hotfix for #217

Author: ChrispyBacon-dev

CHANGELOG.md

@@ -6,10 +6,14 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ---
-## [v3.0.2] - 2025-09-27
+
+## [v3.0.1] (Hotfixes) - 2025-09-27
 
 ### Fixed
-- **IP Whitelist Access Policies:** Corrected an issue where IP-based access policies were not working as expected. The system now correctly creates a `bypass` rule for IP whitelists and a separate `allow` rule for email-based authentication, ensuring whitelisted IPs can access services without an additional authentication step. (raised by @durzo #216)
+- **IP Whitelist Access Policies:** Corrected an issue where IP-based access policies were not working as expected. DockFlare now correctly creates a `bypass` rule for IP whitelists and a separate `allow` rule for email-based authentication, ensuring whitelisted IPs can access services without an additional authentication step.
+- **Access Policy Updates:** Fixed a bug where updating an existing ingress rule's Access Policy would fail with an "application already exists" error. DockFlare now correctly updates the existing Cloudflare Access application instead of trying to create a new one.
+- **API Error Logging:** Reduced the severity of the log message for a `403 Forbidden` error when fetching a user's email. This is an expected and non-critical error when using a scoped API token.
+(raised by @durzo issue tracker #216 #217)
 
 ---
 ## [v3.0.1] - 2025-09-26

dockflare/app/core/access_manager.py

@@ -90,7 +90,10 @@ def get_cloudflare_account_email():
             logging.warning(f"Failed to fetch Cloudflare account email, API call unsuccessful. Response: {response_data}")
             return None
     except requests.exceptions.RequestException as e:
-        logging.error(f"API error fetching Cloudflare account email: {e}")
+        if hasattr(e, 'response') and e.response is not None and e.response.status_code == 403:
+            logging.info("Could not fetch Cloudflare account email due to permissions. This is expected if using a scoped API token without User.Read permissions. The TLD policy feature will be disabled.")
+        else:
+            logging.error(f"API error fetching Cloudflare account email: {e}")
         return None
     except Exception as e:
         logging.error(f"Unexpected error fetching Cloudflare account email: {e}", exc_info=True)

dockflare/app/web/routes.py

@@ -1296,14 +1296,23 @@ def ui_add_manual_rule_route():
                 ]
                 cf_access_policies.append({"name": "UI Deny Fallback", "decision": "deny", "include": [{"everyone": {}}]})
 
-            app_result = create_cloudflare_access_application(
-                full_hostname, f"DockFlare-{full_hostname}", "24h", False, [full_hostname], cf_access_policies, None, False
-            )
-            if app_result:
-                access_app_id = app_result.get('id')
-                access_policy_type = manual_access_policy_type
-            else:
-                cloudflared_agent_state["last_action_status"] = "Error: Failed to create Access App for manual policy."
+            if cf_access_policies:
+                app_result = None
+                existing_app = find_cloudflare_access_application_by_hostname(full_hostname)
+                if existing_app:
+                    app_result = update_cloudflare_access_application(
+                        existing_app['id'], full_hostname, f"DockFlare-{full_hostname}", "24h", False, [full_hostname], cf_access_policies, None, False
+                    )
+                else:
+                    app_result = create_cloudflare_access_application(
+                        full_hostname, f"DockFlare-{full_hostname}", "24h", False, [full_hostname], cf_access_policies, None, False
+                    )
+
+                if app_result:
+                    access_app_id = app_result.get('id')
+                    access_policy_type = manual_access_policy_type
+                else:
+                    cloudflared_agent_state["last_action_status"] = "Error: Failed to create/update Access App for manual policy."
 
     with state_lock:
         existing_rule = managed_rules.get(key_for_managed_rules)
@@ -1524,9 +1533,17 @@ def ui_edit_manual_rule_route():
                     {"name": "UI Deny Fallback", "decision": "deny", "include": [{"everyone": {}}]}
                 ]
             if cf_access_policies:
-                app_result = create_cloudflare_access_application(
-                    full_hostname, f"DockFlare-{full_hostname}", "24h", False, [full_hostname], cf_access_policies, None, False
-                )
+                app_result = None
+                existing_app = find_cloudflare_access_application_by_hostname(full_hostname)
+                if existing_app:
+                    app_result = update_cloudflare_access_application(
+                        existing_app['id'], full_hostname, f"DockFlare-{full_hostname}", "24h", False, [full_hostname], cf_access_policies, None, False
+                    )
+                else:
+                    app_result = create_cloudflare_access_application(
+                        full_hostname, f"DockFlare-{full_hostname}", "24h", False, [full_hostname], cf_access_policies, None, False
+                    )
+
                 if app_result:
                     access_app_id = app_result.get('id')
                     access_policy_type = manual_access_policy_type