Skip to content

bug: context --delete leaves stale auth tokens for named contexts #427

@cotishq

Description

@cotishq

Describe the bug

When deleting a context with microcks context <name> --delete, the CLI removes the context and server entries but does not remove the associated user credentials when the context was created with a custom name via login --name.

login stores users under the server URL (users[].name), while contexts use the context name (contexts[].name) and reference the user through contexts[].user.

However, deleteContext calls RemoveUser(context) using the context name. For a named context like dev, the actual user entry is keyed by http://localhost:8080, so cleanup silently fails.

This can leave OAuth tokens and related auth records in ~/.config/microcks/config even after the user is told Context 'dev' deleted.

Expected behavior

After microcks context dev --delete:

  • The dev context entry is removed from contexts
  • The related servers, users auth-token / refresh-token, and auths entries for that Microcks instance are removed
  • No OAuth tokens or Keycloak client credentials remain on disk for that deleted context

Actual behavior

After deleting a named context:

  • The contexts entry is removed
  • The related servers entry is removed
  • The related users entry remains, including auth-token and refresh-token
  • The CLI prints Context 'dev' deleted with no warning that credentials were left behind

How to Reproduce?

Reproducer:

  1. Create a temporary config:
mkdir -p /tmp/microcks-cli-verify

cat > /tmp/microcks-cli-verify/config <<'EOF'
current-context: staging
contexts:
  - name: dev
    server: http://localhost:8080
    user: http://localhost:8080
    instance: ""
  - name: staging
    server: http://localhost:8083
    user: http://localhost:8083
    instance: ""
servers:
  - server: http://localhost:8080
    insecureTLS: true
    keycloakEnable: true
  - server: http://localhost:8083
    insecureTLS: true
    keycloakEnable: true
users:
  - name: http://localhost:8080
    auth-token: LEAKED-TOKEN
    refresh-token: LEAKED-REFRESH
  - name: http://localhost:8083
    auth-token: ""
    refresh-token: ""
auths:
  - server: http://localhost:8080
    clientId: my-client
    clientSecret: my-secret
EOF

chmod 600 /tmp/microcks-cli-verify/config
  1. Delete the named context:
./build/dist/microcks context dev --delete --config /tmp/microcks-cli-verify/config
  1. Inspect the config:
cat /tmp/microcks-cli-verify/config
Image

Microcks version or git rev

Microcks-CLI 1.0.2

Install method (docker-compose, helm chart, operator, docker-desktop extension,...)

No response

Additional information

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions