Skip to content
Sarj Code Standards

prefer-configured-cloud-scope

Read Cloudflare account targets from validated deployment configuration.

SARJ566 Rule source Tests Catalog JSON

Why

A literal account in a management API request binds the caller to one deployment. Reusing the script in another environment can target the original account even when its credentials change.

Fix

Load the account ID into one shared Pydantic/Pydantic Settings object at startup and inject that same validated object into consumers. Fail before remote effects when required configuration is absent or invalid; preserve independent security allowlists and existing optional defaults, without a production account fallback. Reading an environment variable alone is not validation.

Examples

Before — flagged The outgoing API request is bound to a literal account
app/publish.py
import httpx


ACCOUNT = "0123456789abcdef0123456789abcdef"
httpx.get(f"https://api.cloudflare.com/client/v4/accounts/{ACCOUNT}/workers/scripts")
After — preferred Construct one Pydantic Settings object and inject it into both consumers
app/publish.py
from typing import Annotated
import httpx
from pydantic import Field
from pydantic_settings import BaseSettings




class Settings(BaseSettings):
    cloudflare_account_id: Annotated[
        str, Field(min_length=32, max_length=32, pattern=r"^[a-fA-F0-9]+$")
    ]




def publish(settings: Settings):
    return httpx.post(
        f"https://api.cloudflare.com/client/v4/accounts/{settings.cloudflare_account_id}/workers/scripts"
    )




def list_scripts(settings: Settings):
    return httpx.get(
        f"https://api.cloudflare.com/client/v4/accounts/{settings.cloudflare_account_id}/workers/scripts"
    )




settings = Settings()
publish(settings)
list_scripts(settings)