From 926acd8f86b0f60507e22145f84124eea75882f8 Mon Sep 17 00:00:00 2001 From: kert Date: Sun, 25 Oct 2026 14:57:50 -0400 Subject: [PATCH] fix(infra): bootstrap_sso --dns-only says which zone scope the token is missing Running it with the corwins.media-scoped token updated the tunnel (account scope) and then failed the DNS step with a bare 'Authentication error'; the record needs Zone:DNS:Edit on fhirworx.io specifically. refs #1139 --- dev/scripts/bootstrap_sso.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/dev/scripts/bootstrap_sso.py b/dev/scripts/bootstrap_sso.py index 03a505b..9654ed6 100644 --- a/dev/scripts/bootstrap_sso.py +++ b/dev/scripts/bootstrap_sso.py @@ -460,6 +460,13 @@ def _ensure_dns(client: httpx.Client) -> None: if not r.json().get("success"): err = r.json().get("errors", [{}])[0].get("message", "unknown") print(f" FAIL: DNS list — {err}") + if "Authentication" in err: + # The tunnel write above only needs Account:Cloudflare Tunnel:Edit; + # this one needs Zone:DNS:Edit *on the fhirworx.io zone*. A token + # scoped to another zone passes the first and fails here. + print( + f" hint: the token must include Zone:DNS:Edit for {DOMAIN} (zone {zone})" + ) return existing = {rec["name"] for rec in r.json()["result"]}