Add Cloudflare Access auth to sentry

[mendess]

No description provided.

[lukevalenta]

/bonk review

[ask-bonk]

PR #258 – Add Cloudflare Access auth to Sentry integration

Summary of changes

• Extended WorkerTransport in generic_log_worker/src/obs/sentry.rs with optional access_client_id and access_client_secret fields.
• Updated init to accept these values and store them in the transport.
• Modified the request construction in flush() to add the CF-Access-Client-ID and CF-Access-Client-Secret headers when present.
• Updated each worker crate (bootstrap_mtc_worker, ct_worker, witness_worker) to read the new environment variables (SENTRY_ACCESS_CLIENT_ID and SENTRY_ACCESS_CLIENT_SECRET) and pass them to the Sentry init call.

Potential concerns & verification points

1. Secret handling – SENTRY_ACCESS_CLIENT_SECRET is fetched via env.secret, which is appropriate for a secret value. The ID is fetched via env.var (non‑secret) – this matches the expected Cloudflare Access model.
2. Header inclusion – The headers are added only when the optional fields are Some. This avoids leaking empty headers.
3. Transport cloning – The new fields are stored as owned Strings inside the transport, which is fine given the transport lives for the lifetime of the worker isolate.
4. Compatibility – Existing code that calls generic_log_worker::obs::sentry::init continues to compile because the function signature was extended with default Option<&str> arguments, and all call sites were updated accordingly.
5. Testing – No new unit tests were added, but the existing Sentry integration paths will now include the extra headers when the environment variables are set. Running the full test suite (cargo test) should surface any regressions.

Overall assessment
The implementation cleanly adds Cloudflare Access authentication to the Sentry transport without breaking existing functionality. The code follows the existing patterns for environment variable handling and header injection. No lint or compilation issues are apparent; the changes appear ready for merge.

github run

[lukevalenta]

lgtm