DopplerHQ / cli

The official CLI for interacting with your Doppler secrets and configuration.
https://docs.doppler.com
Apache License 2.0
214 stars 43 forks source link

[BUG] doppler logout does not invalidate token #417

Closed reubenfirmin closed 9 months ago

reubenfirmin commented 12 months ago

Describe the bug I can still run doppler secrets and doppler me after running doppler logout.

To Reproduce

> doppler login
? Open the authorization page in your browser? Yes
Complete authorization at https://dashboard.doppler.com/workplace/auth/cli
Your auth code is:
flower_sixty_boysenberry_nuly_chimes

Waiting...

Welcome, Reuben

[09:21:15] rfirmin@lights /home/rfirmin/code/startup[scaffold]
> doppler me
┌────────┬──────┬──────────────────────────────────┬───────────────┬────────────────────────────────┬───────────────────┬───────────────────┐
│ NAME   │ TYPE │ WORKPLACE                        │ TOKEN PREVIEW │ SLUG                           │ CREATED AT        │ LAST SEEN AT      │
├────────┼──────┼──────────────────────────────────┼───────────────┼────────────────────────────────┼───────────────────┼───────────────────┤
│ lights │ cli  │ www │ xxx  │ sss │ 2023-07-08T15:19: │ 2023-07-08T15:20: │
│        │      │                                  │               │ 5fa4c9                         │ 27.881Z           │ 34.683Z           │
└────────┴──────┴──────────────────────────────────┴───────────────┴────────────────────────────────┴───────────────────┴───────────────────┘

[09:21:19] rfirmin@lights /home/rfirmin/code/startup[scaffold]
> doppler logout
? Revoke auth token scoped to /? Yes
Auth token has been revoked

[09:21:24] rfirmin@lights /home/rfirmin/code/startup[scaffold]
> doppler me
┌────────┬──────┬──────────────────────────────────┬───────────────┬────────────────────────────────┬───────────────────┬───────────────────┐
│ NAME   │ TYPE │ WORKPLACE                        │ TOKEN PREVIEW │ SLUG                           │ CREATED AT        │ LAST SEEN AT      │
├────────┼──────┼──────────────────────────────────┼───────────────┼────────────────────────────────┼───────────────────┼───────────────────┤
│ lights │ cli  │ www │ xxx  │ sss │ 2023-07-08T15:19: │ 2023-07-08T15:21: │
│        │      │                                  │               │ 5fa4c9                         │ 27.881Z           │ 19.325Z           │
└────────┴──────┴──────────────────────────────────┴───────────────┴────────────────────────────────┴───────────────────┴───────────────────┘

Expected behavior doppler logout should completely invalidate the token.

Piccirello commented 9 months ago

The logout command is scoped globally by default (/), whereas the me command is scoped locally. If you run doppler configure debug in /home/rfirmin/code/startup, I suspect you'll see that there's another token that's being used.