From 75a45e1a2ae74b25eadf76195dd4d784be9a49cd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E8=8B=A5=E9=BA=92?= Date: Thu, 16 Jul 2026 10:02:00 +0800 Subject: [PATCH] fix(auth): clear STS credentials on logout --- packages/commands/src/commands/auth/logout.ts | 14 +++-- packages/core/src/auth/store.ts | 11 +--- skills/bailian-cli/reference/auth.md | 8 +-- skills/bailian-cli/reference/config.md | 60 +++++++++++++++++-- skills/bailian-cli/reference/index.md | 24 ++++---- 5 files changed, 83 insertions(+), 34 deletions(-) diff --git a/packages/commands/src/commands/auth/logout.ts b/packages/commands/src/commands/auth/logout.ts index 29430b5..2a598ab 100644 --- a/packages/commands/src/commands/auth/logout.ts +++ b/packages/commands/src/commands/auth/logout.ts @@ -12,7 +12,7 @@ export default defineCommand({ }, openApi: { type: "switch", - description: "Only clear OpenAPI AK/SK credentials, keep other credentials intact", + description: "Only clear OpenAPI AK/SK/STS credentials, keep other credentials intact", }, }, exampleArgs: ["", "--console", "--open-api", "--dry-run"], @@ -46,13 +46,17 @@ export default defineCommand({ if (flags.openApi) { if (settings.dryRun) { if (stored.openapi) - emitBare(`Would clear access_key_id / access_key_secret from ${store.path}`); + emitBare( + `Would clear access_key_id / access_key_secret / security_token from ${store.path}`, + ); else emitBare("No OpenAPI AK/SK credentials to clear."); emitBare("No changes made."); return; } if (await store.logout("openapi")) { - process.stderr.write(`Cleared access_key_id / access_key_secret from ${store.path}\n`); + process.stderr.write( + `Cleared access_key_id / access_key_secret / security_token from ${store.path}\n`, + ); if (stored.apiKey || stored.console) { process.stderr.write( "Other credentials are still configured and will be used for authentication.\n", @@ -69,7 +73,7 @@ export default defineCommand({ if (settings.dryRun) { if (hasKey) emitBare( - `Would clear api_key / access_token / access_key_id / access_key_secret from ${store.path}`, + `Would clear api_key / access_token / access_key_id / access_key_secret / security_token from ${store.path}`, ); else emitBare("No credentials to clear."); emitBare("No changes made."); @@ -78,7 +82,7 @@ export default defineCommand({ if (await store.logout("all")) { process.stderr.write( - `Cleared api_key / access_token / access_key_id / access_key_secret from ${store.path}\n`, + `Cleared api_key / access_token / access_key_id / access_key_secret / security_token from ${store.path}\n`, ); } else { process.stderr.write("No credentials to clear.\n"); diff --git a/packages/core/src/auth/store.ts b/packages/core/src/auth/store.ts index f08f7b7..47f3402 100644 --- a/packages/core/src/auth/store.ts +++ b/packages/core/src/auth/store.ts @@ -7,8 +7,8 @@ import { describeAuthState, resolveModelBaseUrl } from "./resolver.ts"; const LOGOUT_KEYS = { console: ["access_token"], - openapi: ["access_key_id", "access_key_secret"], - all: ["api_key", "access_token", "access_key_id", "access_key_secret"], + openapi: ["access_key_id", "access_key_secret", "security_token"], + all: ["api_key", "access_token", "access_key_id", "access_key_secret", "security_token"], } as const; /** 登录允许落盘的键:凭证本体 + 登录回调携带的连接/作用域字段。 */ @@ -45,8 +45,6 @@ export interface AuthStore { logout(scope: "console" | "openapi" | "all"): Promise; /** 实际写入的 config.json 路径(不受命名配置影响,一直是同一个文件)。 */ path: string; - /** 当前命名配置名(`--config ` 解析后);未指定或 `default` 时为 undefined。 */ - configName?: string; } export function makeAuthStore(sources: ResolutionSources): AuthStore { @@ -58,7 +56,7 @@ export function makeAuthStore(sources: ResolutionSources): AuthStore { return { apiKey: !!file.api_key, console: !!file.access_token, - openapi: !!(file.access_key_id || file.access_key_secret), + openapi: !!(file.access_key_id || file.access_key_secret || file.security_token), baseUrl: file.base_url, }; }, @@ -82,8 +80,5 @@ export function makeAuthStore(sources: ResolutionSources): AuthStore { get path() { return sources.configPath ?? getConfigPath(); }, - get configName() { - return configName; - }, }; } diff --git a/skills/bailian-cli/reference/auth.md b/skills/bailian-cli/reference/auth.md index c6b492e..5002c39 100644 --- a/skills/bailian-cli/reference/auth.md +++ b/skills/bailian-cli/reference/auth.md @@ -86,10 +86,10 @@ bl auth login --open-api --access-key-id LTAIxxxxx --access-key-secret xxxxx #### Flags -| Flag | Type | Required | Description | -| ------------ | ------ | -------- | ------------------------------------------------------------------- | -| `--console` | switch | no | Only clear the console access_token, keep api_key intact | -| `--open-api` | switch | no | Only clear OpenAPI AK/SK credentials, keep other credentials intact | +| Flag | Type | Required | Description | +| ------------ | ------ | -------- | ----------------------------------------------------------------------- | +| `--console` | switch | no | Only clear the console access_token, keep api_key intact | +| `--open-api` | switch | no | Only clear OpenAPI AK/SK/STS credentials, keep other credentials intact | #### Examples diff --git a/skills/bailian-cli/reference/config.md b/skills/bailian-cli/reference/config.md index 29a5139..5078fa7 100644 --- a/skills/bailian-cli/reference/config.md +++ b/skills/bailian-cli/reference/config.md @@ -7,14 +7,38 @@ Index: [index.md](index.md) ## Commands in this group -| Command | Description | -| ---------------- | --------------------------------------------- | -| `bl config set` | Set a config value | -| `bl config show` | Display current configuration | -| `bl config ui` | Open a local web UI to manage config profiles | +| Command | Description | +| ---------------- | ------------------------------------------------ | +| `bl config list` | List config profiles and show the active profile | +| `bl config set` | Set a config value | +| `bl config show` | Display current configuration | +| `bl config ui` | Open a local web UI to manage config profiles | +| `bl config use` | Set the active config profile | ## Command details +### `bl config list` + +| Field | Value | +| --------------- | ------------------------------------------------ | +| **Name** | `config list` | +| **Description** | List config profiles and show the active profile | +| **Usage** | `bl config list` | + +#### Flags + +_No command-specific flags._ + +#### Examples + +```bash +bl config list +``` + +```bash +bl config list --output json +``` + ### `bl config set` | Field | Value | @@ -92,5 +116,29 @@ bl config ui --port 8787 ``` ```bash -bl config ui --config staging --no-open +bl config ui --no-open +``` + +### `bl config use` + +| Field | Value | +| --------------- | ----------------------------- | +| **Name** | `config use` | +| **Description** | Set the active config profile | +| **Usage** | `bl config use --name ` | + +#### Flags + +| Flag | Type | Required | Description | +| --------------- | ------ | -------- | --------------------------------- | +| `--name ` | string | yes | Existing profile name, or default | + +#### Examples + +```bash +bl config use --name token-plan +``` + +```bash +bl config use --name default ``` diff --git a/skills/bailian-cli/reference/index.md b/skills/bailian-cli/reference/index.md index 3326a8d..7ff2968 100644 --- a/skills/bailian-cli/reference/index.md +++ b/skills/bailian-cli/reference/index.md @@ -18,9 +18,11 @@ Use this index for the full quick index and global flags. | `bl auth logout` | Clear stored credentials | [auth.md](auth.md) | | `bl auth status` | Show current authentication state | [auth.md](auth.md) | | `bl bootstrap` | Initialize Bailian workspace and activate postpaid services | [bootstrap.md](bootstrap.md) | +| `bl config list` | List config profiles and show the active profile | [config.md](config.md) | | `bl config set` | Set a config value | [config.md](config.md) | | `bl config show` | Display current configuration | [config.md](config.md) | | `bl config ui` | Open a local web UI to manage config profiles | [config.md](config.md) | +| `bl config use` | Set the active config profile | [config.md](config.md) | | `bl console call` | Call a Bailian console API via the CLI gateway | [console.md](console.md) | | `bl dataset delete` | Delete a dataset file by ID | [dataset.md](dataset.md) | | `bl dataset get` | Get details of a single dataset file | [dataset.md](dataset.md) | @@ -105,7 +107,7 @@ Use this index for the full quick index and global flags. | `app` | `call`, `list` | [app.md](app.md) | | `auth` | `generate-access-token`, `login`, `logout`, `status` | [auth.md](auth.md) | | `bootstrap` | `(root)` | [bootstrap.md](bootstrap.md) | -| `config` | `set`, `show`, `ui` | [config.md](config.md) | +| `config` | `list`, `set`, `show`, `ui`, `use` | [config.md](config.md) | | `console` | `call` | [console.md](console.md) | | `dataset` | `delete`, `get`, `list`, `upload`, `validate` | [dataset.md](dataset.md) | | `deploy` | `audio create`, `delete`, `get`, `image create`, `list`, `models`, `scale`, `text create`, `update` | [deploy.md](deploy.md) | @@ -134,16 +136,16 @@ Use this index for the full quick index and global flags. Available on every command (in addition to command-specific flags): -| Flag | Type | Required | Description | -| --------------------- | ------ | -------- | ----------------------------------- | -| `--output ` | string | no | Output format: text, json | -| `--timeout ` | number | no | Request timeout | -| `--quiet` | switch | no | Suppress non-essential output | -| `--verbose` | switch | no | Print HTTP request/response details | -| `--dry-run` | switch | no | Dry run mode | -| `--config ` | string | no | Use named config credentials | -| `--help` | switch | no | Show help | -| `--version` | switch | no | Print version | +| Flag | Type | Required | Description | +| --------------------- | ------ | -------- | ------------------------------------- | +| `--output ` | string | no | Output format: text, json | +| `--timeout ` | number | no | Request timeout | +| `--quiet` | switch | no | Suppress non-essential output | +| `--verbose` | switch | no | Print HTTP request/response details | +| `--dry-run` | switch | no | Dry run mode | +| `--config ` | string | no | Use a config profile for this command | +| `--help` | switch | no | Show help | +| `--version` | switch | no | Print version | ## Model auth flags