Hacktoberfest 2026: as issues que os mantenedores marcaram para outubro, abertas e boas para iniciantes. Ver issues do Hacktoberfest

bug: workspace access hint suggests a --subject command that fails for hyphen-leading OIDC subjects

Aberta Para iniciantes
  • Algo errado?
#4,889 0 comentários 0 reações 0 responsáveis Ver no GitHub

Mantenedores costumam responder em até 1 dia

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
2/5
Tempo estimado
1-3 horas
Facilidade para iniciantes
78/100
Tipo de issue
Bug
Clareza
Claramente especificada
Status de atividade
Ativa
Stack de tecnologia
rust
Domínio
cli

Direção de pesquisa

Comece em crates/openshell-cli/src/main.rs, nos argumentos subject de workspace member add e workspace member remove; depois, leia crates/openshell-server/src/auth/workspace_authz.rs, onde a dica de correção é montada com shell_quote_for_hint. Confira os testes existentes sobre o parsing dos argumentos da CLI e a geração da dica. O trabalho estará concluído quando ambos os comandos aceitarem um subject iniciado por hífen, a dica copiada funcionar e um teste cobrir os dois comportamentos.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

User Story

I use OpenShell with OIDC sign-in and workspaces. When a workspace denied me, I copied the suggested openshell workspace member add command from the error and it failed, because my OIDC subject starts with -. I need the suggested command to work as printed, so a user can grant access without working out clap's argument parsing.

Problem Statement

When a principal lacks workspace access, the gateway's permission-denied message suggests a remediation command (crates/openshell-server/src/auth/workspace_authz.rs, built with shell_quote_for_hint):

openshell workspace member add --workspace '<ws>' --subject '<subject>' --role user

The subject is shell-quoted, but quoting doesn't stop clap from parsing it. OIDC subjects are opaque strings and can start with -. When one does, --subject '-oAbC…' fails with error: unexpected argument '-o' found, because --subject in crates/openshell-cli/src/main.rs (workspace member add and workspace member remove) is a plain #[arg(long)] that doesn't accept hyphen-leading values.

Impact / Why This Matters

  • The copy-paste remediation fails for any user whose subject starts with -, and clap's error points at a flag that doesn't exist, not at the cause.
  • The workaround, --subject=-oAbC…, isn't obvious and isn't mentioned anywhere.

Acceptance Criteria

  • openshell workspace member add --subject '<value starting with ->' … and workspace member remove accept the subject (for example via allow_hyphen_values), or the hint emits --subject=<quoted>.
  • The remediation hint, copied verbatim, succeeds for a subject that starts with -.
  • A test covers a hyphen-leading subject in both the hint and the CLI parsing.

Reproduction Steps

  1. Sign in to an OIDC-enabled gateway as a user whose sub claim starts with -.
  2. Run any command against a workspace you aren't a member of, and copy the suggested openshell workspace member add … --subject '-…' --role user command.
  3. As a workspace admin, run the copied command.
  4. Observe error: unexpected argument '-o' found.

Environment

  • OpenShell: CLI 0.1.5-dev.124+g92434dcb2; gateway 0.1.6-dev.26+g229382e51
  • OS: macOS (arm64)
  • Runtime, deployment, or integration: OIDC authentication with workspaces

Suggested UX (if applicable)

openshell workspace member add --workspace 'my-ws' --subject='-oAbC123…' --role user

Logs

error: unexpected argument '-o' found
Linguagem predominante
Rust
Estrelas
17.1k
Forks
1.8k
Merge médio
2d 9h
PRs com merge (30d)
355

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de NVIDIA/OpenShell

Todas as issues de NVIDIA/OpenShell

Issues semelhantes

Mais issues de Rust

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.