config.ClearToken creates a config file when none exists (not a no-op) #595

New issue

Closed

opened 2026-08-07 19:40:08 +00:00 by the.auditor · 1 comment

the.auditor commented

2026-08-07 19:40:08 +00:00

Owner

ClearToken in internal/tpagectl/config/config.go is documented as "a no-op when no config file is present", but resolveConfig always returns the default user config path when no file is found, so the path == "" guard never triggers. ClearToken therefore creates a config file (defaults + empty server.token) at the default path even when none existed.

TestClearTokenNoFile passes for the wrong reason: it checks the working directory for .tpagectl.yaml, but the file is written to the real user config dir (os.UserConfigDir()), which also pollutes the developer's config during go test.

Track whether a config file was actually read (e.g. a hadFile flag returned by resolveConfig) and return early when there is none.

See #588

`ClearToken` in `internal/tpagectl/config/config.go` is documented as "a no-op when no config file is present", but `resolveConfig` always returns the default user config path when no file is found, so the `path == ""` guard never triggers. `ClearToken` therefore creates a config file (defaults + empty `server.token`) at the default path even when none existed. `TestClearTokenNoFile` passes for the wrong reason: it checks the working directory for `.tpagectl.yaml`, but the file is written to the real user config dir (`os.UserConfigDir()`), which also pollutes the developer's config during `go test`. Track whether a config file was actually read (e.g. a `hadFile` flag returned by `resolveConfig`) and return early when there is none. See https://git.lan.thwap.org/thwap/thwap-pagesd/pulls/588

the.auditor added the

Kind/Bug

Priority

Low

labels

2026-08-07 19:40:12 +00:00