feat: add Cloudflare Organization support - #52
Conversation
![c1-dev-bot[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
Add an optional --organization-id configuration parameter. When set, the connector syncs the Cloudflare organization as a group resource and creates membership grants linking users to the organization. This allows customers using Cloudflare's new Organizations feature to see which users belong to which organization, solving the problem of running separate connectors per account with no way to distinguish user-to-organization membership. Uses raw HTTP calls to the Cloudflare Organizations API (Public Beta) since the cloudflare-go v0 SDK does not expose these endpoints.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| for _, member := range resp.Result { | ||
| if member.Status != "active" { | ||
| continue | ||
| } | ||
| if member.User.ID == "" { | ||
| continue | ||
| } | ||
|
|
||
| userResourceId := &v2.ResourceId{ | ||
| ResourceType: resourceTypeUser.Id, | ||
| Resource: member.User.ID, | ||
| } | ||
|
|
||
| rv = append(rv, grant.NewGrant(resource, orgMemberEntitlement, userResourceId)) |
There was a problem hiding this comment.
🟡 Suggestion: A Cloudflare organization can span multiple accounts, so /organizations/{id}/members may return users who are not synced by this connector instance (which only syncs members of the single configured account-id). Those member grants will reference user resources that don't exist in this sync and become dangling. Consider whether this is intended (grants resolved cross-connector by C1) or whether org members should be reconciled against the synced user set. (Confidence: medium)
laurenleach
left a comment
laurenleach
left a comment
There was a problem hiding this comment.
This should update the default capabilities builder so that we include the org syncer for our generated capabilities
example: https://github.com/ConductorOne/baton-aws/blob/main/pkg/connector/connector.go#L474-L499
1 participant
Summary
Adds support for Cloudflare's new Organizations feature. When an optional
--organization-idparameter is provided, the connector syncs the organization as a group resource and creates membership grants linking users to the organization.This solves the problem where users running separate connectors per Cloudflare account have no way to distinguish which users belong to which organization, and built-in roles appear duplicated across accounts.
Fixes: CXH-1988
Changes
--organization-idfield to both authentication groups (API Token and API Key + Email)organizationresource withTRAIT_GROUPtraitorganization.go): Uses raw HTTP calls to the Cloudflare Organizations API (Public Beta) since thecloudflare-gov0 SDK does not expose these endpointsList()fetches the organization details viaGET /organizations/{id}Entitlements()exposes a "member" entitlement per organizationGrants()lists organization members viaGET /organizations/{id}/memberswith paginationorganization-idis configuredNotes
api_token.goandinvitation.gofor SDK-unsupported endpoints--organization-idparameter is fully optional — existing deployments without it continue to work unchangedTest plan
go build ./cmd/baton-cloudflare/succeedsgo test ./...passesAutomated PR Notice
This PR was automatically created by c1-dev-bot as a potential implementation.
This code requires: