[Bug] A scoped token can end up with no name in the listing used to revoke it

Aperta
  • Qualcosa non va?
#67 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
48/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
go
Ambito
cli, security

Direzione di ricerca

Start by locating the implementations or help definitions for generate-file-system-token, generate-file-system-scoped-token, and list-file-system-tokens. Compare how --token-name and --subject reach the listing's NAME column, then decide on a consistent naming behavior or documented requirement. Re-run the listed commands in text and JSON modes; done means scoped tokens are identifiable and the help explains the required input.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

ti version

0.2.7 (6c950c77a601d0d55394c4b2f64483ae93d522db, 2026-09-27), bundled ti-drive9 companion 60b63d6

Command family

fs

Operating system and architecture

macOS 14.6, darwin/arm64

Summary

The two token commands name a token through different flags, with different requirements, and
both land in the same NAME column. A scoped token created without the optional flag has no
name at all in the listing an operator uses to find the token they want to revoke.

Covers observation 8 from a review of the TiDB Cloud Filesystem documentation.

The difference

generate-file-system-token takes --token-name, described in help as "An operational name
for the token". It is required.

generate-file-system-scoped-token has no --token-name. It has --subject, described in
help as "Optional server-side audit label". It is optional.

Command

ti fs generate-file-system-token --file-system-id "<fs-id>" --token-name owner1 --no-expiration
ti fs generate-file-system-scoped-token --file-system-id "<fs-id>" --ttl 30m --allow "/reports:read,list"
ti fs list-file-system-tokens --file-system-id "<fs-id>" --output text

Reproduction steps

  1. Generate an owner token with --token-name owner1.
  2. Generate a scoped token without passing --subject.
  3. Run ti fs list-file-system-tokens --output text.
  4. Run the same command with --output json.

Expected behavior

Either both commands name a token the same way, or the scoped command's help states that
--subject fills the NAME column, so an operator knows to set it.

Actual behavior

TOKEN_ID                              NAME     SCOPE      STATUS  EXPIRES_AT
c6bdb91f-7b09-4a6d-a01d-dd5e108d927f  default  owner      active  never
aea96970-11bf-44fd-bde7-95d0767d46be           fs_scoped  active  2026-09-28T04:11:11Z
af7bcbce-15a3-4069-94e9-1dfc13aaf2e3  owner1   owner      active  never

The scoped token's NAME column is blank, and token_name is an empty string in the JSON.
The owner token shows its name. An operator looking at the listing has no way to tell which
scoped token is which, which matters because this listing is how you find the token_id to
pass to disable-file-system-token or delete-file-system-token.

Suggested resolution

Either give generate-file-system-scoped-token a --token-name of its own, or document that
--subject doubles as the operational name and recommend setting it.

This one is partly a naming decision rather than a defect, so the docs fix depends on which
way you want it to work.

Sensitive-data confirmation

No API keys, file system or Vault tokens, database credentials, connection strings, SQL, or
customer data appear above. File systems used for these measurements were deleted afterwards.

Lingua principale
Go
Stelle
3
Fork
4
Merge medio
3g 19h
PR unite (30g)
5

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di tidbcloud/ti-cli

Tutte le issue di tidbcloud/ti-cli

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.