Skip to content

Commit 75a45e1

Browse files
XXPermanentXXXXPermanentXX
committed
fix(auth): clear STS credentials on logout
1 parent 64ff057 commit 75a45e1

5 files changed

Lines changed: 83 additions & 34 deletions

File tree

‎packages/commands/src/commands/auth/logout.ts‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ export default defineCommand({
1212
},
1313
openApi: {
1414
type: "switch",
15-
description: "Only clear OpenAPI AK/SK credentials, keep other credentials intact",
15+
description: "Only clear OpenAPI AK/SK/STS credentials, keep other credentials intact",
1616
},
1717
},
1818
exampleArgs: ["", "--console", "--open-api", "--dry-run"],
@@ -46,13 +46,17 @@ export default defineCommand({
4646
if (flags.openApi) {
4747
if (settings.dryRun) {
4848
if (stored.openapi)
49-
emitBare(`Would clear access_key_id / access_key_secret from ${store.path}`);
49+
emitBare(
50+
`Would clear access_key_id / access_key_secret / security_token from ${store.path}`,
51+
);
5052
else emitBare("No OpenAPI AK/SK credentials to clear.");
5153
emitBare("No changes made.");
5254
return;
5355
}
5456
if (await store.logout("openapi")) {
55-
process.stderr.write(`Cleared access_key_id / access_key_secret from ${store.path}\n`);
57+
process.stderr.write(
58+
`Cleared access_key_id / access_key_secret / security_token from ${store.path}\n`,
59+
);
5660
if (stored.apiKey || stored.console) {
5761
process.stderr.write(
5862
"Other credentials are still configured and will be used for authentication.\n",
@@ -69,7 +73,7 @@ export default defineCommand({
6973
if (settings.dryRun) {
7074
if (hasKey)
7175
emitBare(
72-
`Would clear api_key / access_token / access_key_id / access_key_secret from ${store.path}`,
76+
`Would clear api_key / access_token / access_key_id / access_key_secret / security_token from ${store.path}`,
7377
);
7478
else emitBare("No credentials to clear.");
7579
emitBare("No changes made.");
@@ -78,7 +82,7 @@ export default defineCommand({
7882

7983
if (await store.logout("all")) {
8084
process.stderr.write(
81-
`Cleared api_key / access_token / access_key_id / access_key_secret from ${store.path}\n`,
85+
`Cleared api_key / access_token / access_key_id / access_key_secret / security_token from ${store.path}\n`,
8286
);
8387
} else {
8488
process.stderr.write("No credentials to clear.\n");

‎packages/core/src/auth/store.ts‎

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@ import { describeAuthState, resolveModelBaseUrl } from "./resolver.ts";
77

88
const LOGOUT_KEYS = {
99
console: ["access_token"],
10-
openapi: ["access_key_id", "access_key_secret"],
11-
all: ["api_key", "access_token", "access_key_id", "access_key_secret"],
10+
openapi: ["access_key_id", "access_key_secret", "security_token"],
11+
all: ["api_key", "access_token", "access_key_id", "access_key_secret", "security_token"],
1212
} as const;
1313

1414
/** 登录允许落盘的键:凭证本体 + 登录回调携带的连接/作用域字段。 */
@@ -45,8 +45,6 @@ export interface AuthStore {
4545
logout(scope: "console" | "openapi" | "all"): Promise<boolean>;
4646
/** 实际写入的 config.json 路径(不受命名配置影响,一直是同一个文件)。 */
4747
path: string;
48-
/** 当前命名配置名(`--config <name>` 解析后);未指定或 `default` 时为 undefined。 */
49-
configName?: string;
5048
}
5149

5250
export function makeAuthStore(sources: ResolutionSources): AuthStore {
@@ -58,7 +56,7 @@ export function makeAuthStore(sources: ResolutionSources): AuthStore {
5856
return {
5957
apiKey: !!file.api_key,
6058
console: !!file.access_token,
61-
openapi: !!(file.access_key_id || file.access_key_secret),
59+
openapi: !!(file.access_key_id || file.access_key_secret || file.security_token),
6260
baseUrl: file.base_url,
6361
};
6462
},
@@ -82,8 +80,5 @@ export function makeAuthStore(sources: ResolutionSources): AuthStore {
8280
get path() {
8381
return sources.configPath ?? getConfigPath();
8482
},
85-
get configName() {
86-
return configName;
87-
},
8883
};
8984
}

‎skills/bailian-cli/reference/auth.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -86,10 +86,10 @@ bl auth login --open-api --access-key-id LTAIxxxxx --access-key-secret xxxxx
8686

8787
#### Flags
8888

89-
| Flag | Type | Required | Description |
90-
| ------------ | ------ | -------- | ------------------------------------------------------------------- |
91-
| `--console` | switch | no | Only clear the console access_token, keep api_key intact |
92-
| `--open-api` | switch | no | Only clear OpenAPI AK/SK credentials, keep other credentials intact |
89+
| Flag | Type | Required | Description |
90+
| ------------ | ------ | -------- | ----------------------------------------------------------------------- |
91+
| `--console` | switch | no | Only clear the console access_token, keep api_key intact |
92+
| `--open-api` | switch | no | Only clear OpenAPI AK/SK/STS credentials, keep other credentials intact |
9393

9494
#### Examples
9595

‎skills/bailian-cli/reference/config.md‎

Lines changed: 54 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7,14 +7,38 @@ Index: [index.md](index.md)
77

88
## Commands in this group
99

10-
| Command | Description |
11-
| ---------------- | --------------------------------------------- |
12-
| `bl config set` | Set a config value |
13-
| `bl config show` | Display current configuration |
14-
| `bl config ui` | Open a local web UI to manage config profiles |
10+
| Command | Description |
11+
| ---------------- | ------------------------------------------------ |
12+
| `bl config list` | List config profiles and show the active profile |
13+
| `bl config set` | Set a config value |
14+
| `bl config show` | Display current configuration |
15+
| `bl config ui` | Open a local web UI to manage config profiles |
16+
| `bl config use` | Set the active config profile |
1517

1618
## Command details
1719

20+
### `bl config list`
21+
22+
| Field | Value |
23+
| --------------- | ------------------------------------------------ |
24+
| **Name** | `config list` |
25+
| **Description** | List config profiles and show the active profile |
26+
| **Usage** | `bl config list` |
27+
28+
#### Flags
29+
30+
_No command-specific flags._
31+
32+
#### Examples
33+
34+
```bash
35+
bl config list
36+
```
37+
38+
```bash
39+
bl config list --output json
40+
```
41+
1842
### `bl config set`
1943

2044
| Field | Value |
@@ -92,5 +116,29 @@ bl config ui --port 8787
92116
```
93117

94118
```bash
95-
bl config ui --config staging --no-open
119+
bl config ui --no-open
120+
```
121+
122+
### `bl config use`
123+
124+
| Field | Value |
125+
| --------------- | ----------------------------- |
126+
| **Name** | `config use` |
127+
| **Description** | Set the active config profile |
128+
| **Usage** | `bl config use --name <name>` |
129+
130+
#### Flags
131+
132+
| Flag | Type | Required | Description |
133+
| --------------- | ------ | -------- | --------------------------------- |
134+
| `--name <name>` | string | yes | Existing profile name, or default |
135+
136+
#### Examples
137+
138+
```bash
139+
bl config use --name token-plan
140+
```
141+
142+
```bash
143+
bl config use --name default
96144
```

‎skills/bailian-cli/reference/index.md‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,11 @@ Use this index for the full quick index and global flags.
1818
| `bl auth logout` | Clear stored credentials | [auth.md](auth.md) |
1919
| `bl auth status` | Show current authentication state | [auth.md](auth.md) |
2020
| `bl bootstrap` | Initialize Bailian workspace and activate postpaid services | [bootstrap.md](bootstrap.md) |
21+
| `bl config list` | List config profiles and show the active profile | [config.md](config.md) |
2122
| `bl config set` | Set a config value | [config.md](config.md) |
2223
| `bl config show` | Display current configuration | [config.md](config.md) |
2324
| `bl config ui` | Open a local web UI to manage config profiles | [config.md](config.md) |
25+
| `bl config use` | Set the active config profile | [config.md](config.md) |
2426
| `bl console call` | Call a Bailian console API via the CLI gateway | [console.md](console.md) |
2527
| `bl dataset delete` | Delete a dataset file by ID | [dataset.md](dataset.md) |
2628
| `bl dataset get` | Get details of a single dataset file | [dataset.md](dataset.md) |
@@ -105,7 +107,7 @@ Use this index for the full quick index and global flags.
105107
| `app` | `call`, `list` | [app.md](app.md) |
106108
| `auth` | `generate-access-token`, `login`, `logout`, `status` | [auth.md](auth.md) |
107109
| `bootstrap` | `(root)` | [bootstrap.md](bootstrap.md) |
108-
| `config` | `set`, `show`, `ui` | [config.md](config.md) |
110+
| `config` | `list`, `set`, `show`, `ui`, `use` | [config.md](config.md) |
109111
| `console` | `call` | [console.md](console.md) |
110112
| `dataset` | `delete`, `get`, `list`, `upload`, `validate` | [dataset.md](dataset.md) |
111113
| `deploy` | `audio create`, `delete`, `get`, `image create`, `list`, `models`, `scale`, `text create`, `update` | [deploy.md](deploy.md) |
@@ -134,16 +136,16 @@ Use this index for the full quick index and global flags.
134136

135137
Available on every command (in addition to command-specific flags):
136138

137-
| Flag | Type | Required | Description |
138-
| --------------------- | ------ | -------- | ----------------------------------- |
139-
| `--output <format>` | string | no | Output format: text, json |
140-
| `--timeout <seconds>` | number | no | Request timeout |
141-
| `--quiet` | switch | no | Suppress non-essential output |
142-
| `--verbose` | switch | no | Print HTTP request/response details |
143-
| `--dry-run` | switch | no | Dry run mode |
144-
| `--config <name>` | string | no | Use named config credentials |
145-
| `--help` | switch | no | Show help |
146-
| `--version` | switch | no | Print version |
139+
| Flag | Type | Required | Description |
140+
| --------------------- | ------ | -------- | ------------------------------------- |
141+
| `--output <format>` | string | no | Output format: text, json |
142+
| `--timeout <seconds>` | number | no | Request timeout |
143+
| `--quiet` | switch | no | Suppress non-essential output |
144+
| `--verbose` | switch | no | Print HTTP request/response details |
145+
| `--dry-run` | switch | no | Dry run mode |
146+
| `--config <name>` | string | no | Use a config profile for this command |
147+
| `--help` | switch | no | Show help |
148+
| `--version` | switch | no | Print version |
147149

148150
## Model auth flags
149151

0 commit comments

Comments
 (0)