miki3421 opened a new pull request, #42: URL: https://github.com/apache/openserverless-cli/pull/42
## Summary - keep the backend-managed OIDC device request namespace-free unless the user supplies the positional workspace explicitly - give explicit command-line workspace input precedence over `OPS_USER` and `OPSDEV_USERNAME` values reloaded from `config.json` - preserve workspace binding when an explicit positional user is supplied - accept empty configuration assignments such as `OPSDEV_USERNAME=` as documented by `ops -config` ## Root cause `setAllConfigEnvVars()` reloads persisted IDE values before `LoginCmd()` runs. The old `OPSDEV_USERNAME=nuvolaris` fallback was therefore passed as `namespace` to `/system/api/v1/auth/oidc/device/start`, even when the current device login did not request a workspace. A successful Keycloak login for `michelem` was then correctly rejected by admin-api because it did not match the stale requested namespace. The admin-api namespace mismatch check is unchanged. This PR only distinguishes an explicit workspace request from persisted local fallback state. ## Validation - `go test ./...` - `go test ./auth ./config` - `task itest T=config F="--formatter tap"` (13/13) - regression coverage verifies that stale `OPS_USER`/`OPSDEV_USERNAME` are absent from device start and poll payloads - regression coverage verifies that an explicit positional workspace remains present in both payloads - `git diff --check` ## Follow-up The companion `apache/openserverless-task:0.9.1` PR updates `ops ide login` so an explicit `<username>` is forwarded positionally while the implicit device flow forwards no workspace. A new dev release must be tagged from Apache `main` only after these PRs are reviewed and merged. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
