feat(auth): enforce one session per org name#602
Conversation
This comment has been minimized.
This comment has been minimized.
Previously the session registry key was (site, org), so the same org name could appear on multiple sites as separate entries. This caused ambiguity in find_session_site when a user logged in as the same name on datadoghq.com and datadoghq.eu. The unnamed (default) session already had a single-slot invariant enforced by prune_other_default_sessions. This extends the same invariant to named sessions: save_session now deduplicates on org alone, so logging in as --org foo on a new site silently replaces the prior entry rather than accumulating a second one. find_session now looks up by org alone (no site parameter), and find_session_site is simplified to a single .find() since the registry is guaranteed to hold at most one entry per name. Legacy sessions.json files with duplicate named-org rows self-heal on the next pup auth login for that org name.
srosenthal-dd
force-pushed
the
stephen.rosenthal/pup-session-one-per-name
branch
from
3a27245 to
406b9ad
Compare
|
would there be a case where someone wants |
@platinummonkey we should still be able to do that! Datadog "org" = an account This PR makes it so pup doesn't reuse the same name for multiple sessions. Some users might have two "prod" named sessions for two different sites, and now they'll have to use separate names like It's still possible to have multiple pup named-sessions (--orgs) pointing to the same Datadog org, potentially with different scopes. I tested with a |
srosenthal-dd
dismissed
platinummonkey’s stale review
The merge-base changed after approval.
srosenthal-dd
dismissed
platinummonkey’s stale review
The merge-base changed after approval.
srosenthal-dd
dismissed
platinummonkey’s stale review
The merge-base changed after approval.
srosenthal-dd
dismissed
platinummonkey’s stale review
The merge-base changed after approval.
…-session-one-per-name
2 participants
Depends on #600 (merge that first -- they both touch
README.mdand will conflict).Summary
save_session: deduplicates by org name alone instead of (site, org)find_session: looks up by org alone, drops the now-redundant site parameterfind_session_site: simplified -- no ambiguity path possibleremove_session: filters by org alone