fix(cloudflare): add the SSL and Certificates scope to the UI token links

The provider wizard builds its own copies of the two prefilled Cloudflare
token URLs, so fixing the docs alone would leave anyone onboarding
through the UI with the same incomplete token and the same false
Universal SSL failure.

Updates PRECONFIGURED_CREDENTIAL_URLS.CLOUDFLARE_API_TOKEN_USER and
buildCloudflareAccountOwnedApiTokenUrl to request the fifth scope, along
with the comments in both that enumerate the four, and the tests that
pin the exact URL and the decoded permissionGroupKeys.

The comments in external-urls.ts ask for these to be kept in sync with
the docs; they now are.

Author: danibarranqueroo

ui/components/providers/workflow/forms/select-credentials-type/cloudflare/credentials-type/cloudflare-api-token-credentials-form.test.tsx

@@ -21,7 +21,7 @@ const Harness = ({ providerUid }: { providerUid?: string }) => {
 };
 
 const USER_URL =
-  "https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22read%22%7D%5D&accountId=%2A&zoneId=all&name=Prowler%20Security%20Scanner";
+  "https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22ssl_and_certificates%22%2C%22type%22%3A%22read%22%7D%5D&accountId=%2A&zoneId=all&name=Prowler%20Security%20Scanner";
 
 describe("CloudflareApiTokenCredentialsForm", () => {
   it("always renders the User API Token link with the correct href and safe target attributes", () => {

ui/lib/external-urls.test.ts

@@ -114,20 +114,21 @@ describe("getAWSOrgDeploymentQuickLink", () => {
 });
 
 describe("PRECONFIGURED_CREDENTIAL_URLS", () => {
-  it("keeps the Cloudflare User API Token URL under the profile route with the four required read scopes", () => {
+  it("keeps the Cloudflare User API Token URL under the profile route with the five required read scopes", () => {
     // Snapshot check: fixes the exact URL so a stray edit to the permission
     // scopes, token name, account/zone selectors or console origin trips a
     // failing test instead of silently shipping a broken pre-configured
     // token flow to users. Matches the "User API Token" link in
     // docs/user-guide/providers/cloudflare/authentication.mdx.
     expect(PRECONFIGURED_CREDENTIAL_URLS.CLOUDFLARE_API_TOKEN_USER).toBe(
-      "https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22read%22%7D%5D&accountId=%2A&zoneId=all&name=Prowler%20Security%20Scanner",
+      "https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22ssl_and_certificates%22%2C%22type%22%3A%22read%22%7D%5D&accountId=%2A&zoneId=all&name=Prowler%20Security%20Scanner",
     );
   });
 
-  it("carries the four Prowler read scopes as decoded permissionGroupKeys on the Cloudflare User API Token URL", () => {
+  it("carries the five Prowler read scopes as decoded permissionGroupKeys on the Cloudflare User API Token URL", () => {
     // Semantic contract: the URL must request read on account_settings, zone,
-    // zone_settings and dns and reuse the shared Prowler token name.
+    // zone_settings, dns and ssl_and_certificates and reuse the shared Prowler
+    // token name.
     const parsed = new URL(
       PRECONFIGURED_CREDENTIAL_URLS.CLOUDFLARE_API_TOKEN_USER,
     );
@@ -140,6 +141,7 @@ describe("PRECONFIGURED_CREDENTIAL_URLS", () => {
       { key: "zone", type: "read" },
       { key: "zone_settings", type: "read" },
       { key: "dns", type: "read" },
+      { key: "ssl_and_certificates", type: "read" },
     ]);
     expect(parsed.searchParams.get("name")).toBe("Prowler Security Scanner");
   });
@@ -214,6 +216,7 @@ describe("buildCloudflareAccountOwnedApiTokenUrl", () => {
       { key: "zone", type: "read" },
       { key: "zone_settings", type: "read" },
       { key: "dns", type: "read" },
+      { key: "ssl_and_certificates", type: "read" },
     ]);
   });
 

ui/lib/external-urls.ts

@@ -61,12 +61,13 @@ const CF_QUICKCREATE_BASE_URL =
 // `getAWSCredentialsTemplateLinks` below.
 export const PRECONFIGURED_CREDENTIAL_URLS = {
   // Opens the Cloudflare "Create Custom Token" form under the user profile
-  // pre-filled with the four read-only scopes Prowler needs
-  // (`Account Settings`, `Zone`, `Zone Settings`, `DNS`) and the token name.
+  // pre-filled with the five read-only scopes Prowler needs
+  // (`Account Settings`, `Zone`, `Zone Settings`, `DNS`, `SSL and Certificates`)
+  // and the token name.
   // Kept in sync with the "User API Token" URL published in
   // docs/user-guide/providers/cloudflare/authentication.mdx.
   CLOUDFLARE_API_TOKEN_USER:
-    "https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22read%22%7D%5D&accountId=%2A&zoneId=all&name=Prowler%20Security%20Scanner",
+    "https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22ssl_and_certificates%22%2C%22type%22%3A%22read%22%7D%5D&accountId=%2A&zoneId=all&name=Prowler%20Security%20Scanner",
   // Opens the GitHub fine-grained PAT creation form pre-filled with the four
   // read-only permissions Prowler needs to scan a user's own repositories.
   // Kept in sync with the "user repositories" URL published in
@@ -82,7 +83,7 @@ export const PRECONFIGURED_CREDENTIAL_URLS = {
 // avoid ambiguity when the user is signed into multiple accounts. Navigating
 // directly to `/<accountId>/api-tokens/create` does NOT pre-fill the form —
 // Cloudflare only reads the pre-fill params when they arrive via the router.
-// Same four read-only scopes as the user token URL.
+// Same five read-only scopes as the user token URL.
 export const buildCloudflareAccountOwnedApiTokenUrl = (
   accountId: string,
 ): string => {
@@ -97,6 +98,7 @@ export const buildCloudflareAccountOwnedApiTokenUrl = (
       { key: "zone", type: "read" },
       { key: "zone_settings", type: "read" },
       { key: "dns", type: "read" },
+      { key: "ssl_and_certificates", type: "read" },
     ]),
   );
   const name = encodeURIComponent("Prowler Security Scanner");