fix: reject project list/use for CI-scoped keys with clear errors - #308
leggetter merged 4 commits into
Conversation
Sorry, something went wrong.
Validate credentials before cross-project commands, omit X-Team-ID on ListProjects, improve login and MCP flows for single-project CI keys, and strip legacy workspace/team keys on profile save. Co-Authored-By: Claude <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>
ReviewSolid change, well-tested (unit + MCP + acceptance), and the fix lands at a reasonable depth — client-side ValidateAPIKey guards plus stripping X-Team-ID/X-Project-ID from ListProjects so a stale project_id can't scope GET /teams. Findings below are minor; nothing is a correctness blocker. 1. pkg/gateway/mcp/tool_login.go:125 — "scoped to one project" prefix is also shown for invalid/expired keysIn the if client.APIKey != "" block, an unauthorized (revoked/expired) key satisfies neither early-return condition (err != nil && !IsUnauthorizedError(err) is false; err == nil && !lacks_user is false), so it falls through with client.APIKey still set. loginPrefix then unconditionally sets "Current credentials are scoped to one project; opening browser sign-in for full access." — so a user whose key was revoked is incorrectly told it's "scoped to one project." Consider gating the prefix on the CI case (lacks_user == true) rather than just client.APIKey != "". 2. pkg/cmd/project_list.go — network round-trip runs before offline --type validationEnsureUserAssociatedCredentials (an HTTP validate call) is inserted before the --type flag-value check. project list --type nonsense now incurs a network/auth call and can fail on auth before reporting the local flag error. Minor; cheap offline validation reads better placed first. 3. Extra validate round-trip per call (intended trade-off)project list/use and MCP projectsList/projectsUse now issue a ValidateAPIKey in addition to ListProjects, and hookdeck_login's already-authenticated fast path always makes an HTTP call where it previously returned instantly. Inherent to detecting CI keys client-side, so acceptable — noting it as a conscious choice. Notes (non-blocking): lacks_user is snake_case but consistent with existing locals in pkg/ (no linter config in repo); removeLegacyConfigKeys rebuilding viper via removeKey on every SaveProfile checks out (config path restored, managed keys preserved, existing-file perms not downgraded — mirrors RemoveProfile); ValidateCredentials is exported but only used internally. #1 is the one I'd most want addressed before merge. Generated by Claude Code |
Sorry, something went wrong.
Only show CI-scoped login prefix when validate confirms no user_id; validate --type before the credentials check so invalid flags fail offline (fixes CI). Co-Authored-By: Claude <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>
Rebalance CI matrix runtimes (~5.3 min slice 0 vs ~3 min slice 2). Move ConnectionListResponse to helpers so gateway tests compile without connection_list in the same build. Co-Authored-By: Claude <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>
Rename ErrProjectScopedCredentials (ErrCIScopedCredentials alias), update messages for single-project scope, and match CLI_PROJECT_SCOPED from API. Co-Authored-By: Claude <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>
Merge hookdeck-cli #308 (EnsureUserAssociatedCredentials, CI login UX, ListProjects header fix) while preserving guest claim flow on login. Co-Authored-By: Claude <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>
…ixes Bring #308 handling into simplify guest flow: CI keys fail fast on project list/use, login rejects headless CI keys, keep waitForGuestUpgrade for active guest profiles. Co-Authored-By: Claude <noreply@anthropic.com> Co-authored-by: Cursor <cursoragent@cursor.com>
Summary
Context
hookdeck project list requires a user-associated CLI key. Keys created by hookdeck ci are scoped to one project and previously caused an opaque API 500 on GET /teams. This PR adds client-side guards with actionable messages and aligns login/MCP behavior so users can upgrade to a full session.
Pairs with the companion API PR in hookdeck/core (CLI_USER_REQUIRED on GET /teams).
Test plan
Made with Cursor