use API Token in favour of API Key for better security

lib/constants.js

@@ -2,7 +2,15 @@ import dotenv from "dotenv";
 
 dotenv.config();
 
-export const API_TOKEN = process.env.CLOUDFLARE_API_KEY;
+if (process.env.CLOUDFLARE_API_KEY) {
+  console.warn(
+    "Using Global API Key is very risky for your Cloudflare account. It is strongly recommended to create an API Token with scoped permissions instead."
+  );
+}
+
+export const API_KEY = process.env.CLOUDFLARE_API_KEY;
+
+export const API_TOKEN = process.env.CLOUDFLARE_API_TOKEN;
 
 export const ACCOUNT_ID = process.env.CLOUDFLARE_ACCOUNT_ID;
 
@@ -33,12 +41,11 @@ export const LIST_TYPE = {
 };
 
 export const USER_DEFINED_ALLOWLIST_URLS = process.env.ALLOWLIST_URLS
-  // .filter(x => x) removes empty items from the URL arrays
-  ? process.env.ALLOWLIST_URLS.split("\n").filter(x => x)
+  ? process.env.ALLOWLIST_URLS.split("\n").filter((x) => x)
   : undefined;
 
 export const USER_DEFINED_BLOCKLIST_URLS = process.env.BLOCKLIST_URLS
-  ? process.env.BLOCKLIST_URLS.split("\n").filter(x => x)
+  ? process.env.BLOCKLIST_URLS.split("\n").filter((x) => x)
   : undefined;
 
 export const RECOMMENDED_ALLOWLIST_URLS = [

lib/helpers.js

@@ -1,4 +1,10 @@
-import { ACCOUNT_EMAIL, ACCOUNT_ID, API_HOST, API_TOKEN } from "./constants.js";
+import {
+  ACCOUNT_EMAIL,
+  ACCOUNT_ID,
+  API_HOST,
+  API_KEY,
+  API_TOKEN,
+} from "./constants.js";
 
 if (!globalThis.fetch) {
   console.warn(
@@ -20,20 +26,30 @@ if (!globalThis.fetch) {
  * @returns {Promise}
  */
 const request = async (url, options) => {
-  if (!API_TOKEN || !ACCOUNT_ID || !ACCOUNT_EMAIL) {
+  if (!(API_TOKEN || API_KEY) || !ACCOUNT_ID) {
     throw new Error(
-      "One or more required secrets have not been added: CLOUDFLARE_API_KEY, CLOUDFLARE_ACCOUNT_ID, and CLOUDFLARE_ACCOUNT_EMAIL"
+      "The following secrets are required: CLOUDFLARE_API_TOKEN, CLOUDFLARE_ACCOUNT_ID"
     );
   }
 
+  const headers = API_TOKEN
+    ? {
+        Authorization: `Bearer ${API_TOKEN}`,
+        "Content-Type": "application/json",
+      }
+    : {
+        Authorization: `Bearer ${API_KEY}`,
+        "Content-Type": "application/json",
+        "X-Auth-Email": ACCOUNT_EMAIL,
+        "X-Auth-Key": API_KEY,
+      };
+
   const response = await fetch(url, {
-    headers: {
-      Authorization: `Bearer ${API_TOKEN}`,
-      "Content-Type": "application/json",
-      "X-Auth-Email": ACCOUNT_EMAIL,
-      "X-Auth-Key": API_TOKEN,
-    },
     ...options,
+    headers: {
+      ...options.headers,
+      ...headers,
+    },
   });
 
   if (!response.ok) {
@@ -42,8 +58,6 @@ const request = async (url, options) => {
 
   const data = await response.json();
 
-  console.log(`HTTP request succeeded: ${data.success}`);
-
   return data;
 };