fix: provision temporary Cloudflare DNS token

Author: Villagers654

.github/workflows/email-provider-migration.yml

@@ -12,8 +12,10 @@ jobs:
     permissions:
       contents: read
     env:
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
       CLOUDFLARE_API_TOKEN_PROVISIONER: ${{ secrets.CLOUDFLARE_API_TOKEN_PROVISIONER }}
       CLOUDFLARE_R2_PROVISIONER: ${{ secrets.CLOUDFLARE_R2_PROVISIONER }}
+      CLOUDFLARE_API_TOKEN_OWNER: ${{ vars.CLOUDFLARE_API_TOKEN_OWNER }}
     steps:
       - name: Add authenticated Resend records
         shell: bash
@@ -23,8 +25,66 @@ jobs:
           api="https://api.cloudflare.com/client/v4"
           zone_id=""
           token=""
+          temporary_token_id=""
+          token_owner="${CLOUDFLARE_API_TOKEN_OWNER:-account}"
 
-          for candidate in "$CLOUDFLARE_API_TOKEN_PROVISIONER" "$CLOUDFLARE_R2_PROVISIONER"; do
+          if [[ "$token_owner" == "user" ]]; then
+            token_collection="/user/tokens"
+          else
+            token_collection="/accounts/$CLOUDFLARE_ACCOUNT_ID/tokens"
+          fi
+
+          revoke_temporary_token() {
+            if [[ -n "$temporary_token_id" ]]; then
+              curl --silent --show-error \
+                --request DELETE \
+                --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN_PROVISIONER" \
+                "$api$token_collection/$temporary_token_id" >/dev/null || true
+            fi
+          }
+          trap revoke_temporary_token EXIT
+
+          permission_groups=$(curl --fail-with-body --silent --show-error \
+            --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN_PROVISIONER" \
+            "$api$token_collection/permission_groups")
+          dns_write_id=$(jq -r '.result[] | select(.name == "DNS Write") | .id' <<<"$permission_groups" | head -1)
+          zone_read_id=$(jq -r '.result[] | select(.name == "Zone Read") | .id' <<<"$permission_groups" | head -1)
+
+          if [[ -z "$dns_write_id" || -z "$zone_read_id" ]]; then
+            echo "Cloudflare DNS permission groups were not available to the token provisioner." >&2
+            exit 1
+          fi
+
+          expires_on=$(date -u -d '+1 hour' '+%Y-%m-%dT%H:%M:%SZ')
+          token_payload=$(jq -n \
+            --arg dns_write_id "$dns_write_id" \
+            --arg zone_read_id "$zone_read_id" \
+            --arg expires_on "$expires_on" \
+            '{
+              name: "modtale Resend DNS migration",
+              expires_on: $expires_on,
+              policies: [{
+                effect: "allow",
+                resources: {"com.cloudflare.api.account.zone.*": "*"},
+                permission_groups: [{id: $dns_write_id}, {id: $zone_read_id}]
+              }]
+            }')
+          token_response=$(curl --fail-with-body --silent --show-error \
+            --request POST \
+            --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN_PROVISIONER" \
+            --header "Content-Type: application/json" \
+            --data "$token_payload" \
+            "$api$token_collection")
+          token=$(jq -r '.result.value // empty' <<<"$token_response")
+          temporary_token_id=$(jq -r '.result.id // empty' <<<"$token_response")
+
+          if [[ -z "$token" || -z "$temporary_token_id" ]]; then
+            echo "Cloudflare did not return the temporary DNS token." >&2
+            exit 1
+          fi
+          echo "::add-mask::$token"
+
+          for candidate in "$token" "$CLOUDFLARE_API_TOKEN_PROVISIONER" "$CLOUDFLARE_R2_PROVISIONER"; do
             if [[ -z "$candidate" ]]; then
               continue
             fi