feat(cloudflare): add access helpers and scoped retry controls

- Add Scope and AccessService helpers for account and zone Access endpoints
- Add request-level retry controls for unsafe methods via explicit opt-in
- Add zone pagination handling and use per_page=1 for zone lookup requests
- Expand lint config and add tests for Access flows and transport retries

Improves Cloudflare client safety by making non-idempotent retries explicit.
Adds first-class Access API workflows with account and zone scoping.

Author: d-padmanabhan

.golangci.yaml

@@ -1,17 +1,76 @@
----
 version: "2"
-
 run:
   timeout: 5m
-
+  concurrency: 4
 linters:
   enable:
+    - asciicheck
+    - asasalint
+    - bidichk
+    - bodyclose
+    - contextcheck
+    - copyloopvar
+    - durationcheck
     - errcheck
+    - errchkjson
+    - errorlint
+    - exhaustive
     - govet
+    - gocheckcompilerdirectives
+    - gochecksumtype
+    - gosec
+    - gosmopolitan
     - ineffassign
+    - loggercheck
+    - makezero
+    - musttag
+    - nilerr
+    - nilnesserr
+    - noctx
+    - protogetter
+    - reassign
+    - recvcheck
+    - revive
+    - rowserrcheck
+    - spancheck
     - staticcheck
+    - sqlclosecheck
+    - testifylint
+    - unparam
     - unused
-
+    - zerologlint
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    rules:
+      - path: (.+)\.go$
+        text: should not use dot imports
+    paths:
+      - .github
+      - third_party$
+      - builtin$
+      - examples$
+  settings:
+    revive:
+      confidence: 0.1
+    staticcheck:
+      checks:
+        - all
+        - '-QF1008'
+formatters:
+  enable:
+    - gofmt
+  exclusions:
+    generated: lax
+    paths:
+      - .github
+      - third_party$
+      - builtin$
+      - examples$
 issues:
   max-issues-per-linter: 0
   max-same-issues: 0

cloudflare/access.go

@@ -0,0 +1,138 @@
+package cloudflare
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+)
+
+// AccessService provides Cloudflare Access and Zero Trust API operations.
+type AccessService struct {
+	client *Client
+}
+
+// Access returns the Access service API.
+func (c *Client) Access() *AccessService {
+	return &AccessService{client: c}
+}
+
+// Do performs a scoped Access API request.
+func (a *AccessService) Do(
+	ctx context.Context,
+	scope Scope,
+	method string,
+	endpoint string,
+	params url.Values,
+	requestBody any,
+	out any,
+	reqOpts ...RequestOption,
+) error {
+	prefix, err := scope.PathPrefix()
+	if err != nil {
+		return err
+	}
+
+	cleanEndpoint := strings.TrimPrefix(strings.TrimSpace(endpoint), "/")
+	if cleanEndpoint == "" {
+		return errors.New("access endpoint must not be empty")
+	}
+
+	return a.client.DoWithOptions(
+		ctx,
+		method,
+		fmt.Sprintf("/%s/%s", prefix, cleanEndpoint),
+		params,
+		requestBody,
+		out,
+		reqOpts...,
+	)
+}
+
+// CreateIdentityProvider creates an Access identity provider (login method).
+func (a *AccessService) CreateIdentityProvider(
+	ctx context.Context,
+	accountID string,
+	requestBody any,
+	out any,
+	reqOpts ...RequestOption,
+) error {
+	return a.Do(
+		ctx,
+		AccountScope(accountID),
+		http.MethodPost,
+		"/access/identity_providers",
+		nil,
+		requestBody,
+		out,
+		reqOpts...,
+	)
+}
+
+// CreateApplication creates an Access application at account or zone scope.
+func (a *AccessService) CreateApplication(
+	ctx context.Context,
+	scope Scope,
+	requestBody any,
+	out any,
+	reqOpts ...RequestOption,
+) error {
+	return a.Do(
+		ctx,
+		scope,
+		http.MethodPost,
+		"/access/apps",
+		nil,
+		requestBody,
+		out,
+		reqOpts...,
+	)
+}
+
+// CreateReusablePolicy creates a reusable Access policy at account scope.
+func (a *AccessService) CreateReusablePolicy(
+	ctx context.Context,
+	accountID string,
+	requestBody any,
+	out any,
+	reqOpts ...RequestOption,
+) error {
+	return a.Do(
+		ctx,
+		AccountScope(accountID),
+		http.MethodPost,
+		"/access/policies",
+		nil,
+		requestBody,
+		out,
+		reqOpts...,
+	)
+}
+
+// CreateApplicationPolicy creates an application-scoped Access policy.
+func (a *AccessService) CreateApplicationPolicy(
+	ctx context.Context,
+	scope Scope,
+	appID string,
+	requestBody any,
+	out any,
+	reqOpts ...RequestOption,
+) error {
+	cleanAppID := strings.TrimSpace(appID)
+	if cleanAppID == "" {
+		return errors.New("app ID must not be empty")
+	}
+
+	return a.Do(
+		ctx,
+		scope,
+		http.MethodPost,
+		fmt.Sprintf("/access/apps/%s/policies", url.PathEscape(cleanAppID)),
+		nil,
+		requestBody,
+		out,
+		reqOpts...,
+	)
+}