[pjcdawkins]

Adds integration tests for security-relevant behavior:

• api:curl refuses a path with a host (absolute or //host/...) with exit code 1, and sends no request to either server. The access token is shown as [token] in -v and -vv output. -X, --json (including invalid JSON) and -H reach the request.
• api:curl, project:curl, environment:curl and organization:curl each request under their own base path.
• Sensitive variables at project and environment level: the value is sent on create and update, but not shown by variable:get (without -P) or by CSV variable:list output. A variable can also be updated to be sensitive.
• auth:logout of a single session revokes its access and refresh tokens and deletes its session and certificate files. It warns when an API token is set via config. --other keeps the current session when no other sessions exist.
• auth:api-token-login is refused when an API token is set via config.

The tests pass with both legacy auth and Go auth (TEST_CLI_GO_AUTH=1).

🤖 Generated with Claude Code

[upsun-dispatch]

Note

Reviewed — No blocking findings · 🔵 1 minor point

🔍 Full review · 4 files reviewed

🔵 Minor point

• integration-tests/api_curl_test.go:169 — assert.Empty(t, otherRecorder.requests()) can never fail. CurlCli::run builds the URL as rtrim($baseUrl, '/') . '/' . ltrim($path, '/'), so if the parse_url($path, PHP_URL_HOST) check were removed, both test paths (http://127.0.0.1:N/steal and //127.0.0.1:N/steal) would still go to the API server, as <api>/http://127.0.0.1:N/steal and <api>/127.0.0.1:N/steal. curl would never contact otherServer. Only assert.Empty(t, apiRecorder.requests()) and the exit-code/stderr checks would catch a regression. So the comment on line 149, which says the check keeps the token from being sent to another host, misstates what this test protects.

Verification

• The strings the tests expect ('Invalid path: ', 'The value of --json contains invalid JSON.', "Bearer [token]", 'An API token is already set via config', 'Warning: an API token is set via config') exist in both the Go commands and legacy PHP sources.
• CurlCli::run returns 1 before fetching a token for any path with a host, and the invalid-JSON exception is thrown before curl runs, so the request-count assertions after those cases hold.
• The mock auth server always issues access-token-1 unless unique tokens are enabled, so the Bearer access-token-1 and censoring assertions match its behavior.
• Go auth auth:api-token-login checks HasConfiguredToken before the interactive prompt, so 'Please enter an API token' is never printed when a token is configured.
• The mock API redacts sensitive variable values, and var:list writes an empty value for them in machine-readable formats, which matches the expected env:SECRET,<level>, CSV row.

This change is tests only. It adds Go integration tests that run in the integration-test job of .github/workflows/ci.yml, once with legacy auth and once with TEST_CLI_GO_AUTH=1. I did not run them, because they need a built CLI binary.

Review details

• Commit: 1be1a2a
• Model: claude-opus-5-5

---

Review 1 of 10 for this pull request · View the full run