Add Cloudflare v2 plugin

.github/CODEOWNERS

@@ -8,6 +8,7 @@ plugins/* @squaredup/community-moderators
 
 # Request review from original author
 plugins/AutoTask/*  @TimWheeler-SQUP
+plugins/Cloudflare/*  @clarkd
 plugins/DattoRMM/*  @TimWheeler-SQUP
 plugins/DigiCert/*  @shaswot77
 plugins/Huntress/*  @Deenk

plugins/Cloudflare/v2/configValidation.json

@@ -0,0 +1,31 @@
+{
+    "steps": [
+        {
+            "displayName": "Authenticate",
+            "dataStream": { "name": "verifyToken" },
+            "required": true,
+            "error": "Could not authenticate with Cloudflare. Check the API token is valid, has not expired, and has not been revoked.",
+            "success": "Connected to Cloudflare successfully."
+        },
+        {
+            "displayName": "Check account access",
+            "dataStream": {
+                "name": "accounts",
+                "config": { "errorOnEmptyResults": true }
+            },
+            "required": false,
+            "error": "Authenticated, but no accounts are visible. Add the Account Settings Read permission and set Account Resources to Include all accounts.",
+            "success": "Accounts accessible."
+        },
+        {
+            "displayName": "Check zone access",
+            "dataStream": {
+                "name": "zones",
+                "config": { "errorOnEmptyResults": true }
+            },
+            "required": false,
+            "error": "Authenticated, but no zones are visible. Add the Zone Read permission and set Zone Resources to Include all zones.",
+            "success": "Zones accessible."
+        }
+    ]
+}

plugins/Cloudflare/v2/correlationRules/relate-access-application-to-zone.json

@@ -0,0 +1,21 @@
+{
+    "displayName": "Access Application protects Zone",
+    "source": {
+        "types": "Cloudflare Access Application"
+    },
+    "target": {
+        "types": "Cloudflare Zone"
+    },
+    "conditions": [
+        {
+            "sourceProperty": "domain",
+            "sourceExpression": "{{ value.split('.').slice(-2).join('.') }}",
+            "operator": "equals",
+            "targetProperty": "name"
+        }
+    ],
+    "labels": {
+        "forward": "protects",
+        "reverse": "protected by"
+    }
+}

plugins/Cloudflare/v2/correlationRules/relate-durable-object-namespace-to-worker.json

@@ -0,0 +1,25 @@
+{
+    "displayName": "Durable Object Namespace defined by Worker",
+    "source": {
+        "types": "Cloudflare Durable Object Namespace"
+    },
+    "target": {
+        "types": "Cloudflare Worker"
+    },
+    "conditions": [
+        {
+            "sourceProperty": "scriptName",
+            "operator": "equals",
+            "targetProperty": "name"
+        },
+        {
+            "sourceProperty": "accountId",
+            "operator": "equals",
+            "targetProperty": "accountId"
+        }
+    ],
+    "labels": {
+        "forward": "defined by",
+        "reverse": "defines"
+    }
+}

plugins/Cloudflare/v2/correlationRules/relate-pages-project-to-zone.json

@@ -0,0 +1,20 @@
+{
+    "displayName": "Pages Project served by Zone",
+    "source": {
+        "types": "Cloudflare Pages Project"
+    },
+    "target": {
+        "types": "Cloudflare Zone"
+    },
+    "conditions": [
+        {
+            "sourceProperty": "primaryDomain",
+            "operator": "equals",
+            "targetProperty": "name"
+        }
+    ],
+    "labels": {
+        "forward": "served by",
+        "reverse": "serves"
+    }
+}

plugins/Cloudflare/v2/correlationRules/relate-queue-to-producer-worker.json

@@ -0,0 +1,25 @@
+{
+    "displayName": "Queue receives messages from Worker",
+    "source": {
+        "types": "Cloudflare Queue"
+    },
+    "target": {
+        "types": "Cloudflare Worker"
+    },
+    "conditions": [
+        {
+            "sourceProperty": "primaryProducerScript",
+            "operator": "equals",
+            "targetProperty": "name"
+        },
+        {
+            "sourceProperty": "accountId",
+            "operator": "equals",
+            "targetProperty": "accountId"
+        }
+    ],
+    "labels": {
+        "forward": "receives messages from",
+        "reverse": "sends messages to"
+    }
+}

plugins/Cloudflare/v2/correlationRules/relate-queue-to-worker.json

@@ -0,0 +1,25 @@
+{
+    "displayName": "Queue consumed by Worker",
+    "source": {
+        "types": "Cloudflare Queue"
+    },
+    "target": {
+        "types": "Cloudflare Worker"
+    },
+    "conditions": [
+        {
+            "sourceProperty": "primaryConsumerScript",
+            "operator": "equals",
+            "targetProperty": "name"
+        },
+        {
+            "sourceProperty": "accountId",
+            "operator": "equals",
+            "targetProperty": "accountId"
+        }
+    ],
+    "labels": {
+        "forward": "consumed by",
+        "reverse": "consumes"
+    }
+}

plugins/Cloudflare/v2/correlationRules/relate-resources-to-account.json

@@ -0,0 +1,41 @@
+{
+    "displayName": "Account contains Resource",
+    "source": {
+        "types": [
+            "Cloudflare Zone",
+            "Cloudflare Worker",
+            "Cloudflare R2 Bucket",
+            "Cloudflare Pages Project",
+            "Cloudflare D1 Database",
+            "Cloudflare KV Namespace",
+            "Cloudflare Queue",
+            "Cloudflare Tunnel",
+            "Cloudflare Load Balancer Pool",
+            "Cloudflare Access Application",
+            "Cloudflare Durable Object Namespace",
+            "Cloudflare Vectorize Index",
+            "Cloudflare Hyperdrive Config",
+            "Cloudflare Stream Video",
+            "Cloudflare Turnstile Widget",
+            "Cloudflare AI Gateway",
+            "Cloudflare AutoRAG",
+            "Cloudflare Container Application",
+            "Cloudflare Pipeline",
+            "Cloudflare Realtime App"
+        ]
+    },
+    "target": {
+        "types": "Cloudflare Account"
+    },
+    "conditions": [
+        {
+            "sourceProperty": "accountId",
+            "operator": "equals",
+            "targetProperty": "rawId"
+        }
+    ],
+    "labels": {
+        "forward": "belongs to",
+        "reverse": "contains"
+    }
+}

plugins/Cloudflare/v2/correlationRules/relate-turnstile-widget-to-zone.json

@@ -0,0 +1,20 @@
+{
+    "displayName": "Turnstile Widget protects Zone",
+    "source": {
+        "types": "Cloudflare Turnstile Widget"
+    },
+    "target": {
+        "types": "Cloudflare Zone"
+    },
+    "conditions": [
+        {
+            "sourceProperty": "primaryDomain",
+            "operator": "equals",
+            "targetProperty": "name"
+        }
+    ],
+    "labels": {
+        "forward": "protects",
+        "reverse": "protected by"
+    }
+}

plugins/Cloudflare/v2/correlationRules/relate-worker-binding-to-d1-database.json

@@ -0,0 +1,20 @@
+{
+    "displayName": "Worker Binding targets D1 Database",
+    "source": {
+        "types": "Cloudflare Worker Binding"
+    },
+    "target": {
+        "types": "Cloudflare D1 Database"
+    },
+    "conditions": [
+        {
+            "sourceProperty": "d1DatabaseId",
+            "operator": "equals",
+            "targetProperty": "rawId"
+        }
+    ],
+    "labels": {
+        "forward": "targets",
+        "reverse": "targeted by"
+    }
+}

plugins/Cloudflare/v2/correlationRules/relate-worker-binding-to-durable-object-namespace.json

@@ -0,0 +1,20 @@
+{
+    "displayName": "Worker Binding targets Durable Object Namespace",
+    "source": {
+        "types": "Cloudflare Worker Binding"
+    },
+    "target": {
+        "types": "Cloudflare Durable Object Namespace"
+    },
+    "conditions": [
+        {
+            "sourceProperty": "durableObjectNamespaceId",
+            "operator": "equals",
+            "targetProperty": "rawId"
+        }
+    ],
+    "labels": {
+        "forward": "targets",
+        "reverse": "targeted by"
+    }
+}

plugins/Cloudflare/v2/correlationRules/relate-worker-binding-to-hyperdrive-config.json

@@ -0,0 +1,20 @@
+{
+    "displayName": "Worker Binding targets Hyperdrive Config",
+    "source": {
+        "types": "Cloudflare Worker Binding"
+    },
+    "target": {
+        "types": "Cloudflare Hyperdrive Config"
+    },
+    "conditions": [
+        {
+            "sourceProperty": "hyperdriveConfigId",
+            "operator": "equals",
+            "targetProperty": "rawId"
+        }
+    ],
+    "labels": {
+        "forward": "targets",
+        "reverse": "targeted by"
+    }
+}

plugins/Cloudflare/v2/correlationRules/relate-worker-binding-to-kv-namespace.json

@@ -0,0 +1,20 @@
+{
+    "displayName": "Worker Binding targets KV Namespace",
+    "source": {
+        "types": "Cloudflare Worker Binding"
+    },
+    "target": {
+        "types": "Cloudflare KV Namespace"
+    },
+    "conditions": [
+        {
+            "sourceProperty": "kvNamespaceId",
+            "operator": "equals",
+            "targetProperty": "rawId"
+        }
+    ],
+    "labels": {
+        "forward": "targets",
+        "reverse": "targeted by"
+    }
+}

plugins/Cloudflare/v2/correlationRules/relate-worker-binding-to-queue.json

@@ -0,0 +1,25 @@
+{
+    "displayName": "Worker Binding targets Queue",
+    "source": {
+        "types": "Cloudflare Worker Binding"
+    },
+    "target": {
+        "types": "Cloudflare Queue"
+    },
+    "conditions": [
+        {
+            "sourceProperty": "queueName",
+            "operator": "equals",
+            "targetProperty": "name"
+        },
+        {
+            "sourceProperty": "accountId",
+            "operator": "equals",
+            "targetProperty": "accountId"
+        }
+    ],
+    "labels": {
+        "forward": "targets",
+        "reverse": "targeted by"
+    }
+}

plugins/Cloudflare/v2/correlationRules/relate-worker-binding-to-r2-bucket.json

@@ -0,0 +1,25 @@
+{
+    "displayName": "Worker Binding targets R2 Bucket",
+    "source": {
+        "types": "Cloudflare Worker Binding"
+    },
+    "target": {
+        "types": "Cloudflare R2 Bucket"
+    },
+    "conditions": [
+        {
+            "sourceProperty": "r2BucketName",
+            "operator": "equals",
+            "targetProperty": "name"
+        },
+        {
+            "sourceProperty": "accountId",
+            "operator": "equals",
+            "targetProperty": "accountId"
+        }
+    ],
+    "labels": {
+        "forward": "targets",
+        "reverse": "targeted by"
+    }
+}

plugins/Cloudflare/v2/correlationRules/relate-worker-binding-to-service-worker.json

@@ -0,0 +1,25 @@
+{
+    "displayName": "Worker Binding calls Worker",
+    "source": {
+        "types": "Cloudflare Worker Binding"
+    },
+    "target": {
+        "types": "Cloudflare Worker"
+    },
+    "conditions": [
+        {
+            "sourceProperty": "serviceName",
+            "operator": "equals",
+            "targetProperty": "name"
+        },
+        {
+            "sourceProperty": "accountId",
+            "operator": "equals",
+            "targetProperty": "accountId"
+        }
+    ],
+    "labels": {
+        "forward": "calls",
+        "reverse": "called by"
+    }
+}