Wrong endpoint in access manager

[x3lq]

Version 3.0.5

When running dockflare I permanently receive errors in my logs of failed API requests, the endpoint always turns out to be /client/v4/user.
After investigating the error I found that it seems to be th access_manager.py that calls a different endpoint than all of the other API calls.

Appended logs:

dockflare | 11:17:09 [INFO] Fetching Cloudflare account email from API. dockflare | 11:17:09 [INFO] CF API Request: GET https://api.cloudflare.com/client/v4/user Params: None dockflare | DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): api.cloudflare.com:443 dockflare | 11:17:09 [DEBUG] Starting new HTTPS connection (1): api.cloudflare.com:443 dockflare | 11:17:10 [DEBUG] https://api.cloudflare.com:443 "GET /client/v4/user HTTP/1.1" 403 None dockflare | DEBUG:urllib3.connectionpool:https://api.cloudflare.com:443 "GET /client/v4/user HTTP/1.1" 403 None dockflare | 11:17:10 [ERROR] CF API Error Response Body: {'success': False, 'errors': [{'code': 9109, 'message': 'Valid user-level authentication not found'}], 'messages': [], 'result': None} dockflare | ERROR:root:CF API Error Response Body: {'success': False, 'errors': [{'code': 9109, 'message': 'Valid user-level authentication not found'}], 'messages': [], 'result': None} dockflare | ERROR:root:CF API Request Failed: GET https://api.cloudflare.com/client/v4/user. Original Exception: 403 Client Error: Forbidden for url: https://api.cloudflare.com/client/v4/user - API Details: Valid user-level authentication not found dockflare | ERROR:root:API error fetching Cloudflare account email: 403 Client Error: Forbidden for url: https://api.cloudflare.com/client/v4/user dockflare | 11:17:10 [ERROR] CF API Request Failed: GET https://api.cloudflare.com/client/v4/user. Original Exception: 403 Client Error: Forbidden for url: https://api.cloudflare.com/client/v4/user - API Details: Valid user-level authentication not found dockflare | 11:17:10 [ERROR] API error fetching Cloudflare account email: 403 Client Error: Forbidden for url: https://api.cloudflare.com/client/v4/user

Fix would be to adapt the access_manager.py to call the correct endpoint and read the email address.
I couldn't quite wrap my head around why there are two different API calls for email and how API calls are structured thus I did not make a pull request.

I assume this error should be experienced by everyone.

I fixed it by using the following code:

`def get_cloudflare_account_email():
global _cached_account_email, _cached_account_email_timestamp

current_time = time.time()
if _cached_account_email and (current_time - _cached_account_email_timestamp < _ACCOUNT_EMAIL_CACHE_TTL):
    logging.debug(f"Returning cached Cloudflare account email: {_cached_account_email}")
    return _cached_account_email

logging.info("Fetching Cloudflare account email from API.")
try:
    account_id = current_app.config.get('CF_ACCOUNT_ID')

    response_data = cloudflare_api.cf_api_request("GET", f"/accounts/{account_id}/members")  #Changing endpoint
    print(response_data)
    if response_data and response_data.get("success"):
        email = response_data.get("result", {})[0].get("email")     #Fixing email retrival 
        if email:
            logging.info(f"Successfully fetched Cloudflare account email: {email}")
            _cached_account_email = email
            _cached_account_email_timestamp = current_time
            return email
        else:
            logging.warning("Cloudflare account email not found in API response.")
            return None
    else:
        logging.warning(f"Failed to fetch Cloudflare account email, API call unsuccessful. Response: {response_data}")
        return None
except requests.exceptions.RequestException as e:
    logging.error(f"API error fetching Cloudflare account email: {e}")
    return None
except Exception as e:
    logging.error(f"Unexpected error fetching Cloudflare account email: {e}", exc_info=True)
    return None`

Whats your opinion on this ?

[ChrispyBacon-dev]

Hi,

before I go into the codebase, can you please share your CF API permissions?