xF2 Add-on [DigitalPoint] App for Cloudflare® 1.8.2

• Can use R2 for storage without site being a domain/zone in Cloudflare
• Made change to XenForo's attachment data entity to be more efficient (normally XenForo checks if an attachment exists before making an additional call to actually get it). This will reduce an API call for every attachment view because we don't need to check if the attachment exists (we know it does already because we have a record of it in attachment data).
• Added new option: Use presigned URLs for attachments stored in R2 (allows attachments stored in R2 to be viewed directly by the user, rather than you server needing to download the attachment to pass it through to the user)

The presigned URL thing is particularly interesting... a remote storage system like R2 has your server checking user permissions to see if a user can view something, then it makes an API call to fetch the file/object and then passes that through to the user.

As an example, if you have a 10MB attachment, your server first needs to download 10MB and then it sends that 10MB to the end user (so there's the time it takes to download the attachment from R2 and as well as 20MB total bandwidth happening on your server... 10MB in, then 10MB out). With presigned URLs, your server does the permission check and then if the user has permission to view the attachment, the user is redirected to a unique URL that expires in 60 seconds to fetch the attachment. This means attachments are viewed faster for end-users and your server isn't wasting bandwidth passing it through to the user.

Presigned URLs that expire and can't be changed by users is done with cryptographic signing (hence the name, presigned URLs).

Fix for issue when trying to enable guest page caching (ends up in a loop). Only needed if you don't have guest page caching enabled and you want to enable it.

• Fixed issue where you would get a Call to a member function getBody() on array exception instead of the intended HTTP response if an API call failed twice (it automatically does a retry if it failed once)
• When using guest page caching, decouple the purge cache mechanism from the http request (the purge cache action is sent to XenForo's job system)
• Show egress bandwidth when hovering over R2 class A or class B operation stats
• Reorganized settings to align with Cloudflare's recent dashboard changes
• Remove authentication option for Global API Keys (only allow API Tokens going forward)

Reorganization of settings moves settings to different categories and created sub-sections within categories. It follows the changes Cloudflare introduced this week so the location of settings in the addon matches where they are in the Cloudflare dashboard

• Fixed issue with creating Turnstile site via API (Cloudflare updated schema for API call)
• Added ASN support when creating IP address rules
• Cache Cloudflare zone/domain (makes it so an API call is not necessary on the admin index page to build deeplink to your zone in your Cloudflare account)

• Guest page caching will work properly when a page immediately fires an AJAX request
• Don't try to purge Cloudflare's cache when using guest page caching and an orphaned post is being deleted (when a post is assigned to a thread that doesn't exist)
• Don't include all Zero Trust Access rules in backup (only include rules for your zone/domain)
• Cache Rules included in backup/restore process

• Added check to make sure the site's hostname has at least one dot in it when determining Cloudflare zone ID (things like "localhost" are not valid Cloudflare zones)
• Fetch up to 1,000 R2 buckets per account with API call instead of the default of 20
• If API permissions get revoked on accident, don't throw exception about it on main admin index (admin index won't break if API permissions went away for some reason)

• Better handling of stats rebuilding when rebuilding all stats for the site (from cache rebuild)
• Check if Cloudflare account ID is missing when generating R2 bucket URL and add a server error log if that's the case (if an API token has insufficient permissions, you could end up with a missing account ID, which would in turn make R2 functions not work).
• Backup option works properly again with Firewall rules (forgot to convert that to the new Ruleset API that the firewall uses
• Added check to make sure none of the Cloudflare daily stats are somehow giving a negative number

• Better handling of situation where someone deleted R2 bucket in Cloudflare's dashboard but didn't disconnect that bucket from being used by XenForo yet.
• Fixed issue where we were assuming there was a firewall ruleset for firewall rules (not always the case, so don't assume it exists).
• Fixed issue with logging daily stats if a site isn't using Turnstile for CAPTCHAs
• Requires XF 2.1.0+ (always was the case technically, installer enforces it now)

IMPORTANT for existing users: A change to Firewall API calls requires a new API permission to be able to set it. You can go to your Cloudflare API Tokens, edit the token you have and add the following permissions:

• Zone.Zone WAF: Edit

The Firewall API has been deprecated and turned into a Ruleset API, so no way around the new permission (sorry).

Changes:

• Fixed missing padding on timeframe selector on DMARC management page
• Added missing phrase missing_cloudflare_authentication_info
• If there is no Cloudflare authentication token set (new install normally), don't try to show the stats block
• Fixed issue where deeplink generated for DMARC management would include sub-domain of site rather than just the domain/zone.
• Links for Turnstile settings and analytics work again (Cloudflare made an unannounced changed to API, so conforming to new API schema)
• Fixed reversed label on DMARC chart
• Fixed issue with approved DMARC sources showing in the unapproved sources report
• Fixed sorting issue on DMARC sources report
• Made internals of Country blocking case-insensitive for country codes
• Migrated Firewall API calls to new Ruleset API
• New Cloudflare daily stats (in XenForo's normal statistics area):
  • Unique visitors
  • Requests
  • Data served
  • Data cached
  • Threats
  • Turnstile challenges
  • Turnstile interactive solves
  • Turnstile non-interactive solves
  • Turnstile unsolved
  • R2 class A operations
  • R2 class B operations

• Selecting Global API keys are disabled (can't setup new ones going forward). Includes deprecation notice (going away completely in the future, so migrate to API tokens if you are still using Global API keys!).
• Unify primary classes so they can be shared without changes with WordPress version of this addon
• If you don't already have a Cloudflare API token, the link to create one will pre-define the required permissions for you (way less annoying for new users)
• Updated deep links inside cloudflare.com for Firewall events to reflect the new endpoint
• Look back 7 days instead of 1 day to find account-level usage records for buckets
• unfurl and image proxy Workers will use default language for site when they are setup
• Changed URL where you set Worker subdomain and made it a property for easier changes in the future (Cloudflare changed it in their dashboard)
• Make external URL include protocol (https rather than relative URLs (R2 subdomains always have valid SSL certificates, so no reason to serve up content insecurely even if the site isn't using HTTPS)
• Automatic retry (once) if API/R2 calls return HTTP 499 response (same way we handle server-side [5xx errors])
• Change verbiage on R2 operation log to be more clear about billable events
• Don't hardcode dash.cloudflare.com prefix in admin:cloudflare_r2 template
• Fix Zero round trip phrase being title case
• Add direct link for setup of Zero Trust Access authentication method
• Added new pre-set Cache Rule option to force caching of static content
• Firewall rules can be toggled on/off
• User agent rules can be toggled on/off
• Page rules can be toggled on/off
• Cache rules can be toggled on/off
• Cloudflare analytics shown on admin index