digitalocean / digitalocean/doctl

auth switch --context default writes bogus "default: true" into auth-contexts

Open
#1,816 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
3.4k
Forks
496
Avg merge
1d 2h
Merged PRs (30d)
31

Description

## Description

`doctl auth switch --context default` silently injects `default: "true"` into the `auth-contexts` map in `~/.config/doctl/config.yaml`. This entry is not a real token — it's a side effect of how `RunAuthSwitch` validates the requested context.

The bogus entry can break subsequent context switches because doctl may resolve the `default` context against `auth-contexts` (finding `"true"`) instead of the top-level `access-token`.

## Steps to reproduce

```bash
# Start with a clean config that has a named context
doctl auth init # sets top-level access-token
doctl auth init --context teamadf # adds teamadf under auth-contexts

# Confirm no "default" key under auth-contexts
grep -A3 '^auth-contexts:' ~/.config/doctl/config.yaml

# Switch to default — this creates the bogus entry
doctl auth switch --context default

# Now check again
grep -A3 '^auth-contexts:' ~/.config/doctl/config.yaml
```

**Expected:**
```yaml
auth-contexts:
teamadf: dop_v1_abc123...
```

**Actual:**
```yaml
auth-contexts:
default: "true"
teamadf: dop_v1_abc123...
```

The `default: "true"` entry appears every time you switch to the default context.

## Root cause

In [`commands/auth.go` → `RunAuthSwitch`](https://github.com/digitalocean/doctl/blob/main/commands/auth.go), the default context is temporarily added to the auth-contexts map for validation:

```go
contextsAvail := viper.GetStringMap("auth-contexts")
contextsAvail[doctl.ArgDefaultContext] = true
```

Later, viper's state (now containing `default: true`) is serialized back to the config file via `writeConfig()`. The temporary validation entry is never removed before the write.

## Impact

- The `default` context resolves to the string `"true"` instead of the top-level `access-token`, which can cause API calls to silently use the wrong token or fail.
- Users managing multiple contexts (e.g. switching between teams) get stale results because all contexts fall back to the same top-level token.
- The entry reappears after every `doctl auth switch --context default`, so manually removing it doesn't stick.

## Suggested fix

Remove the `default` key from the map after validation, before writing the config. Something like:

```go
contextsAvail := viper.GetStringMap("auth-contexts")
contextsAvail[doctl.ArgDefaultContext] = true // for validation only

// ... validation logic ...

// Clean up before persisting
delete(contextsAvail, doctl.ArgDefaultContext)
```

## Workaround

Strip the bogus entry after switching:

```bash
# Wrapper function
doswitch() {
local ctx="${1:-default}"
doctl auth switch --context "$ctx"
sed -i '/^ default: "true"$/d' "${HOME}/.config/doctl/config.yaml" 2>/dev/null
}
```

## Environment

- doctl version: 1.110.0-release
- OS: Linux (WSL2)
- Shell: bash

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.