# Tencent SCF Proxy — Dead-End (2026-08-05, retested same day)

Attempted twice to deploy a WeChat API proxy on Tencent Cloud SCF as an alternative
to Deno Deploy (which the user couldn't access via browser).

## What Worked

- **TAT credentials also work for SCF**: The same SecretId/SecretKey used for Lighthouse
  TAT API also authenticates to SCF (`scf.tencentcloudapi.com`).
- **Role creation**: Created `SCF_QcsRole` via CAM API (`CreateRole` with trust policy for
  `scf.qcloud.com`). No error.
- **Zip-based deployment**: Must create a proper zip file with `index.py` inside, then
  base64-encode for `Code.ZipFile`. Plain text (not zipped) causes `ResourceNotFound.Entryfile`.
- **Server can reach deno.com/deno.land**: The server could deploy Deno code via CLI using
  the `deployctl` auth challenge flow (see `references/deno-deploy-proxy.md`).

## What Failed

### 1. HTTP-type function requires `scf_bootstrap`
Creating with `Type: "HTTP"` → `ResourceNotFound.BootstrapFile`. HTTP-triggered SCF
functions need a `scf_bootstrap` entrypoint file. Standard Python3.9 runtime doesn't
automatically set this up.

### 2. Event-type function fails on CLS permissions
Creating with default `Type: "Event"` → `CreateFailed` with:
```
AuthFailure.UnauthorizedOperation: you are not authorized to perform operation
(cls:DescribeLogsets) resource (qc...
```
The account's CAM policy doesn't grant CLS (Cloud Log Service) permissions, which SCF
requires for function logging. Without CLS, the function can't be created.

### 3. CMQ permissions also missing
Secondary error: `BadCmqMsgError — failed to write meta`. SCF uses CMQ internally for
metadata operations.

### 4. Handler must match zip filename
The `Handler` parameter must be `<filename>.<function>`. If the zip contains `index.py`
with function `main_handler`, the handler must be `index.main_handler`. This was correct
in the attempts — the failure was not a handler mismatch.

## Conclusion

**Do not attempt SCF proxy deployment** with the current credentials (`AKIDCPsv...`).
The TAT API role has compute permissions but lacks CLS/CMQ permissions needed for SCF.
Unless the user grants `QcloudCLSFullAccess` and `QcloudCMQFullAccess` in CAM console,
SCF is a dead end. **Use Deno Deploy via CLI auth flow instead** (see `references/deno-deploy-proxy.md`).

## Retry Checklist (if user grants permissions)

1. Verify CLS access: `CreateLogset` via CLS API
2. Verify CMQ access: create a test queue
3. Attach policies: `QcloudSCFFullAccess`, `QcloudCLSFullAccess`, `QcloudCMQFullAccess`
4. Re-run the create function script from `/tmp/create_scf.py`