fix(sdk): allow account-scoped tokens in Cloudflare connection test (#10731)

Co-authored-by: Andoni Alonso <14891798+andoniaf@users.noreply.github.com>

prowler/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to the **Prowler SDK** are documented in this file.
 
+## [5.24.1] (Prowler UNRELEASED)
+
+### 🐞 Fixed
+
+- Cloudflare account-scoped API tokens failing connection test in the App with `CloudflareUserTokenRequiredError` [(#10723)](https://github.com/prowler-cloud/prowler/pull/10723)
+
+---
+
 ## [5.24.0] (Prowler v5.24.0)
 
 ### 🚀 Added

prowler/providers/cloudflare/cloudflare_provider.py

@@ -332,19 +332,16 @@ class CloudflareProvider(Provider):
             return
         except PermissionDeniedError as error:
             error_str = str(error)
-            # Check for user-level authentication required (code 9109)
-            if "9109" in error_str:
-                logger.error(f"CloudflareUserTokenRequiredError: {error}")
-                raise CloudflareUserTokenRequiredError(
-                    file=os.path.basename(__file__),
-                )
             # Check for invalid API key or email (code 9103) - comes as 403
             if "9103" in error_str or "Unknown X-Auth-Key" in error_str:
                 logger.error(f"CloudflareInvalidAPIKeyError: {error}")
                 raise CloudflareInvalidAPIKeyError(
                     file=os.path.basename(__file__),
                 )
-            # For other permission errors, try accounts.list() as fallback
+            # For permission errors (including 9109 account-scoped tokens),
+            # try accounts.list() as fallback before failing.
+            # Error 9109 means the token is account-scoped, not user-level,
+            # which is valid for scanning — only fail if accounts.list() also fails.
             logger.warning(
                 f"Unable to retrieve Cloudflare user info: {error}. "
                 "Trying accounts.list() as fallback."