🤖 chore(tofu): Update cloudflare/cloudflare requirement from ~> 4.52 to ~> 5.26 in /infra/tofu

docs/STAGED_ROLLOUT_PLAN.md

@@ -107,9 +107,9 @@ pre-commit run --all-files
 ### Directory Structure (`infra/tofu/`)
 ```
 infra/tofu/
-├── versions.tf               # OpenTofu requirement (>= 1.6.0), cloudflare/cloudflare (~> 4.52), local backend
+├── versions.tf               # OpenTofu requirement (>= 1.6.0), cloudflare/cloudflare (~> 5.26), local backend
 ├── variables.tf              # Account ID, Zone ID, custom_domain (scbind.com), allowed_ips, allowed_emails
-├── main.tf                   # cloudflare_pages_project, cloudflare_pages_domain, cloudflare_record, zero trust app & policy
+├── main.tf                   # cloudflare_pages_project, cloudflare_pages_domain, cloudflare_dns_record, zero trust app & inline policy
 ├── outputs.tf                # Live URLs, DNS CNAME, Zero Trust AUD tag, and staged rollout status
 └── terraform.tfvars.example  # Git-tracked placeholder template
 ```

infra/tofu/main.tf

@@ -21,42 +21,71 @@ resource "cloudflare_pages_project" "app" {
   name              = var.project_name
   production_branch = var.production_branch
 
-  source {
+  source = {
     type = "github"
-    config {
-      owner                         = local.repo_owner
-      repo_name                     = local.repo_name
-      production_branch             = var.production_branch
-      pr_comments_enabled           = true
-      deployments_enabled           = true
-      production_deployment_enabled = true
-      preview_deployment_setting    = "all"
+    config = {
+      owner                          = local.repo_owner
+      repo_name                      = local.repo_name
+      production_branch              = var.production_branch
+      pr_comments_enabled            = true
+      production_deployments_enabled = true
+      preview_deployment_setting     = "all"
     }
   }
 
-  build_config {
+  build_config = {
     build_command   = var.build_command
     destination_dir = var.build_output_directory
     root_dir        = var.root_directory
   }
 
-  deployment_configs {
-    preview {
-      environment_variables = {
-        NODE_VERSION              = var.node_version
-        VITE_MONETIZATION_MODE    = "test"
-        VITE_SUPPORTER_URL        = var.supporter_url
-        VITE_AFFILIATE_AMAZON_TAG = var.affiliate_amazon_tag
+  deployment_configs = {
+    preview = {
+      env_vars = {
+        NODE_VERSION = {
+          type  = "plain_text"
+          value = var.node_version
+        }
+        VITE_MONETIZATION_MODE = {
+          type  = "plain_text"
+          value = "test"
+        }
+        VITE_SUPPORTER_URL = {
+          type  = "plain_text"
+          value = var.supporter_url
+        }
+        VITE_AFFILIATE_AMAZON_TAG = {
+          type  = "plain_text"
+          value = var.affiliate_amazon_tag
+        }
       }
     }
-    production {
-      environment_variables = {
-        NODE_VERSION              = var.node_version
-        VITE_MONETIZATION_MODE    = var.monetization_mode != "" ? var.monetization_mode : (var.enable_zero_trust ? "test" : "live")
-        VITE_SUPPORTER_URL        = var.supporter_url
-        VITE_AFFILIATE_AMAZON_TAG = var.affiliate_amazon_tag
-        VITE_ADSENSE_CLIENT_ID    = var.adsense_client_id
-        VITE_ADSENSE_SLOT_ID      = var.adsense_slot_id
+    production = {
+      env_vars = {
+        NODE_VERSION = {
+          type  = "plain_text"
+          value = var.node_version
+        }
+        VITE_MONETIZATION_MODE = {
+          type  = "plain_text"
+          value = var.monetization_mode != "" ? var.monetization_mode : (var.enable_zero_trust ? "test" : "live")
+        }
+        VITE_SUPPORTER_URL = {
+          type  = "plain_text"
+          value = var.supporter_url
+        }
+        VITE_AFFILIATE_AMAZON_TAG = {
+          type  = "plain_text"
+          value = var.affiliate_amazon_tag
+        }
+        VITE_ADSENSE_CLIENT_ID = {
+          type  = "plain_text"
+          value = var.adsense_client_id
+        }
+        VITE_ADSENSE_SLOT_ID = {
+          type  = "plain_text"
+          value = var.adsense_slot_id
+        }
       }
     }
   }
@@ -69,12 +98,12 @@ resource "cloudflare_pages_project" "app" {
 resource "cloudflare_pages_domain" "custom_domain" {
   account_id   = var.cloudflare_account_id
   project_name = cloudflare_pages_project.app.name
-  domain       = var.custom_domain
+  name         = var.custom_domain
 }
 
 # Configure proxied DNS CNAME record pointing custom_domain to <project>.pages.dev.
 # For apex domains (scbind.com), Cloudflare proxy automatically provides CNAME flattening.
-resource "cloudflare_record" "pages_cname" {
+resource "cloudflare_dns_record" "pages_cname" {
   zone_id = var.cloudflare_zone_id
   name    = var.custom_domain
   content = "${cloudflare_pages_project.app.name}.pages.dev"
@@ -89,52 +118,41 @@ resource "cloudflare_record" "pages_cname" {
   ]
 }
 
+
 # ==============================================================================
 # 3. Gated Access & Staged Rollout (Cloudflare Zero Trust)
 # ==============================================================================
 # Cloudflare Access Application protecting the custom domain.
 # When var.enable_zero_trust = false (Public Launch), this resource and its policy
 # are destroyed, allowing unrestricted public traffic.
-resource "cloudflare_zero_trust_access_application" "pages_app" {
-  count            = var.enable_zero_trust ? 1 : 0
-  account_id       = var.cloudflare_account_id
-  name             = "${var.project_name} Staged Access Gate"
-  domain           = var.custom_domain
-  type             = "self_hosted"
-  session_duration = var.session_duration
-}
-
+#
 # Staged Access Policy:
 # - Stage 2A: IP Whitelist — allows seamless access from your public IP / initial tester IPs.
 # - Stage 2B: Email Allowlist — permits invited friends to authenticate via Cloudflare Access
 #   One-Time PIN (OTP) without needing static IP addresses.
 #
-# Cloudflare Access combines multiple 'include' blocks using OR logic:
+# Cloudflare Access evaluates multiple 'include' entries using OR logic:
 # A visitor is granted access if their IP matches 'allowed_ips' OR they authenticate
 # with an email in 'allowed_emails'.
-resource "cloudflare_zero_trust_access_policy" "staged_access" {
-  count          = var.enable_zero_trust ? 1 : 0
-  account_id     = var.cloudflare_account_id
-  application_id = cloudflare_zero_trust_access_application.pages_app[0].id
-  name           = "${var.project_name} Staged Access Policy"
-  decision       = "allow"
-  precedence     = 1
-
-  # Stage 2A: IP Whitelist selector
-  dynamic "include" {
-    for_each = length(var.allowed_ips) > 0 ? [1] : []
-    content {
-      ip = var.allowed_ips
-    }
-  }
+resource "cloudflare_zero_trust_access_application" "pages_app" {
+  count            = var.enable_zero_trust ? 1 : 0
+  account_id       = var.cloudflare_account_id
+  name             = "${var.project_name} Staged Access Gate"
+  domain           = var.custom_domain
+  type             = "self_hosted"
+  session_duration = var.session_duration
 
-  # Stage 2B: Email OTP Allowlist selector
-  dynamic "include" {
-    for_each = length(var.allowed_emails) > 0 ? [1] : []
-    content {
-      email = var.allowed_emails
+  policies = [
+    {
+      name       = "${var.project_name} Staged Access Policy"
+      decision   = "allow"
+      precedence = 1
+      include = concat(
+        [for ip in var.allowed_ips : { ip = { ip = ip } }],
+        [for email in var.allowed_emails : { email = { email = email } }]
+      )
     }
-  }
+  ]
 
   lifecycle {
     precondition {

infra/tofu/outputs.tf

@@ -20,12 +20,12 @@ output "custom_domain_url" {
 
 output "dns_record_id" {
   description = "The ID of the proxied DNS CNAME record."
-  value       = cloudflare_record.pages_cname.id
+  value       = cloudflare_dns_record.pages_cname.id
 }
 
 output "dns_record_hostname" {
   description = "The fully-qualified hostname configured in DNS."
-  value       = cloudflare_record.pages_cname.hostname
+  value       = cloudflare_dns_record.pages_cname.name
 }
 
 output "zero_trust_enabled" {

infra/tofu/versions.tf

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     cloudflare = {
       source  = "cloudflare/cloudflare"
-      version = "~> 4.52"
+      version = "~> 5.26"
     }
   }