Repository navigation
fix(lk): say which env credentials --user-auth ignores - #1074
Merged
Merged
Conversation
Topherhindman
force-pushed
the
auth-tests/lk-auth-scripts
branch
from
October 23, 2026 17:11
81c5844 to
7d625e4
Compare
Topherhindman
force-pushed
the
fix/lk-user-auth-env-keys-note
branch
from
October 23, 2026 17:11
7ad81a8 to
1e205a2
Compare
Topherhindman
force-pushed
the
auth-tests/lk-auth-scripts
branch
from
October 23, 2026 17:53
7d625e4 to
e07a424
Compare
Topherhindman
force-pushed
the
fix/lk-user-auth-env-keys-note
branch
from
October 23, 2026 17:53
1e205a2 to
d8697c9
Compare
LIVEKIT_* credentials in the environment don't switch lk's auth mode, so with --user-auth a command acting through the session silently left a set LIVEKIT_URL, LIVEKIT_API_KEY or LIVEKIT_API_SECRET unused. lk now names the ones it's ignoring, once, after the "Using user" line on stderr. Agent runs are the exception: resolveCredentials hands environment credentials to the agent even under --user-auth, so they don't get the note.
Topherhindman
force-pushed
the
fix/lk-user-auth-env-keys-note
branch
from
October 23, 2026 19:39
d8697c9 to
e29b920
Compare
u9g
approved these changes
Oct 23, 2026
u9g
reviewed
Oct 23, 2026
| // TestAnnounceUserNamesIgnoredEnvCredentials checks the note announceUser adds | ||
| // for LIVEKIT_* credentials in the environment that --user-auth leaves unused, | ||
| // and that commands handing them to an agent don't get it. | ||
| func TestAnnounceUserNamesIgnoredEnvCredentials(t *testing.T) { |
Contributor
There was a problem hiding this comment.
Is this necessary because we also have an e2e test?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
LIVEKIT_*credentials in the environment don't switch lk's auth mode, so with--user-autha command acting through the session silently left a setLIVEKIT_URL,LIVEKIT_API_KEYorLIVEKIT_API_SECRETunused. lk now names the ones it's ignoring, once, after the "Using user" line on stderr:Ignoring LIVEKIT_URL, LIVEKIT_API_KEY, LIVEKIT_API_SECRET from environment (--user-auth uses your session).Agent runs (
lk agent dev,lk agent start, the debugger's--audio) are the exception.resolveCredentialshands environment credentials to the agent even under--user-auth, so those runs don't get the note.Something to look at separately: when only some of those env vars are set,
resolveCredentialspairs the shell's API key with the session project's URL, which may belong to a different project. It counts env-sourced values as explicit (explicitCredentialsreadsIsSet). This PR doesn't change that.Testing:
TestAnnounceUserNamesIgnoredEnvCredentialschecks the note for all three variables, for one, for none, and that agent runs don't get it.env-keys-with-user-auth.txtardrops its known-bug skip and matches the full line.cmd/lkpasses.