add Verify method for Cloudflare to prevent full resource fetch (#741)

* add Verify method for Cloudflare to prevent full resource fetch

Author: mkrs2404

pkg/providers/cloudflare/cloudflare.go

@@ -2,6 +2,7 @@ package cloudflare
 
 import (
 	"context"
+	"fmt"
 	"strings"
 
 	"github.com/cloudflare/cloudflare-go"
@@ -97,6 +98,34 @@ func (p *Provider) Services() []string {
 	return p.services.Keys()
 }
 
+// Verify checks if the provider credentials are valid using minimal API calls.
+func (p *Provider) Verify(ctx context.Context) error {
+	if !p.services.Has("dns") {
+		return nil
+	}
+
+	zones, err := p.client.ListZones(ctx)
+	if err != nil {
+		return fmt.Errorf("failed to verify Cloudflare zone access: %w", err)
+	}
+
+	if len(zones) == 0 {
+		return fmt.Errorf("no accessible Cloudflare zones found with provided credentials")
+	}
+
+	_, _, err = p.client.ListDNSRecords(ctx, cloudflare.ZoneIdentifier(zones[0].ID), cloudflare.ListDNSRecordsParams{
+		ResultInfo: cloudflare.ResultInfo{
+			Page:    1,
+			PerPage: 1,
+		},
+	})
+	if err != nil {
+		return fmt.Errorf("failed to verify Cloudflare DNS access for zone %s: %w", zones[0].Name, err)
+	}
+
+	return nil
+}
+
 // Resources returns the provider for an resource deployment source.
 func (p *Provider) Resources(ctx context.Context) (*schema.Resources, error) {
 	finalResources := schema.NewResources()

pkg/providers/cloudflare/cloudflare_test.go

@@ -35,6 +35,28 @@ func (f *failingRecordsClient) ListDNSRecords(context.Context, *cloudflare.Resou
 	return nil, nil, f.err
 }
 
+type trackingClient struct {
+	zones            []cloudflare.Zone
+	listZonesCalls   int
+	listDNSCalls     int
+	lastZoneID       string
+	lastListDNSParam cloudflare.ListDNSRecordsParams
+}
+
+func (t *trackingClient) ListZones(context.Context, ...string) ([]cloudflare.Zone, error) {
+	t.listZonesCalls++
+	return t.zones, nil
+}
+
+func (t *trackingClient) ListDNSRecords(_ context.Context, zoneID *cloudflare.ResourceContainer, params cloudflare.ListDNSRecordsParams) ([]cloudflare.DNSRecord, *cloudflare.ResultInfo, error) {
+	t.listDNSCalls++
+	if zoneID != nil {
+		t.lastZoneID = zoneID.Identifier
+	}
+	t.lastListDNSParam = params
+	return nil, &cloudflare.ResultInfo{}, nil
+}
+
 func TestProviderResourcesPropagatesZoneError(t *testing.T) {
 	t.Parallel()
 
@@ -67,3 +89,91 @@ func TestProviderResourcesPropagatesRecordError(t *testing.T) {
 	require.Error(t, err)
 	require.Contains(t, err.Error(), "record fetch failed")
 }
+
+func TestProviderVerifyPropagatesZoneError(t *testing.T) {
+	t.Parallel()
+
+	p := &Provider{
+		id: "test",
+		client: &failingZonesClient{
+			err: errors.New("zones down"),
+		},
+		services: schema.ServiceMap{"dns": struct{}{}},
+	}
+
+	err := p.Verify(context.Background())
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "zones down")
+}
+
+func TestProviderVerifyReturnsErrorWhenNoZonesExist(t *testing.T) {
+	t.Parallel()
+
+	client := &trackingClient{}
+	p := &Provider{
+		id:       "test",
+		client:   client,
+		services: schema.ServiceMap{"dns": struct{}{}},
+	}
+
+	err := p.Verify(context.Background())
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "no accessible Cloudflare zones found")
+	require.Equal(t, 1, client.listZonesCalls)
+	require.Zero(t, client.listDNSCalls)
+}
+
+func TestProviderVerifySkipsWhenDNSServiceDisabled(t *testing.T) {
+	t.Parallel()
+
+	client := &trackingClient{}
+	p := &Provider{
+		id:       "test",
+		client:   client,
+		services: schema.ServiceMap{"workers": struct{}{}},
+	}
+
+	err := p.Verify(context.Background())
+	require.NoError(t, err)
+	require.Zero(t, client.listZonesCalls)
+	require.Zero(t, client.listDNSCalls)
+}
+
+func TestProviderVerifyUsesSingleRecordProbe(t *testing.T) {
+	t.Parallel()
+
+	client := &trackingClient{
+		zones: []cloudflare.Zone{{ID: "zone-id", Name: "example.com"}},
+	}
+	p := &Provider{
+		id:       "test",
+		client:   client,
+		services: schema.ServiceMap{"dns": struct{}{}},
+	}
+
+	err := p.Verify(context.Background())
+	require.NoError(t, err)
+	require.Equal(t, 1, client.listZonesCalls)
+	require.Equal(t, 1, client.listDNSCalls)
+	require.Equal(t, "zone-id", client.lastZoneID)
+	require.Equal(t, 1, client.lastListDNSParam.Page)
+	require.Equal(t, 1, client.lastListDNSParam.PerPage)
+}
+
+func TestProviderVerifyPropagatesRecordError(t *testing.T) {
+	t.Parallel()
+
+	p := &Provider{
+		id: "test",
+		client: &failingRecordsClient{
+			zones: []cloudflare.Zone{{ID: "zone-id", Name: "example.com"}},
+			err:   errors.New("record fetch failed"),
+		},
+		services: schema.ServiceMap{"dns": struct{}{}},
+	}
+
+	err := p.Verify(context.Background())
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "failed to verify Cloudflare DNS access")
+	require.Contains(t, err.Error(), "record fetch failed")
+}