{"record":{"id":"fe07baae2274651b","repo":"cloudflare/cloudflared","slug":"invalid-resource-s-w","errorCode":null,"errorMessage":"invalid resource '%s': %w","messagePattern":"invalid resource '(.+?)': %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/cloudflared/management/cmd.go","lineNumber":76,"sourceCode":"\t\t\t\tName:    cfdflags.LogLevel,\n\t\t\t\tValue:   \"info\",\n\t\t\t\tUsage:   \"Application logging level {debug, info, warn, error, fatal}\",\n\t\t\t\tEnvVars: []string{\"TUNNEL_LOGLEVEL\"},\n\t\t\t},\n\t\t\tcliutil.FlagLogOutput,\n\t\t},\n\t}\n}\n\n// tokenCommand handles the token subcommand execution\nfunc tokenCommand(c *cli.Context) error {\n\tlog := cliutil.CreateStderrLogger(c)\n\n\t// Parse and validate resource flag\n\tresourceStr := c.String(\"resource\")\n\tresource, err := parseResource(resourceStr)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid resource '%s': %w\", resourceStr, err)\n\t}\n\n\t// Get management token\n\ttoken, err := cliutil.GetManagementToken(c, log, resource, buildInfo)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\t// Output JSON to stdout\n\ttokenResponse := struct {\n\t\tToken string `json:\"token\"`\n\t}{Token: token}\n\n\treturn json.NewEncoder(os.Stdout).Encode(tokenResponse)\n}\n\n// parseResource converts resource string to ManagementResource enum\nfunc parseResource(resource string) (cfapi.ManagementResource, error) {","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/cmd/cloudflared/management/cmd.go#L58-L94","documentation":"The `cloudflared management token` command validates the --resource flag via parseResource before requesting a management token. If the resource string is not a recognized value, the parse error is wrapped as \"invalid resource '%s': %w\" and the command exits. This is a CLI input validation guard so a bad flag value fails fast instead of hitting the API.","triggerScenarios":"Running `cloudflared management token --resource <value>` where <value> is anything other than \"logs\", \"admin\", or \"host_details\" (typo, wrong casing, or empty value).","commonSituations":"Typing `--resource Logs` (capitalized), `--resource log`, forgetting the value, or copying an outdated example from older docs/versions with a different resource set.","solutions":["Use exactly one of: logs, admin, host_details (all lowercase)","Check `cloudflared management token --help` for the accepted values in your version","Quote the value to avoid shell issues, e.g. --resource \"host_details\""],"exampleFix":"// before\ncloudflared management token --resource Logs\n\n// after\ncloudflared management token --resource logs","handlingStrategy":"validation","validationCode":"// shell: validate the flag before invoking\nvalid=\"logs admin host_details\"\n[[ \" $valid \" == *\" $RESOURCE \"* ]] || { echo \"--resource must be one of: $valid\" >&2; exit 2; }","typeGuard":null,"tryCatchPattern":"// Go caller: treat exit as a usage error, inspect stderr\nout, err := exec.Command(\"cloudflared\", \"management\", \"token\", \"--resource\", r).CombinedOutput()\nif err != nil && strings.Contains(string(out), \"invalid resource\") {\n    return fmt.Errorf(\"usage error: %s\", out)\n}","preventionTips":["Use the exact lowercase values: logs, admin, host_details","Check --help output for the current version's accepted resources","Centralize the resource value in scripts/constants instead of inlining ad-hoc strings"],"tags":["cli","validation","management","flag"],"backgroundTag":"invalid-enum-value","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}