Skip to content

fix: fail fast on empty api key and profile inputs instead of falling back#346

Draft
bukinoshita wants to merge 1 commit into
mainfrom
fix/empty-auth-input-fallback-bc43
Draft

fix: fail fast on empty api key and profile inputs instead of falling back#346
bukinoshita wants to merge 1 commit into
mainfrom
fix/empty-auth-input-fallback-bc43

Conversation

@bukinoshita

@bukinoshita bukinoshita commented Jul 13, 2026

Copy link
Copy Markdown
Member

Summary by cubic

Reject empty --api-key, --profile, RESEND_API_KEY, and RESEND_PROFILE to prevent silent fallback to other credentials and accidental account usage. logout --profile "" now errors instead of removing all profiles. Addresses BU-2298.

  • Bug Fixes
    • Added requireNonEmpty to error on empty inputs and ignore undefined.
    • Enforced in resolveProfileName, resolveApiKey, and resolveAuthentication; client/whoami now use !== undefined/?? instead of truthiness.
    • logout: empty --profile is an error; only logs out all when no profile is provided.
    • Empty inputs surface as auth_error/profile_not_found; normal precedence and behavior unchanged.
    • Tests added for all empty-input paths.

Written for commit 77ae49c. Summary will update on new commits.

Review in cubic

… back

Empty --api-key/--profile flags and RESEND_API_KEY/RESEND_PROFILE env
vars were treated as missing by truthiness checks, so commands silently
fell back to other credentials and could target the wrong account.
Explicitly provided empty values now raise a clear validation error at
the point they would be consulted, and logout with an empty --profile
no longer removes all profiles.

Co-authored-by: Bu Kinoshita <bukinoshita@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants