Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions cmd/relayfile-cli/main.go
Original file line number Diff line number Diff line change
Expand Up @@ -9859,6 +9859,15 @@ func loadDelegatedCredentials(path string) (delegatedauth.Bundle, string, error)
}

func loadDelegatedCredentialsForRequest(path, workspaceValue string, scopes []string) (delegatedauth.Bundle, string, error) {
if explicitPath, ok := explicitDelegatedCredentialsPath(path); ok {
return loadDelegatedCredentials(explicitPath)
}
if strings.TrimSpace(workspaceValue) == "" {
legacyBundle, legacyPath, legacyErr := loadDelegatedCredentials(delegatedCredentialsPath())
if legacyErr == nil && delegatedBundleSatisfiesRequestedScopes(legacyBundle, scopes) {
return legacyBundle, legacyPath, nil
}
}
canonicalWorkspaceValue, canonicalWorkspaceOK := canonicalWorkspaceShardValueStatus(workspaceValue)
if !canonicalWorkspaceOK && strings.TrimSpace(workspaceValue) != "" {
fmt.Fprintf(os.Stderr, "warning: delegated credential workspace %q was not uniquely resolved in %s; using raw workspace shard and probing alias shards\n", canonicalWorkspaceValue, workspacesPath())
Expand Down
10 changes: 10 additions & 0 deletions cmd/relayfile-cli/main_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -1278,6 +1278,13 @@ func TestReadPrintsRemoteFileContent(t *testing.T) {
func TestReadUsesTokenWorkspaceWhenWorkspaceArgOmitted(t *testing.T) {
t.Setenv("HOME", t.TempDir())
clearRelayfileEnv(t)
agentRelayLog := filepath.Join(t.TempDir(), "agent-relay.log")
t.Setenv("AGENT_RELAY_LOG", agentRelayLog)
installFakeAgentRelay(t, `
printf '%s\n' "$*" >> "$AGENT_RELAY_LOG"
echo "unexpected agent-relay call: $*" >&2
exit 2
`)

token := testJWTWithWorkspace("ws_token")
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
Expand Down Expand Up @@ -1306,6 +1313,9 @@ func TestReadUsesTokenWorkspaceWhenWorkspaceArgOmitted(t *testing.T) {
if got := stdout.String(); got != "ok\n" {
t.Fatalf("unexpected file content: %q", got)
}
if _, err := os.Stat(agentRelayLog); !errors.Is(err, os.ErrNotExist) {
t.Fatalf("read with a token workspace unexpectedly called agent-relay: %v", err)
}
}

func TestReadDecodesBase64Content(t *testing.T) {
Expand Down
Loading