Uh oh!
There was an error while loading. Please reload this page.
[CDTOOL-1144] Let profile accept service-limited tokens - #1856
Conversation
When the "fastly profile create" command is run and provided an existing (static) token, and that token is service-limited, the GET /user/:id operation invoked by the CLI to validate the token failed because that endpoint is now unavailable to service-limited tokens. This was a recent behavior change. Fix that by reusing what we already did for the "profile update" command.
A token is now accepted whenever /current_user or /tokens/self responds successfully. In service-limited tokens the email and account ID are empty, so handle that properly.
rcaril
left a comment
There was a problem hiding this comment.
Looks great, great refactor with two minor / optional nits. Please also add a changelog entry :)
(nit): the both-fail test only checks the error message - consider also verifying the token isn't saved to the config when validation fails (e.g. a Validator asserting GetAuthToken(...) is nil)
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
jedisct1
commented
Jul 29, 2026
Done :) |
jedisct1
commented
Jul 29, 2026
ChangeLog entry added. Not sure if that should be in "Enhancements" or "Bug fixes" (since it doesn't really fix a bug in the CLI itself). |
Uh oh!
There was an error while loading. Please reload this page.
rcaril
left a comment
There was a problem hiding this comment.
One suggestion for the changelog, otherwise looks good!
Change summary
fastly profile create,profile updateandauth loginvalidate a static token by looking up the current user, but that endpoint was recently made unavailable to service-limited tokens (a recent change), so these commands failed even with a valid token.Fix that: tokens are now accepted as long as either
/current_useror/tokens/selfsucceeds.All Submissions:
Changes to Core Features:
User Impact
No behavior change for full-access tokens. Profiles created from a service-limited token won't display an email or account ID, but this is expected.
Are there any considerations that need to be addressed for release?
None. No breaking changes, no config format change.