Skip to content

bug: silent CF analytics auth-error blindness (operator believes they're protected) #25

Description

@mikeumus

Priority: HIGH — reliability/security.

A CF token missing Account Analytics:Read returns 10000 Authentication error, which cfGraphQLSafe swallows → the entire CF half reads empty and the operator believes they're protected. We were blind for an unknown period without noticing (only GCP worked).

Fixes:

  • Surface a prominent analyticsAuth: "FAILING" status on the health//spend endpoint instead of silently returning zeros.
  • Document the EXACT token scopes: Account Analytics:Read (monitoring) + Workers Scripts:Edit + Workers Routes:Edit (auto-disconnect).

From FEEDBACK-from-divinci-deployment.md — real-world findings from the Divinci self-hosted deployment, 2026-06-17.

Metadata

Metadata

Assignees

No one assigned

    Labels

    area:cloudflareCloudflare datasets / API integrationarea:securityAuth, fail-open, endpoint hardeningbugSomething isn't workingpriority:highCritical — outage risk or biggest coverage gap

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions