci-lint v1 format and the env ships v2.9.0, so the repo-configured lint can't run locally (pre-existing). Ran a default-config pass (gosec/unused/staticcheck/errcheck) on the new files — clean (gosec G101 on the detail-string const is a false positive, suppressed with an explained//nolint:gosec).Ready for review — do not merge.