Skip to content

Commit f765244

Browse files
MattieTKMattieTK
authored
fix: restrict account name redaction to CI environments only (#12671)
1 parent c0e9e08 commit f765244

6 files changed

Lines changed: 56 additions & 15 deletions

File tree

‎.changeset/narrow-account-redaction-to-ci.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
---
2+
"wrangler": patch
3+
---
4+
5+
fix: Only redact account names in CI environments, not all non-interactive contexts
6+
7+
The multi-account selection error in `getAccountId` now only redacts account names
8+
when running in a CI environment (detected via `ci-info`). Non-interactive terminals
9+
such as coding agents and piped commands can now see account names, which they need
10+
to identify which account to configure. CI logs remain protected.

‎packages/wrangler/src/__tests__/deploy/core.test.ts‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import * as fs from "node:fs";
44
import { readFile } from "node:fs/promises";
55
import * as path from "node:path";
66
import { writeWranglerConfig } from "@cloudflare/workers-utils/test-helpers";
7+
import ci from "ci-info";
78
import { http, HttpResponse } from "msw";
89
import * as TOML from "smol-toml";
910
import dedent from "ts-dedent";
@@ -877,6 +878,33 @@ describe("deploy", () => {
877878
{ id: "R2-D2", account: { id: "nx01", name: "enterprise-nx" } },
878879
]);
879880

881+
await expect(runWrangler("deploy index.js")).rejects
882+
.toMatchInlineSnapshot(`
883+
[Error: More than one account available but unable to select one in non-interactive mode.
884+
Please set the appropriate \`account_id\` in your Wrangler configuration file or assign it to the \`CLOUDFLARE_ACCOUNT_ID\` environment variable.
885+
Available accounts are (\`<name>\`: \`<account_id>\`):
886+
\`enterprise\`: \`1701\`
887+
\`enterprise-nx\`: \`nx01\`]
888+
`);
889+
});
890+
891+
it("should redact account names in CI even when non-interactive", async () => {
892+
setIsTTY(false);
893+
vi.mocked(ci).isCI = true;
894+
vi.stubEnv("CLOUDFLARE_API_TOKEN", "hunter2");
895+
vi.stubEnv("CLOUDFLARE_ACCOUNT_ID", "");
896+
writeWranglerConfig({
897+
account_id: undefined,
898+
});
899+
writeWorkerSource();
900+
mockSubDomainRequest();
901+
mockUploadWorkerRequest();
902+
mockOAuthServerCallback();
903+
mockGetMemberships([
904+
{ id: "IG-88", account: { id: "1701", name: "enterprise" } },
905+
{ id: "R2-D2", account: { id: "nx01", name: "enterprise-nx" } },
906+
]);
907+
880908
await expect(runWrangler("deploy index.js")).rejects
881909
.toMatchInlineSnapshot(`
882910
[Error: More than one account available but unable to select one in non-interactive mode.

‎packages/wrangler/src/__tests__/kv/key.test.ts‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1119,8 +1119,8 @@ describe("kv", () => {
11191119
[Error: More than one account available but unable to select one in non-interactive mode.
11201120
Please set the appropriate \`account_id\` in your Wrangler configuration file or assign it to the \`CLOUDFLARE_ACCOUNT_ID\` environment variable.
11211121
Available accounts are (\`<name>\`: \`<account_id>\`):
1122-
\`(redacted)\`: \`1\`
1123-
\`(redacted)\`: \`2\`]
1122+
\`one\`: \`1\`
1123+
\`two\`: \`2\`]
11241124
`);
11251125
});
11261126

@@ -1136,8 +1136,8 @@ describe("kv", () => {
11361136
[Error: More than one account available but unable to select one in non-interactive mode.
11371137
Please set the appropriate \`account_id\` in your Wrangler configuration file or assign it to the \`CLOUDFLARE_ACCOUNT_ID\` environment variable.
11381138
Available accounts are (\`<name>\`: \`<account_id>\`):
1139-
\`(redacted)\`: \`1\`
1140-
\`(redacted)\`: \`2\`]
1139+
\`one\`: \`1\`
1140+
\`two\`: \`2\`]
11411141
`);
11421142
});
11431143

@@ -1179,8 +1179,8 @@ describe("kv", () => {
11791179
[Error: More than one account available but unable to select one in non-interactive mode.
11801180
Please set the appropriate \`account_id\` in your Wrangler configuration file or assign it to the \`CLOUDFLARE_ACCOUNT_ID\` environment variable.
11811181
Available accounts are (\`<name>\`: \`<account_id>\`):
1182-
\`(redacted)\`: \`1\`
1183-
\`(redacted)\`: \`2\`]
1182+
\`one\`: \`1\`
1183+
\`two\`: \`2\`]
11841184
`);
11851185
});
11861186
});

‎packages/wrangler/src/__tests__/pages/secret.test.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -287,9 +287,9 @@ describe("wrangler pages secret", () => {
287287
[Error: More than one account available but unable to select one in non-interactive mode.
288288
Please set the appropriate \`account_id\` in your Wrangler configuration file or assign it to the \`CLOUDFLARE_ACCOUNT_ID\` environment variable.
289289
Available accounts are (\`<name>\`: \`<account_id>\`):
290-
\`(redacted)\`: \`account-id-1\`
291-
\`(redacted)\`: \`account-id-2\`
292-
\`(redacted)\`: \`account-id-3\`]
290+
\`account-name-1\`: \`account-id-1\`
291+
\`account-name-2\`: \`account-id-2\`
292+
\`account-name-3\`: \`account-id-3\`]
293293
`);
294294
});
295295
});

‎packages/wrangler/src/__tests__/secret.test.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -459,9 +459,9 @@ describe("wrangler secret", () => {
459459
[Error: More than one account available but unable to select one in non-interactive mode.
460460
Please set the appropriate \`account_id\` in your Wrangler configuration file or assign it to the \`CLOUDFLARE_ACCOUNT_ID\` environment variable.
461461
Available accounts are (\`<name>\`: \`<account_id>\`):
462-
\`(redacted)\`: \`account-id-1\`
463-
\`(redacted)\`: \`account-id-2\`
464-
\`(redacted)\`: \`account-id-3\`]
462+
\`account-name-1\`: \`account-id-1\`
463+
\`account-name-2\`: \`account-id-2\`
464+
\`account-name-3\`: \`account-id-3\`]
465465
`);
466466
});
467467
});

‎packages/wrangler/src/user/user.ts‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -221,6 +221,7 @@ import {
221221
readFileSync,
222222
UserError,
223223
} from "@cloudflare/workers-utils";
224+
import ci from "ci-info";
224225
import TOML from "smol-toml";
225226
import dedent from "ts-dedent";
226227
import { fetch } from "undici";
@@ -1287,9 +1288,11 @@ export async function getAccountId(
12871288
} catch (e) {
12881289
// Did we try to select an account in CI or a non-interactive terminal?
12891290
if (e instanceof NoDefaultValueProvided) {
1290-
// Redact account names (which may contain email addresses) in non-interactive mode
1291-
// to avoid leaking sensitive information in CI logs
1292-
const redactAccountName = isNonInteractiveOrCI();
1291+
// Redact account names (which may contain email addresses) in CI
1292+
// to avoid leaking sensitive information in public CI logs.
1293+
// Non-interactive terminals (agents, piped commands) still need
1294+
// to see account names to identify which account to configure.
1295+
const redactAccountName = ci.isCI;
12931296
throw new UserError(
12941297
`More than one account available but unable to select one in non-interactive mode.
12951298
Please set the appropriate \`account_id\` in your ${configFileName(undefined)} file or assign it to the \`CLOUDFLARE_ACCOUNT_ID\` environment variable.

0 commit comments

Comments
 (0)