From b770362af467cc4eba921a6dbb8ff6d7cbedeaa7 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 23 Jul 2026 13:56:21 +0000 Subject: [PATCH 1/2] Omit OAuth client credentials from auth help text pscale auth login/logout/check --help was printing the built-in client-id and client-secret defaults, which agents often scrape into cloud context. Keep the flags, but resolve the built-in values only at runtime when the flags are unset. Co-authored-by: Mike Coutermarsh --- internal/cmd/auth/check.go | 5 +- internal/cmd/auth/login.go | 4 +- internal/cmd/auth/logout.go | 4 +- internal/cmd/auth/oauth_flags.go | 26 ++++++++++ internal/cmd/auth/oauth_flags_test.go | 69 +++++++++++++++++++++++++++ 5 files changed, 101 insertions(+), 7 deletions(-) create mode 100644 internal/cmd/auth/oauth_flags.go create mode 100644 internal/cmd/auth/oauth_flags_test.go diff --git a/internal/cmd/auth/check.go b/internal/cmd/auth/check.go index 75825adb5..7454e65f7 100644 --- a/internal/cmd/auth/check.go +++ b/internal/cmd/auth/check.go @@ -1,7 +1,6 @@ package auth import ( - psauth "github.com/planetscale/cli/internal/auth" "github.com/planetscale/cli/internal/cmdutil" "github.com/planetscale/cli/internal/printer" @@ -49,7 +48,7 @@ func CheckCmd(ch *cmdutil.Helper) *cobra.Command { }, } - cmd.Flags().StringVar(&clientID, "client-id", psauth.OAuthClientID, "The client ID for the PlanetScale CLI application.") - cmd.Flags().StringVar(&clientSecret, "client-secret", psauth.OAuthClientSecret, "The client ID for the PlanetScale CLI application") + // Kept for flag compatibility; auth check does not use OAuth client credentials. + addOAuthClientFlags(cmd, &clientID, &clientSecret) return cmd } diff --git a/internal/cmd/auth/login.go b/internal/cmd/auth/login.go index 9e565342b..b3d64036b 100644 --- a/internal/cmd/auth/login.go +++ b/internal/cmd/auth/login.go @@ -33,6 +33,7 @@ func LoginCmd(ch *cmdutil.Helper) *cobra.Command { return errors.New("the 'login' command requires an interactive shell (use --format json; browser opens when possible, then polls until approved)") } + clientID, clientSecret = resolveOAuthClient(clientID, clientSecret) authenticator, err := psauth.New(cleanhttp.DefaultClient(), clientID, clientSecret, psauth.SetBaseURL(authURL)) if err != nil { if jsonMode { @@ -126,8 +127,7 @@ func LoginCmd(ch *cmdutil.Helper) *cobra.Command { }, } - cmd.Flags().StringVar(&clientID, "client-id", psauth.OAuthClientID, "The client ID for the PlanetScale CLI application.") - cmd.Flags().StringVar(&clientSecret, "client-secret", psauth.OAuthClientSecret, "The client ID for the PlanetScale CLI application") + addOAuthClientFlags(cmd, &clientID, &clientSecret) cmd.Flags().StringVar(&authURL, "api-url", psauth.DefaultBaseURL, "The PlanetScale Auth API base URL.") return cmd diff --git a/internal/cmd/auth/logout.go b/internal/cmd/auth/logout.go index aa7ca776f..e333b0f87 100644 --- a/internal/cmd/auth/logout.go +++ b/internal/cmd/auth/logout.go @@ -33,6 +33,7 @@ func LogoutCmd(ch *cmdutil.Helper) *cobra.Command { _ = waitForEnter(cmd.InOrStdin()) } + clientID, clientSecret = resolveOAuthClient(clientID, clientSecret) authenticator, err := auth.New(cleanhttp.DefaultClient(), clientID, clientSecret, auth.SetBaseURL(apiURL)) if err != nil { return err @@ -56,8 +57,7 @@ func LogoutCmd(ch *cmdutil.Helper) *cobra.Command { }, } - cmd.Flags().StringVar(&clientID, "client-id", auth.OAuthClientID, "The client ID for the PlanetScale CLI application.") - cmd.Flags().StringVar(&clientSecret, "client-secret", auth.OAuthClientSecret, "The client ID for the PlanetScale CLI application") + addOAuthClientFlags(cmd, &clientID, &clientSecret) cmd.Flags().StringVar(&apiURL, "api-url", auth.DefaultBaseURL, "The PlanetScale base API URL.") return cmd } diff --git a/internal/cmd/auth/oauth_flags.go b/internal/cmd/auth/oauth_flags.go new file mode 100644 index 000000000..7dd128e6c --- /dev/null +++ b/internal/cmd/auth/oauth_flags.go @@ -0,0 +1,26 @@ +package auth + +import ( + psauth "github.com/planetscale/cli/internal/auth" + + "github.com/spf13/cobra" +) + +// addOAuthClientFlags registers --client-id and --client-secret without exposing +// the built-in OAuth credentials as help-text defaults. +func addOAuthClientFlags(cmd *cobra.Command, clientID, clientSecret *string) { + cmd.Flags().StringVar(clientID, "client-id", "", "The client ID for the PlanetScale CLI application.") + cmd.Flags().StringVar(clientSecret, "client-secret", "", "The client secret for the PlanetScale CLI application.") +} + +// resolveOAuthClient returns the flag values, falling back to the built-in +// PlanetScale CLI OAuth application credentials when unset. +func resolveOAuthClient(clientID, clientSecret string) (string, string) { + if clientID == "" { + clientID = psauth.OAuthClientID + } + if clientSecret == "" { + clientSecret = psauth.OAuthClientSecret + } + return clientID, clientSecret +} diff --git a/internal/cmd/auth/oauth_flags_test.go b/internal/cmd/auth/oauth_flags_test.go new file mode 100644 index 000000000..112f33f56 --- /dev/null +++ b/internal/cmd/auth/oauth_flags_test.go @@ -0,0 +1,69 @@ +package auth + +import ( + "bytes" + "strings" + "testing" + + psauth "github.com/planetscale/cli/internal/auth" + "github.com/planetscale/cli/internal/cmdutil" + "github.com/spf13/cobra" +) + +func TestAuthLoginHelpOmitsOAuthSecrets(t *testing.T) { + assertHelpOmitsOAuthSecrets(t, LoginCmd(&cmdutil.Helper{})) +} + +func TestAuthLogoutHelpOmitsOAuthSecrets(t *testing.T) { + assertHelpOmitsOAuthSecrets(t, LogoutCmd(&cmdutil.Helper{})) +} + +func TestAuthCheckHelpOmitsOAuthSecrets(t *testing.T) { + assertHelpOmitsOAuthSecrets(t, CheckCmd(&cmdutil.Helper{})) +} + +func assertHelpOmitsOAuthSecrets(t *testing.T, cmd *cobra.Command) { + t.Helper() + + var out bytes.Buffer + cmd.SetOut(&out) + cmd.SetErr(&out) + cmd.SetArgs([]string{"--help"}) + if err := cmd.Execute(); err != nil { + t.Fatalf("help: %v", err) + } + + help := out.String() + if strings.Contains(help, psauth.OAuthClientID) { + t.Fatalf("help text must not include OAuth client ID; got:\n%s", help) + } + if strings.Contains(help, psauth.OAuthClientSecret) { + t.Fatalf("help text must not include OAuth client secret; got:\n%s", help) + } + if !strings.Contains(help, "--client-id") { + t.Fatalf("help text should still document --client-id; got:\n%s", help) + } + if !strings.Contains(help, "--client-secret") { + t.Fatalf("help text should still document --client-secret; got:\n%s", help) + } +} + +func TestResolveOAuthClientDefaults(t *testing.T) { + id, secret := resolveOAuthClient("", "") + if id != psauth.OAuthClientID { + t.Fatalf("client ID = %q, want built-in default", id) + } + if secret != psauth.OAuthClientSecret { + t.Fatalf("client secret = %q, want built-in default", secret) + } +} + +func TestResolveOAuthClientOverrides(t *testing.T) { + id, secret := resolveOAuthClient("custom-id", "custom-secret") + if id != "custom-id" { + t.Fatalf("client ID = %q, want custom-id", id) + } + if secret != "custom-secret" { + t.Fatalf("client secret = %q, want custom-secret", secret) + } +} From 6f7cdf3ec0d4c8ffb7969422b6b1e2528ed11cba Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 23 Jul 2026 13:59:31 +0000 Subject: [PATCH 2/2] Remove unused OAuth client flags from auth check auth check never used --client-id or --client-secret; drop them instead of registering empty placeholders. Co-authored-by: Mike Coutermarsh --- internal/cmd/auth/check.go | 5 ----- internal/cmd/auth/oauth_flags_test.go | 10 ++++++++-- 2 files changed, 8 insertions(+), 7 deletions(-) diff --git a/internal/cmd/auth/check.go b/internal/cmd/auth/check.go index 7454e65f7..323138c60 100644 --- a/internal/cmd/auth/check.go +++ b/internal/cmd/auth/check.go @@ -8,9 +8,6 @@ import ( ) func CheckCmd(ch *cmdutil.Helper) *cobra.Command { - var clientID string - var clientSecret string - cmd := &cobra.Command{ Use: "check", Args: cobra.NoArgs, @@ -48,7 +45,5 @@ func CheckCmd(ch *cmdutil.Helper) *cobra.Command { }, } - // Kept for flag compatibility; auth check does not use OAuth client credentials. - addOAuthClientFlags(cmd, &clientID, &clientSecret) return cmd } diff --git a/internal/cmd/auth/oauth_flags_test.go b/internal/cmd/auth/oauth_flags_test.go index 112f33f56..66a2322b8 100644 --- a/internal/cmd/auth/oauth_flags_test.go +++ b/internal/cmd/auth/oauth_flags_test.go @@ -18,8 +18,14 @@ func TestAuthLogoutHelpOmitsOAuthSecrets(t *testing.T) { assertHelpOmitsOAuthSecrets(t, LogoutCmd(&cmdutil.Helper{})) } -func TestAuthCheckHelpOmitsOAuthSecrets(t *testing.T) { - assertHelpOmitsOAuthSecrets(t, CheckCmd(&cmdutil.Helper{})) +func TestAuthCheckHasNoOAuthClientFlags(t *testing.T) { + cmd := CheckCmd(&cmdutil.Helper{}) + if cmd.Flags().Lookup("client-id") != nil { + t.Fatal("auth check must not define --client-id") + } + if cmd.Flags().Lookup("client-secret") != nil { + t.Fatal("auth check must not define --client-secret") + } } func assertHelpOmitsOAuthSecrets(t *testing.T, cmd *cobra.Command) {