`void platform install --app-access public` fails when Cloudflare reports Access is disabled

Open Beginner friendly
  • Is something wrong?
#835 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
typescript
Domain
authentication, cli

Research direction

Start in packages/void/src/cli/platform-app-access.ts at lines 175-241, where the installer checks Default-Deny through GET /accounts/{account_id}/access/organizations and sends 403s into the App Access token flow. Follow how --app-access public and --no-access-protection reach that check, then treat Cloudflare's access.api.error.not_enabled response as public setup while other 403s keep the existing path. Update the CLI tests covering Access disabled. Done when the reproduction finishes without a token prompt and other auth failures still prompt.

Written by the indexing model from the issue text.

Description

Affected version
Void CLI 1.9.1

Steps to reproduce

  1. Start a fresh install in a Cloudflare account where Access is disabled. Set CLOUDFLARE_API_TOKEN to an installer token with the usual install permissions and account-level Access: Organizations, Identity Providers, and Groups Read. Leave VOID_PLATFORM_APP_ACCESS_TOKEN and appAccess.tokenEnv unset.

  2. Use a platform login method that does not rely on Cloudflare Access. Run the following in a non-interactive shell with the rest of your installation settings. --no-access-protection disables Access protection for the platform itself, so the reproduction reaches the separate check for deployed apps.

    void platform install --app-access public --no-access-protection --yes
Actual behavior

The install stops while checking whether the account enforces Access Default-Deny.

platform: App access requires VOID_PLATFORM_APP_ACCESS_TOKEN or appAccess.tokenEnv in --auth-config, scoped to the hosting account.

A separate request to GET /accounts/{account_id}/access/organizations with the account-level read permission returned HTTP 403 with access.api.error.not_enabled: Access is not enabled. The 1.9.1 installer sends that response through the same credential flow as other 403 responses. In an interactive install, that flow prompts for an App Access API token. Void CLI 1.9.1 source

Expected behavior

When --app-access public is selected and Cloudflare explicitly reports that Access is disabled, the installer should continue with public app setup without requesting a separate App Access token or creating Access policies. Other authorization failures and accounts with Default-Deny enabled should continue through the existing checks.

Dominant language
TypeScript
Stars
684
Forks
83
Avg merge
15h 22m
Merged PRs (30d)
219

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from voidzero-dev/void

All issues in voidzero-dev/void

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.