digitalocean / digitalocean/doctl
auth switch --context default writes bogus "default: true" into auth-contexts
- Dominant language
- Go
- Stars
- 3.4k
- Forks
- 496
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 31
Description
## Description
`doctl auth switch --context default` silently injects `default: "true"` into the `auth-contexts` map in `~/.config/doctl/config.yaml`. This entry is not a real token — it's a side effect of how `RunAuthSwitch` validates the requested context.
The bogus entry can break subsequent context switches because doctl may resolve the `default` context against `auth-contexts` (finding `"true"`) instead of the top-level `access-token`.
## Steps to reproduce
```bash
# Start with a clean config that has a named context
doctl auth init # sets top-level access-token
doctl auth init --context teamadf # adds teamadf under auth-contexts
# Confirm no "default" key under auth-contexts
grep -A3 '^auth-contexts:' ~/.config/doctl/config.yaml
# Switch to default — this creates the bogus entry
doctl auth switch --context default
# Now check again
grep -A3 '^auth-contexts:' ~/.config/doctl/config.yaml
```
**Expected:**
```yaml
auth-contexts:
teamadf: dop_v1_abc123...
```
**Actual:**
```yaml
auth-contexts:
default: "true"
teamadf: dop_v1_abc123...
```
The `default: "true"` entry appears every time you switch to the default context.
## Root cause
In [`commands/auth.go` → `RunAuthSwitch`](https://github.com/digitalocean/doctl/blob/main/commands/auth.go), the default context is temporarily added to the auth-contexts map for validation:
```go
contextsAvail := viper.GetStringMap("auth-contexts")
contextsAvail[doctl.ArgDefaultContext] = true
```
Later, viper's state (now containing `default: true`) is serialized back to the config file via `writeConfig()`. The temporary validation entry is never removed before the write.
## Impact
- The `default` context resolves to the string `"true"` instead of the top-level `access-token`, which can cause API calls to silently use the wrong token or fail.
- Users managing multiple contexts (e.g. switching between teams) get stale results because all contexts fall back to the same top-level token.
- The entry reappears after every `doctl auth switch --context default`, so manually removing it doesn't stick.
## Suggested fix
Remove the `default` key from the map after validation, before writing the config. Something like:
```go
contextsAvail := viper.GetStringMap("auth-contexts")
contextsAvail[doctl.ArgDefaultContext] = true // for validation only
// ... validation logic ...
// Clean up before persisting
delete(contextsAvail, doctl.ArgDefaultContext)
```
## Workaround
Strip the bogus entry after switching:
```bash
# Wrapper function
doswitch() {
local ctx="${1:-default}"
doctl auth switch --context "$ctx"
sed -i '/^ default: "true"$/d' "${HOME}/.config/doctl/config.yaml" 2>/dev/null
}
```
## Environment
- doctl version: 1.110.0-release
- OS: Linux (WSL2)
- Shell: bash
Contributor guide
Assessment
This issue has not been assessed yet.