fix(cli): forward CF Access headers on the OIDC token exchange (review)

The GitHub Actions OIDC → deploy-token exchange POSTs to
$VOID_API_URL/auth/github-oidc before any PlatformClient exists, so it
sent only Content-Type. When VOID_API_URL targets the Access-gated
staging API, Cloudflare Access rejected the request at the edge before
/auth/github-oidc could mint the deploy token.

Mirror every other CLI → Void-API call: call ensureCloudflaredToken(apiUrl)
and spread cfAccessHeaders(process.env) on the POST. Both no-op for the
prod/ungated path (no CF Access env, host not gated), so this is a safe
defense-in-depth change. The GitHub OIDC GET (token.actions.githubusercontent.com)
is untouched — CF Access headers belong only to the Void API.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Brooooooklyn

packages/void/src/cli/github-oidc.ts

@@ -12,6 +12,9 @@
  *   response { token: string, projectId, buildId }
  */
 
+import { cfAccessHeaders } from '../shared/cf-access.ts';
+import { ensureCloudflaredToken } from './cf-access.ts';
+
 const OIDC_AUDIENCE = 'void';
 
 /**
@@ -107,11 +110,19 @@ async function exchangeOidcTokenAtApi(
   const base = apiUrl.endsWith('/') ? apiUrl.slice(0, -1) : apiUrl;
   const url = `${base}/auth/github-oidc`;
 
+  // This POST hits the Void API (which may be the Access-gated staging host)
+  // before any PlatformClient exists, so it must carry CF Access credentials
+  // itself — exactly like every other CLI → Void-API call (PlatformClient
+  // ctor, exchangeLoginCode). `ensureCloudflaredToken` no-ops for prod/ungated
+  // hosts and when the service-token pair or CF_ACCESS_TOKEN is already set;
+  // `cfAccessHeaders` returns {} when no CF Access env is present (prod path).
+  ensureCloudflaredToken(apiUrl);
+
   let res: Response;
   try {
     res = await fetch(url, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', ...cfAccessHeaders(process.env) },
       body: JSON.stringify({ oidcToken, project }),
     });
   } catch (err) {

packages/void/test/unit/github-oidc.test.ts

@@ -30,6 +30,14 @@ function jsonResponse(body: unknown, status = 200): Response {
 const REQUEST_URL = 'https://token.actions.githubusercontent.com/abc?api-version=2.0';
 const REQUEST_TOKEN = 'req-token-123';
 
+function restoreEnv(key: string, prev: string | undefined): void {
+  if (prev === undefined) {
+    delete process.env[key];
+  } else {
+    process.env[key] = prev;
+  }
+}
+
 function oidcEnv(overrides: Record<string, string | undefined> = {}): NodeJS.ProcessEnv {
   return {
     GITHUB_ACTIONS: 'true',
@@ -95,6 +103,83 @@ describe('exchangeGithubOidcForDeployToken', () => {
     expect(postInit.body).toBe(JSON.stringify({ oidcToken: 'oidc-jwt', project: 'my-app' }));
   });
 
+  it('forwards CF Access service-token headers on the API POST but not the GitHub GET', async () => {
+    const prevId = process.env.CF_ACCESS_CLIENT_ID;
+    const prevSecret = process.env.CF_ACCESS_CLIENT_SECRET;
+    process.env.CF_ACCESS_CLIENT_ID = 'cf-id';
+    process.env.CF_ACCESS_CLIENT_SECRET = 'cf-secret';
+    try {
+      fetchMock
+        .mockResolvedValueOnce(jsonResponse({ value: 'oidc-jwt' }))
+        .mockResolvedValueOnce(jsonResponse({ token: 'deploy-token' }));
+
+      await exchangeGithubOidcForDeployToken(apiUrl, 'my-app', oidcEnv());
+
+      // GitHub OIDC GET hits token.actions.githubusercontent.com — never CF Access.
+      const [, getInit] = fetchMock.mock.calls[0] as [URL, RequestInit];
+      const getHeaders = getInit.headers as Record<string, string>;
+      expect(getHeaders['CF-Access-Client-Id']).toBeUndefined();
+      expect(getHeaders['CF-Access-Client-Secret']).toBeUndefined();
+
+      // Void API POST carries the service-token pair so Access-gated staging passes.
+      const [, postInit] = fetchMock.mock.calls[1] as [string, RequestInit];
+      const postHeaders = postInit.headers as Record<string, string>;
+      expect(postHeaders['CF-Access-Client-Id']).toBe('cf-id');
+      expect(postHeaders['CF-Access-Client-Secret']).toBe('cf-secret');
+    } finally {
+      restoreEnv('CF_ACCESS_CLIENT_ID', prevId);
+      restoreEnv('CF_ACCESS_CLIENT_SECRET', prevSecret);
+    }
+  });
+
+  it('forwards a CF_ACCESS_TOKEN user JWT on the API POST but not the GitHub GET', async () => {
+    const prevToken = process.env.CF_ACCESS_TOKEN;
+    process.env.CF_ACCESS_TOKEN = 'cf-jwt';
+    try {
+      fetchMock
+        .mockResolvedValueOnce(jsonResponse({ value: 'oidc-jwt' }))
+        .mockResolvedValueOnce(jsonResponse({ token: 'deploy-token' }));
+
+      await exchangeGithubOidcForDeployToken(apiUrl, 'my-app', oidcEnv());
+
+      const [, getInit] = fetchMock.mock.calls[0] as [URL, RequestInit];
+      expect((getInit.headers as Record<string, string>)['cf-access-token']).toBeUndefined();
+
+      const [, postInit] = fetchMock.mock.calls[1] as [string, RequestInit];
+      expect((postInit.headers as Record<string, string>)['cf-access-token']).toBe('cf-jwt');
+    } finally {
+      restoreEnv('CF_ACCESS_TOKEN', prevToken);
+    }
+  });
+
+  it('omits CF Access headers on the API POST when no CF Access env is set (prod path)', async () => {
+    const prevId = process.env.CF_ACCESS_CLIENT_ID;
+    const prevSecret = process.env.CF_ACCESS_CLIENT_SECRET;
+    const prevToken = process.env.CF_ACCESS_TOKEN;
+    delete process.env.CF_ACCESS_CLIENT_ID;
+    delete process.env.CF_ACCESS_CLIENT_SECRET;
+    delete process.env.CF_ACCESS_TOKEN;
+    try {
+      fetchMock
+        .mockResolvedValueOnce(jsonResponse({ value: 'oidc-jwt' }))
+        .mockResolvedValueOnce(jsonResponse({ token: 'deploy-token' }));
+
+      await exchangeGithubOidcForDeployToken(apiUrl, 'my-app', oidcEnv());
+
+      const [, postInit] = fetchMock.mock.calls[1] as [string, RequestInit];
+      const postHeaders = postInit.headers as Record<string, string>;
+      expect(postHeaders['CF-Access-Client-Id']).toBeUndefined();
+      expect(postHeaders['CF-Access-Client-Secret']).toBeUndefined();
+      expect(postHeaders['cf-access-token']).toBeUndefined();
+      // The plain Content-Type header is still present.
+      expect(postHeaders['Content-Type']).toBe('application/json');
+    } finally {
+      restoreEnv('CF_ACCESS_CLIENT_ID', prevId);
+      restoreEnv('CF_ACCESS_CLIENT_SECRET', prevSecret);
+      restoreEnv('CF_ACCESS_TOKEN', prevToken);
+    }
+  });
+
   it('strips a trailing slash from the API URL', async () => {
     fetchMock
       .mockResolvedValueOnce(jsonResponse({ value: 'oidc-jwt' }))