AI_Assistant/pcbjam
Watch
1
0
Fork
You've already forked pcbjam
 0
Code Issues Pull requests Projects Releases 4 Packages Wiki Activity Actions 2

fix(deploy/site): make the Pages steps work with wrangler login alone

Browse source 
`wrangler login` yields an OAuth token that wrangler uses itself but that
cannot be replayed as a REST bearer token, and it only carries zone:read.
03 and 06 were reaching for the REST API for things wrangler can answer,
so they died on a missing CLOUDFLARE_API_TOKEN even though every Pages
operation they needed was already authorised.

03 now reads `pages project list --json` for existence and the Git
provider, and proves the production branch EMPIRICALLY from
`pages deployment list --environment production` — if a deployment on
that branch is labelled Production, the setting must be right. That is a
stronger check than reading the field, which the REST endpoint would have
given us. 06 resolves the production deployment the same way.

cf_have_token() marks the boundary, and cf_token() now explains why a
login is not sufficient for the DNS/ruleset/HSTS phases of 07.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LAmkjM7okPdScp9XLW1JVr
This commit is contained in:
Viktor Vaczi 2026-07-27 14:03:30 +02:00
commit 04ce88f8a4
3 changed files with 60 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

11
deploy/site/lib/cf-api.sh
View file

@ -10,8 +10,17 @@
CF_API="https://api.cloudflare.com/client/v4"
# True when a REST token is available. `wrangler login` gives an OAuth token that
# wrangler itself uses but that cannot be replayed as a REST bearer token, and its
# zone scope is read-only — so the DNS/ruleset/HSTS steps need a real API token
# while the Pages steps are happy with either. Scripts branch on this.
cf_have_token() { [ -n "${CLOUDFLARE_API_TOKEN:-}" ] && [ -n "${CLOUDFLARE_ACCOUNT_ID:-}" ]; }
cf_token() {
[ -n "${CLOUDFLARE_API_TOKEN:-}" ] || die "CLOUDFLARE_API_TOKEN is not set"
[ -n "${CLOUDFLARE_API_TOKEN:-}" ] || die "CLOUDFLARE_API_TOKEN is not set.
\`wrangler login\` is not enough for this step: its OAuth token cannot be used
as a REST bearer token, and it only carries zone:read. Create an API token with
the scopes at the top of this file and export it (plus CLOUDFLARE_ACCOUNT_ID)."
printf '%s' "$CLOUDFLARE_API_TOKEN"
}
cf_account() {