TPT-4175: cli: Update interactive config token access check#881
TPT-4175: cli: Update interactive config token access check#881mgwoj wants to merge 2 commits intolinode:devfrom
Conversation
mgwoj
added
the
improvement
mgwoj
requested review from
ckulinsk and
yec-akamai
and removed request for
a team
There was a problem hiding this comment.
Pull request overview
This PR updates the CLI’s token “full access” check used during interactive configuration to avoid failing hard when /profile/grants is inaccessible (notably for IAM-enrolled users).
Changes:
- Update
_check_full_accessto treat HTTP 403 from/profile/grantsas a non-fatal response and interpret it as “not full access”. - Add unit tests covering
_check_full_accessbehavior for 204/200/403 responses.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
linodecli/configuration/auth.py |
Adjusts response handling for /profile/grants to allow 403 without exiting. |
tests/unit/test_configuration.py |
Adds unit tests verifying _check_full_access return values for key status codes. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # IAM-enrolled users receive a 403 from /profile/grants since that | ||
| # endpoint is not accessible to them. Treat 403 as a valid response | ||
| # (i.e. not full access) rather than a fatal error. | ||
| _handle_response_status( | ||
| result, | ||
| exit_on_error=True, | ||
| status_validator=lambda status: status == 403, | ||
| ) |
There was a problem hiding this comment.
Treating a 403 from /profile/grants as a non-fatal response makes _check_full_access return False for IAM-enrolled users. In CLIConfig.configure() this value gates the /account/users lookup, so IAM users will never be offered authorized_users selection even if they otherwise have the needed account permissions. If the intent is to still support configuring authorized users for IAM tokens, consider falling back to a different capability check (e.g. attempt /account/users with a status_validator for 401/403) or decouple the authorized-users prompt from _check_full_access when the grants endpoint is inaccessible.
There was a problem hiding this comment.
@jriddle-linode Thoughts on this? I can't seem to reproduce the issue that requires this change but I might not be properly enrolled in IAM
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
📝 Description
AM Users wont have access to /profile/grants so we need to come up with a new way to check the access level of an account so it can add auth users.
✔️ How to Test