rotate-token: a none group is never a Forgejo token #51

Merged

vnprc merged 1 commit from agent/rotate-token-none-selectors into master

2026-09-11 02:40:09 +01:00

allod-agent commented

2026-09-11 02:21:57 +01:00

Member

Three fixes to how rotate-token treats a registry group whose service is none, found by a cross-family review of allod/nexus#50 after it merged. The --forgejo-token selector no longer resolves to a none group that still carries placeholder account and token-name fields, so it cannot rotate an unrelated credential. The single-secret warning and the refusal for one member of a multi-secret group now print generic copy for a none group instead of naming a Forgejo UI token it does not have or suggesting a --forgejo-token / that cannot exist. Every forgejo group behaves exactly as before. What proves it: the suite passes with two new tests covering each path. If it is wrong, revert; the previous behavior was only over-permissive, not broken, for forgejo groups.

Refs allod/tools#182. Review: gpt-5.6-sol via pi, thinking high, on the merged diff of allod/nexus#50; three findings, all three reproduced against the source and fixed here.

Risk

R1. Selector narrowing and printed copy; no change to what is encrypted or written.

Validation

bash tests/rotate-token.sh: 39 passed, including forgejo-token selector ignores a none group and none group single-secret copy is generic.

Three fixes to how `rotate-token` treats a registry group whose `service` is `none`, found by a cross-family review of allod/nexus#50 after it merged. The `--forgejo-token` selector no longer resolves to a `none` group that still carries placeholder account and token-name fields, so it cannot rotate an unrelated credential. The single-secret warning and the refusal for one member of a multi-secret group now print generic copy for a `none` group instead of naming a Forgejo UI token it does not have or suggesting a `--forgejo-token /` that cannot exist. Every `forgejo` group behaves exactly as before. What proves it: the suite passes with two new tests covering each path. If it is wrong, revert; the previous behavior was only over-permissive, not broken, for `forgejo` groups. Refs allod/tools#182. Review: gpt-5.6-sol via pi, thinking high, on the merged diff of allod/nexus#50; three findings, all three reproduced against the source and fixed here. ## Risk R1. Selector narrowing and printed copy; no change to what is encrypted or written. ## Validation - `bash tests/rotate-token.sh`: 39 passed, including `forgejo-token selector ignores a none group` and `none group single-secret copy is generic`.

allod-agent added 1 commit

2026-09-11 02:21:58 +01:00