Add account analytics OAuth scope (cloudflare#173)

mattzcarey · web-flow · commit 3d46b04fe766 · 2026-07-03T12:56:46.000+01:00
diff --git a/src/auth/scopes.ts b/src/auth/scopes.ts
@@ -54,6 +54,7 @@ export const ALL_SCOPES = {
   'logpush:read': 'View Logpush jobs',
   'logpush:write': 'Configure Logpush jobs',
   'auditlogs:read': 'View audit logs',
+  'account-analytics.read': 'View account analytics such as RUM and Web Analytics data',
   'logs.read': 'View logs',
   'logs.write': 'Manage logs',
 
diff --git a/src/auth/workers-oauth-utils.ts b/src/auth/workers-oauth-utils.ts
@@ -241,6 +241,7 @@ const RESOURCE_LABELS: Record<string, string> = {
   aiaudit: 'AI Audit',
   'ai-search': 'AI Search',
   auditlogs: 'Audit logs',
+  'account-analytics': 'Account analytics',
   browser: 'Browser Rendering',
   cfone: 'Cloudflare One',
   connectivity: 'Connectivity',
@@ -349,6 +350,7 @@ const CATEGORY_MAP: Record<string, string> = {
   snippets: 'DNS & Zones',
   logpush: 'Analytics & Logs',
   auditlogs: 'Analytics & Logs',
+  'account-analytics': 'Analytics & Logs',
   logs: 'Analytics & Logs',
   lb: 'Networking',
   notification: 'Networking',
diff --git a/tests/auth/scopes.test.ts b/tests/auth/scopes.test.ts
@@ -49,6 +49,7 @@ const REGISTERED_SCOPES = [
   'logpush:read',
   'logpush:write',
   'auditlogs:read',
+  'account-analytics.read',
   'logs.read',
   'logs.write',
   'account-ssl-and-certificates.write',
@@ -166,6 +167,11 @@ describe('scopes', () => {
       expect(SCOPE_TEMPLATES['read-only'].scopes).toContain('registrar-domains.read')
       expect(SCOPE_TEMPLATES['read-only'].scopes).toContain('logs.read')
       expect(SCOPE_TEMPLATES['read-only'].scopes).toContain('ssl-and-certificates.read')
+      expect(SCOPE_TEMPLATES['read-only'].scopes).toContain('account-analytics.read')
+    })
+
+    it('full-access template should include account analytics access', () => {
+      expect(SCOPE_TEMPLATES.yolo.scopes).toContain('account-analytics.read')
     })
 
     it('full-access template should include derived SSL certificate access', () => {
