hasura / hasura/graphql-engine
--admin-secret doesn't work with --endpoint (migrate + more)
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
### Version Information
Server Version: v1.3.3
CLI Version (for CLI related issue): v1.3.3
### Environment
macOS
### What is the expected behaviour?
Specifying an admin secret as a flag or environment would work, when applying migrations on a remote Hasura server (i.e. using `--endpoint`). I think this might only happen with remote servers, importantly.
I don't think this is related to non-alphanumeric characters but I could be wrong.
### Keywords
`cli` `migrate apply` `endpoint`
### What is the current behaviour?
It doesn't work. [You have to specify the admin-secret in `config.yaml` to get it to work.](https://github.com/hasura/graphql-engine/issues/3740#issuecomment-576799962) This isn't workable for my situation, since I want to migrate the production database and I won't commit the admin secret to the codebase.
### How to reproduce the issue?
1. Migrate with CLI flag
```
hasura migrate apply
--endpoint https://api.example.server.xyz/
--certificate-authority ca-chain.pem
--admin-secret long-and-random-string
```
2. Migrate with ENV
```
HASURA_GRAPHQL_ADMIN_SECRET=long-and-random-string hasura migrate apply
--endpoint https://api.example.server.xyz/
--certificate-authority ca-chain.pem
````
Both of these output:
`# FATA[0002] apply failed: cannot create migrate instance: [access-denied] invalid x-hasura-admin-secret/x-hasura-access-key ($)`
It doesn't seem like `--certificate-authority` vs `--insecure-skip-tls-verify` matters, but a `--endpoint` that's **not** `localhost` does.
### Screenshots or Screencast
n/a
### Please provide any traces or logs that could help here.
This issue, where it was first reported, could be useful: https://github.com/hasura/graphql-engine/issues/3740
I agree with @cltsang that this sould be fixed https://github.com/hasura/graphql-engine/issues/3740#issuecomment-780377239
This same issue happens with `hasura metadata`
This also happens with `hasura console` but the config.yaml workaround doesn't work: https://github.com/hasura/graphql-engine/issues/4926 I except they have a similar root cause.
### Any possible solutions?
n/a
### Can you identify the location in the source code where the problem exists?
No
### If the bug is confirmed, would you be willing to submit a PR?
No
Contributor guide
Assessment
This issue has not been assessed yet.