Skip to content
Sarj Code Standards

prefer-configured-cloud-scope

Prefer validated deployment configuration for account scope in outgoing cloud management requests.

configuredScope Rule source Tests Catalog JSON

Why

A source-literal cloud account scope pins operational requests to one deployment even when the credential or environment changes.

Fix

Read the account ID through one shared settings object validated by a Zod schema at startup, then import or inject that parsed object into consumers. Required values must fail before remote effects. Preserve independent security allowlists; an environment read alone is not validation.

Examples

Before — flagged Move outgoing account scope into deployment configuration
.github/scripts/publish.mjs
const accountId = "0123456789abcdef0123456789abcdef";
const base = `https://api.cloudflare.com/client/v4/accounts/${accountId}`;
export async function publish(path, request = fetch) {
  return request(`${base}/${path}`);
}
After — preferred Parse one shared settings object with Zod before requests
.github/scripts/publish.mjs
import { settings } from "../../src/env.mjs";
const base = `https://api.cloudflare.com/client/v4/accounts/${settings.CLOUDFLARE_ACCOUNT_ID}`;
export async function publish(path, request = fetch) {
  return request(`${base}/${path}`);
}
export async function list(request = fetch) {
  return request(`${base}/workers/scripts`);
}
src/env.mjs
import { z } from "zod";
const SettingsSchema = z.object({
  CLOUDFLARE_ACCOUNT_ID: z
    .string()
    .length(32)
    .regex(/^[a-fA-F0-9]+$/u),
});
export const settings = SettingsSchema.parse(process.env);
Before — flagged A native URL wrapper still fixes the outgoing account in source
src/cloud-client.ts
export function list() {
  return fetch(
    new URL(
      "https://api.cloudflare.com/client/v4/accounts/0123456789abcdef0123456789abcdef/workers/scripts",
    ),
  );
}
After — preferred Supply the account from shared Zod-validated settings
src/cloud-client.ts
import { settings } from "./env.js";
export function list() {
  return fetch(
    new URL(
      `https://api.cloudflare.com/client/v4/accounts/${settings.CLOUDFLARE_ACCOUNT_ID}/workers/scripts`,
    ),
  );
}
src/env.ts
import { z } from "zod";
const SettingsSchema = z.object({
  CLOUDFLARE_ACCOUNT_ID: z
    .string()
    .length(32)
    .regex(/^[a-fA-F0-9]+$/u),
});
export const settings = SettingsSchema.parse(process.env);

References