[Bug] A scoped token can end up with no name in the listing used to revoke it

オープン
  • 何か問題がありますか？
#67 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
48/100
issue の種類
バグ
明瞭さ
おおむね明確
活発さ
活発
技術スタック
go
領域
cli, security

調査の方向性

Start by locating the implementations or help definitions for generate-file-system-token, generate-file-system-scoped-token, and list-file-system-tokens. Compare how --token-name and --subject reach the listing's NAME column, then decide on a consistent naming behavior or documented requirement. Re-run the listed commands in text and JSON modes; done means scoped tokens are identifiable and the help explains the required input.

索引モデルが issue の本文から書いたものです。

説明

ti version

0.2.7 (6c950c77a601d0d55394c4b2f64483ae93d522db, 2026-09-27), bundled ti-drive9 companion 60b63d6

Command family

fs

Operating system and architecture

macOS 14.6, darwin/arm64

Summary

The two token commands name a token through different flags, with different requirements, and
both land in the same NAME column. A scoped token created without the optional flag has no
name at all in the listing an operator uses to find the token they want to revoke.

Covers observation 8 from a review of the TiDB Cloud Filesystem documentation.

The difference

generate-file-system-token takes --token-name, described in help as "An operational name
for the token". It is required.

generate-file-system-scoped-token has no --token-name. It has --subject, described in
help as "Optional server-side audit label". It is optional.

Command

ti fs generate-file-system-token --file-system-id "<fs-id>" --token-name owner1 --no-expiration
ti fs generate-file-system-scoped-token --file-system-id "<fs-id>" --ttl 30m --allow "/reports:read,list"
ti fs list-file-system-tokens --file-system-id "<fs-id>" --output text

Reproduction steps

  1. Generate an owner token with --token-name owner1.
  2. Generate a scoped token without passing --subject.
  3. Run ti fs list-file-system-tokens --output text.
  4. Run the same command with --output json.

Expected behavior

Either both commands name a token the same way, or the scoped command's help states that
--subject fills the NAME column, so an operator knows to set it.

Actual behavior

TOKEN_ID                              NAME     SCOPE      STATUS  EXPIRES_AT
c6bdb91f-7b09-4a6d-a01d-dd5e108d927f  default  owner      active  never
aea96970-11bf-44fd-bde7-95d0767d46be           fs_scoped  active  2026-09-28T04:11:11Z
af7bcbce-15a3-4069-94e9-1dfc13aaf2e3  owner1   owner      active  never

The scoped token's NAME column is blank, and token_name is an empty string in the JSON.
The owner token shows its name. An operator looking at the listing has no way to tell which
scoped token is which, which matters because this listing is how you find the token_id to
pass to disable-file-system-token or delete-file-system-token.

Suggested resolution

Either give generate-file-system-scoped-token a --token-name of its own, or document that
--subject doubles as the operational name and recommend setting it.

This one is partly a naming decision rather than a defect, so the docs fix depends on which
way you want it to work.

Sensitive-data confirmation

No API keys, file system or Vault tokens, database credentials, connection strings, SQL, or
customer data appear above. File systems used for these measurements were deleted afterwards.

主要言語
Go
スター
3
フォーク
4
平均マージ
3日 19時間
マージ済み PR（30日）
5

環境構築

このプロジェクトには開発コンテナ、Dockerfile、コントリビューションガイドがありません。まず README を読み、一般的な手順ははじめてのコントリビューションガイドを参照してください。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

tidbcloud/ti-cli のほかの issue

tidbcloud/ti-cli の issue をすべて見る

似ている issue

Go の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。