@rubytech/create-sitedesk-code 0.1.401 → 0.1.402

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-sitedesk-code",
-  "version": "0.1.401",
+  "version": "0.1.402",
   "description": "Install SiteDesk — automated back office for independent building contractors",
   "bin": {
     "create-sitedesk-code": "./dist/index.js"

package/payload/platform/plugins/cloudflare/bin/__tests__/cf-token.test.sh

@@ -48,7 +48,7 @@ echo "\$@" >> "\$SB/curl.log"
 url=""; for a in "\$@"; do case "\$a" in https://*) url="\$a";; esac; done
 case "\$url" in
   *"/tokens/permission_groups"*)
-    echo '{"success":true,"result":[{"id":"pg_pages","name":"Cloudflare Pages Write"},{"id":"pg_d1","name":"D1 Write"},{"id":"pg_dns","name":"DNS Write"},{"id":"pg_acc1","name":"Access: Apps and Policies Write"},{"id":"pg_acc2","name":"Access: Apps and Policies Write"}]}'
+    echo '{"success":true,"result":[{"id":"pg_pages","name":"Pages Write"},{"id":"pg_d1","name":"D1 Write"},{"id":"pg_dns","name":"DNS Write"},{"id":"pg_acc1","name":"Access: Apps and Policies Write"},{"id":"pg_acc2","name":"Access: Apps and Policies Write"}]}'
     ;;
   *"/tokens/verify"*) echo '{"success":true,"result":{"status":"active"}}';;
   *"/tokens"*)        echo '{"success":true,"result":{"id":"tok1","value":"'"$SECRET_VALUE"'"}}';;
@@ -191,5 +191,100 @@ echo "$ERR" | grep -q "code=1001" && ok "failure code surfaced" || bad "code not
 no_leak "real failure"
 teardown
 
+# 9. pages exact-name: three custom-pages decoys ordered BEFORE the real group.
+#    The old fuzzy /pages.*(write|edit)/ + head -1 picks "Access: Custom Pages Write";
+#    exact-name must mint the real Pages Write + D1 Write ids and none of the decoys.
+setup "cfat_master_abc"
+cat > "$BIN/curl" <<'CURL'
+#!/usr/bin/env bash
+SB="$(cd "$(dirname "$0")/.." && pwd)"
+echo "$@" >> "$SB/curl.log"
+url=""; for a in "$@"; do case "$a" in https://*) url="$a";; esac; done
+case "$url" in
+  *"/permission_groups"*) echo '{"success":true,"result":[{"id":"pg_x1","name":"Access: Custom Pages Write"},{"id":"pg_x2","name":"Account Custom Pages Write"},{"id":"pg_x3","name":"Custom Pages Write"},{"id":"pg_pages_real","name":"Pages Write"},{"id":"pg_d1_real","name":"D1 Write"}]}';;
+  *"/tokens/verify"*) echo '{"success":true,"result":{"status":"active"}}';;
+  *"/tokens"*) echo '{"success":true,"result":{"value":"cfat_minted_SECRET_do_not_leak_0123456789"}}';;
+  *) echo '{"success":false,"errors":[{"code":9999}]}';;
+esac
+CURL
+chmod +x "$BIN/curl"
+run "pages exact-name skips custom-pages decoys" pages 0
+POSTLINE=$(grep -- "-X POST" "$SANDBOX/curl.log")
+echo "$POSTLINE" | grep -q "pg_pages_real" && ok "minted real Pages Write id" || bad "did not mint real pages id: $POSTLINE"
+echo "$POSTLINE" | grep -q "pg_d1_real" && ok "minted real D1 Write id" || bad "did not mint real d1 id"
+echo "$POSTLINE" | grep -qE "pg_x1|pg_x2|pg_x3" && bad "minted a custom-pages decoy id: $POSTLINE" || ok "no custom-pages decoy id minted"
+no_leak "pages exact-name"
+teardown
+
+# 10. dns exact-name on cfat_: skip the "Account DNS Settings Write" / "DNS Firewall
+#     Write" decoys, mint the real "DNS Write" id, AND nest the zone resource under
+#     the account resource (account-owned masters reject the flat zone.* with 1001).
+setup "cfat_master_abc"
+cat > "$BIN/curl" <<'CURL'
+#!/usr/bin/env bash
+SB="$(cd "$(dirname "$0")/.." && pwd)"
+echo "$@" >> "$SB/curl.log"
+url=""; for a in "$@"; do case "$a" in https://*) url="$a";; esac; done
+case "$url" in
+  *"/permission_groups"*) echo '{"success":true,"result":[{"id":"pg_dnsx1","name":"Account DNS Settings Write"},{"id":"pg_dnsx2","name":"DNS Firewall Write"},{"id":"pg_dns_real","name":"DNS Write"}]}';;
+  *"/tokens/verify"*) echo '{"success":true,"result":{"status":"active"}}';;
+  *"/tokens"*) echo '{"success":true,"result":{"value":"cfat_minted_SECRET_do_not_leak_0123456789"}}';;
+  *) echo '{"success":false,"errors":[{"code":9999}]}';;
+esac
+CURL
+chmod +x "$BIN/curl"
+run "dns exact-name cfat nests zone under account" dns 0
+POSTLINE=$(grep -- "-X POST" "$SANDBOX/curl.log")
+echo "$POSTLINE" | grep -q "pg_dns_real" && ok "minted real DNS Write id" || bad "did not mint real dns id: $POSTLINE"
+echo "$POSTLINE" | grep -qE "pg_dnsx1|pg_dnsx2" && bad "minted a dns decoy id: $POSTLINE" || ok "no dns decoy id minted"
+echo "$POSTLINE" | grep -qF '"resources":{"com.cloudflare.api.account.acc123":{"com.cloudflare.api.account.zone.*":"*"}}' && ok "cfat nests zone under account" || bad "zone resource not nested for cfat: $POSTLINE"
+no_leak "dns cfat nested"
+teardown
+
+# 11. dns exact-name on cfut_: the flat top-level zone resource is preserved, with
+#     no account nesting (user-owned masters accept the flat zone.* shape).
+setup "cfut_master_xyz"
+cat > "$BIN/curl" <<'CURL'
+#!/usr/bin/env bash
+SB="$(cd "$(dirname "$0")/.." && pwd)"
+echo "$@" >> "$SB/curl.log"
+url=""; for a in "$@"; do case "$a" in https://*) url="$a";; esac; done
+case "$url" in
+  *"/permission_groups"*) echo '{"success":true,"result":[{"id":"pg_dns_real","name":"DNS Write"}]}';;
+  *"/tokens/verify"*) echo '{"success":true,"result":{"status":"active"}}';;
+  *"/tokens"*) echo '{"success":true,"result":{"value":"cfut_minted_SECRET_do_not_leak_0123456789"}}';;
+  *) echo '{"success":false,"errors":[{"code":9999}]}';;
+esac
+CURL
+chmod +x "$BIN/curl"
+run "dns cfut keeps flat zone resource" dns 0
+POSTLINE=$(grep -- "-X POST" "$SANDBOX/curl.log")
+echo "$POSTLINE" | grep -qF '"resources":{"com.cloudflare.api.account.zone.*":"*"}' && ok "cfut flat zone resource" || bad "cfut resource not flat: $POSTLINE"
+echo "$POSTLINE" | grep -qF 'account.acc123":{' && bad "cfut wrongly nested under account: $POSTLINE" || ok "cfut not nested under account"
+no_leak "dns cfut flat"
+teardown
+
+# 12. a Cloudflare group rename surfaces as a NAMED miss, not a silent wrong-group
+#     mint: with only decoys present and no exact "DNS Write", the helper dies 1 and
+#     names the exact group it looked for.
+setup "cfat_master_abc"
+cat > "$BIN/curl" <<'CURL'
+#!/usr/bin/env bash
+SB="$(cd "$(dirname "$0")/.." && pwd)"
+echo "$@" >> "$SB/curl.log"
+url=""; for a in "$@"; do case "$a" in https://*) url="$a";; esac; done
+case "$url" in
+  *"/permission_groups"*) echo '{"success":true,"result":[{"id":"pg_dnsx1","name":"Account DNS Settings Write"},{"id":"pg_dnsx2","name":"DNS Firewall Write"}]}';;
+  *"/tokens/verify"*) echo '{"success":true,"result":{"status":"active"}}';;
+  *"/tokens"*) echo '{"success":true,"result":{"value":"cfat_minted_SECRET_do_not_leak_0123456789"}}';;
+  *) echo '{"success":false,"errors":[{"code":9999}]}';;
+esac
+CURL
+chmod +x "$BIN/curl"
+run "missing exact group fails closed" dns 1
+grep -q -- "-X POST" "$SANDBOX/curl.log" && bad "minted despite no exact group match" || ok "no mint on missing exact group"
+echo "$ERR" | grep -qF "no permission group named 'DNS Write'" && ok "die names the missing exact group" || bad "die message not named: $ERR"
+teardown
+
 echo "----"; echo "PASS=$PASS FAIL=$FAIL"
 [ "$FAIL" -eq 0 ]

package/payload/platform/plugins/cloudflare/bin/cf-token.sh

@@ -41,13 +41,17 @@ fi
 [ -n "$brand" ] || die "cannot derive brand from path; set CF_TOKEN_BRAND"
 
 # Scope table - resolved by case, never inferred.
-legacy=""
+# pages/d1/dns select their permission group by EXACT name (a broad substring once
+# picked "Access: Custom Pages Write" over "Pages Write"); access keeps a regex
+# because it legitimately enumerates duplicate-named candidates and functional-probes.
+legacy=""; names=""; regexes=""; zone_scoped=""
 case "$scope" in
   pages|d1) suffix="pages-d1"; key="CF_PAGES_D1_TOKEN"; legacy="CF_PAGES_TOKEN"
-            # per-group regexes separated by ';' (each may use '|' internally)
-            regexes="pages.*(write|edit);d1.*(write|edit)"; res='{"com.cloudflare.api.account.'"$ACC"'":"*"}';;
+            # exact permission-group names separated by ';'
+            names="Pages Write;D1 Write"; res='{"com.cloudflare.api.account.'"$ACC"'":"*"}';;
   dns)      suffix="dns"; key="CF_DNS_TOKEN"
-            regexes="dns.*(write|edit)"; res='{"com.cloudflare.api.account.zone.*":"*"}';;
+            # zone-scoped: res is set after the master-prefix routing (nesting differs)
+            names="DNS Write"; zone_scoped=1;;
   access)   suffix="access"; key="CF_ACCESS_TOKEN"
             regexes="access.*apps.*polic.*(write|edit)"; res='{"com.cloudflare.api.account.'"$ACC"'":"*"}';;
 esac
@@ -74,9 +78,20 @@ case "$CLOUDFLARE_API_TOKEN" in
      die "unrecognised master token prefix (not cfat_/cfut_); refusing to guess an endpoint";;
 esac
 
+# Zone-scoped resource shape branches by master type. An account-owned (cfat_) master
+# rejects a flat zone.* resource with code 1001 "Must specify a zone for account owned
+# tokens, or nest zone under specific account resource"; nest it under the account.
+# A user-owned (cfut_) master accepts the flat zone.* shape.
+if [ -n "$zone_scoped" ]; then
+  case "$mtag" in
+    cfat) res='{"com.cloudflare.api.account.'"$ACC"'":{"com.cloudflare.api.account.zone.*":"*"}}';;
+    cfut) res='{"com.cloudflare.api.account.zone.*":"*"}';;
+  esac
+fi
+
 api_get() { curl -sS -H "Authorization: Bearer ${CLOUDFLARE_API_TOKEN}" "$1"; }
 
-# Resolve permission-group id(s) by name regex (case-insensitive).
+# Resolve permission-group id(s): access matches by regex, pages/d1/dns by exact name.
 pg_json="$(api_get "${base}/tokens/permission_groups")"
 echo "$pg_json" | jq -e '.success==true' >/dev/null 2>&1 || {
   code=$(echo "$pg_json" | jq -r '.errors[0].code // "?"')
@@ -85,6 +100,7 @@ echo "$pg_json" | jq -e '.success==true' >/dev/null 2>&1 || {
 }
 
 collect_ids() { echo "$pg_json" | jq -r --arg re "$1" '.result[] | select(.name|test($re;"i")) | .id'; }
+collect_exact() { echo "$pg_json" | jq -r --arg n "$1" '.result[] | select(.name==$n) | .id'; }
 
 mint_with() { # $1 = json permission_groups array -> echoes minted token value or empty
   local body
@@ -136,12 +152,12 @@ if [ "$scope" = "access" ]; then
 else
   pg_array='[]'
   OLDIFS=$IFS; IFS=';'
-  for rx in $regexes; do
-    id=$(collect_ids "$rx" | head -1)
+  for nm in $names; do
+    id=$(collect_exact "$nm" | head -1)
     [ -n "$id" ] || {
       IFS=$OLDIFS
       echo "[cf-token] op=resolve scope=${scope} master=${mtag} action=mint result=error code=0" >&2
-      die "no permission group matched /${rx}/"; }
+      die "no permission group named '${nm}'"; }
     pg_array=$(echo "$pg_array" | jq -c --arg id "$id" '. + [{id:$id}]')
   done
   IFS=$OLDIFS

package/payload/platform/plugins/cloudflare/references/api.md

@@ -112,6 +112,8 @@ The master an operator provisions is usually **account-scoped** (`cfat_…`, cre
 
 Cross-type calls fail with a stable, recognizable signal: a `cfat_…` token at `/user/tokens/verify` returns `Invalid API Token`; a `cfut_…` token at any `/accounts/{id}/…` endpoint returns `9109`. The diagnostic is the verify call's JSON `errors[].code`.
 
+The prefix also governs the **resource shape** of a zone-scoped mint body, not just the endpoint. A `cfut_…` master accepts a flat zone resource — `"resources": { "com.cloudflare.api.account.zone.*": "*" }`. A `cfat_…` (account-owned) master **rejects** that flat shape with code `1001` ("Must specify a zone for account owned tokens, or nest zone under specific account resource"); it requires the zone resource nested under the account resource — `"resources": { "com.cloudflare.api.account.${ACC}": { "com.cloudflare.api.account.zone.*": "*" } }`. Non-zone scopes (Pages/D1/Access) already scope to `com.cloudflare.api.account.${ACC}` and need no branch.
+
 **Creating** a token stays an account-level, operator-owned concern — each account documents its own master token and its type (e.g. a per-account `secrets/cloudflare.README.md`). Where an account *can* mint an account-scoped token that is the cleaner default; but a skill that merely *consumes* a supplied token must detect the prefix and adapt, never assume it can mint at `/accounts/…`.
 
 ---
@@ -154,7 +156,7 @@ CLOUDFLARE_API_TOKEN="${PAGES_D1}" wrangler pages deploy ./dist --project-name <
 
 No `expires_on`: the per-scope token is permanent and reused, so decay is the job of the **reconcile pass** (§ Reconcile), not a per-token TTL — the old short-TTL guidance was never honored in practice and produced only never-expiring strays. Look up `<pages-edit-permission-group-id>` (and the ids for DNS Edit, D1 Edit, etc.) once via `GET /accounts/{account_id}/tokens/permission_groups`; they are stable per account. Before reusing or before reconciling, `GET …/tokens` (§ Curated endpoint map) shows what already exists, so a scope is never minted twice under different names.
 
-**Per-scope token resources.** Each reused per-scope token carries the resource that matches its operation class. The Pages-and-D1 token (`<brand>-pages-d1`) and the Access token (`<brand>-access`) are account-scoped: `"resources": { "com.cloudflare.api.account.${CLOUDFLARE_ACCOUNT_ID}": "*" }`. The DNS token (`<brand>-dns`) is zone-scoped, but since it is a single stable token reused across every zone the install routes, its resource covers the account's zones: `"resources": { "com.cloudflare.api.account.zone.*": "*" }`. A per-zone DNS token would defeat the one-stable-token-per-scope model (one token, reused, not one per zone); the minted token is still strictly narrower than the master, which already carries Zone DNS Edit over the zones in scope.
+**Per-scope token resources.** Each reused per-scope token carries the resource that matches its operation class. The Pages-and-D1 token (`<brand>-pages-d1`) and the Access token (`<brand>-access`) are account-scoped: `"resources": { "com.cloudflare.api.account.${CLOUDFLARE_ACCOUNT_ID}": "*" }`. The DNS token (`<brand>-dns`) is zone-scoped, and since it is a single stable token reused across every zone the install routes, its resource covers the account's zones — but the exact shape depends on the master's prefix (see § Token type — route endpoints by prefix): a `cfut_…` master takes the flat `"resources": { "com.cloudflare.api.account.zone.*": "*" }`, while a `cfat_…` master requires the zone nested under the account, `"resources": { "com.cloudflare.api.account.${CLOUDFLARE_ACCOUNT_ID}": { "com.cloudflare.api.account.zone.*": "*" } }` (the flat shape returns `1001` on an account-owned master). A per-zone DNS token would defeat the one-stable-token-per-scope model (one token, reused, not one per zone); the minted token is still strictly narrower than the master, which already carries Zone DNS Edit over the zones in scope.
 
 **Redaction is binding.** Every example above pipes the token into a variable or an `Authorization` header and never to stdout. The agent surfaces the operation as verb + target — "minting a Pages-deploy token", "creating CNAME `chat.example.com`" — never the secret. A failure surfaces the API error body with any `Authorization` value masked.