[GH-ISSUE #272] Auth: Warn when credentials are mixed from multiple sources #85

New issue

Closed

opened 2026-02-26 21:33:16 +03:00 by kerem · 1 comment

kerem commented

2026-02-26 21:33:16 +03:00

Owner

Originally created by @rudrankriyam on GitHub (Jan 28, 2026).
Original GitHub issue: https://github.com/rudrankriyam/App-Store-Connect-CLI/issues/272

Problem

The current credential resolution logic in cmd/shared.go can silently mix credentials from different sources. For example, if a user has a Key ID stored in the keychain but provides an Issuer ID via environment variable, the CLI will combine them without warning. This can create invalid credential combinations that fail at API call time with confusing errors.

Current behavior:

if actualKeyID == "" { actualKeyID = envCreds.keyID }
if actualIssuerID == "" { actualIssuerID = envCreds.issuerID }
if actualKeyPath == "" { actualKeyPath = envCreds.keyPath }

This silent merging violates the principle of least surprise and makes debugging auth issues difficult.

Affected Code

cmd/shared.go:203-220 - The credential resolution and merging logic
cmd/shared.go:148-200 - The getASCClient function that orchestrates credential loading

Proposed Solution

Track the source of each credential component (keychain, config file, environment variable, command-line flag)
If credentials come from multiple sources, emit a warning to stderr
Consider adding a strict mode (--strict-auth or ASC_STRICT_AUTH=1) that fails instead of warns when mixing occurs

Implementation approach:

type CredentialSource struct {
    KeyID    string // "keychain", "config", "env", "flag"
    IssuerID string
    KeyPath  string
}

func resolveCredentialsWithSource(profile string) (creds Credentials, sources CredentialSource, err error) {
    // ... resolution logic ...
    
    // Check for mixed sources
    if sources.KeyID != sources.IssuerID || sources.IssuerID != sources.KeyPath {
        fmt.Fprintf(os.Stderr, "Warning: credentials loaded from multiple sources:\n")
        fmt.Fprintf(os.Stderr, "  Key ID: %s\n", sources.KeyID)
        fmt.Fprintf(os.Stderr, "  Issuer ID: %s\n", sources.IssuerID)
        fmt.Fprintf(os.Stderr, "  Private Key: %s\n", sources.KeyPath)
    }
    
    return creds, sources, nil
}

Document the credential precedence rules clearly in --help output

Acceptance Criteria

Warning is emitted when credentials come from different sources
Warning includes which source provided each credential component
Add --strict-auth flag or ASC_STRICT_AUTH env var to fail on mixed credentials
Update help text to document credential precedence
Add tests for mixed credential scenarios

Originally created by @rudrankriyam on GitHub (Jan 28, 2026). Original GitHub issue: https://github.com/rudrankriyam/App-Store-Connect-CLI/issues/272 ## Problem The current credential resolution logic in `cmd/shared.go` can silently mix credentials from different sources. For example, if a user has a Key ID stored in the keychain but provides an Issuer ID via environment variable, the CLI will combine them without warning. This can create invalid credential combinations that fail at API call time with confusing errors. Current behavior: ```go if actualKeyID == "" { actualKeyID = envCreds.keyID } if actualIssuerID == "" { actualIssuerID = envCreds.issuerID } if actualKeyPath == "" { actualKeyPath = envCreds.keyPath } ``` This silent merging violates the principle of least surprise and makes debugging auth issues difficult. ## Affected Code - `cmd/shared.go:203-220` - The credential resolution and merging logic - `cmd/shared.go:148-200` - The `getASCClient` function that orchestrates credential loading ## Proposed Solution 1. Track the source of each credential component (keychain, config file, environment variable, command-line flag) 2. If credentials come from multiple sources, emit a warning to stderr 3. Consider adding a strict mode (`--strict-auth` or `ASC_STRICT_AUTH=1`) that fails instead of warns when mixing occurs Implementation approach: ```go type CredentialSource struct { KeyID string // "keychain", "config", "env", "flag" IssuerID string KeyPath string } func resolveCredentialsWithSource(profile string) (creds Credentials, sources CredentialSource, err error) { // ... resolution logic ... // Check for mixed sources if sources.KeyID != sources.IssuerID || sources.IssuerID != sources.KeyPath { fmt.Fprintf(os.Stderr, "Warning: credentials loaded from multiple sources:\n") fmt.Fprintf(os.Stderr, " Key ID: %s\n", sources.KeyID) fmt.Fprintf(os.Stderr, " Issuer ID: %s\n", sources.IssuerID) fmt.Fprintf(os.Stderr, " Private Key: %s\n", sources.KeyPath) } return creds, sources, nil } ``` 4. Document the credential precedence rules clearly in `--help` output ## Acceptance Criteria - Warning is emitted when credentials come from different sources - Warning includes which source provided each credential component - Add `--strict-auth` flag or `ASC_STRICT_AUTH` env var to fail on mixed credentials - Update help text to document credential precedence - Add tests for mixed credential scenarios