From e608de02544deaac1d7440820093735ef25b326b Mon Sep 17 00:00:00 2001 From: Topher Hindman Date: Mon, 26 Oct 2026 10:29:43 -0700 Subject: [PATCH] test(lk): allow the project fallback only for an unconfigured livekit.toml TestCredentialResolution let room list fall back to the only configured project in every API-key case, because a --project or --subdomain that didn't resolve used to fall back to it. #1076 made that an error and #1084 made --dev with an API key or secret one too, so lk now falls back only when no project is named on the command line and a livekit.toml names a project that isn't configured. Allowing it anywhere else hid a return of the mistyped-project fallback. --- cmd/lk/credential_property_test.go | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/cmd/lk/credential_property_test.go b/cmd/lk/credential_property_test.go index 3c52b8fe..0c6a347a 100644 --- a/cmd/lk/credential_property_test.go +++ b/cmd/lk/credential_property_test.go @@ -155,9 +155,14 @@ func TestCredentialResolution(t *testing.T) { strings.Join(c.env(), " "), strings.Join(c.args(), " "), conf, strings.Join(requests, "\n"), output) allowed := c.namedProjects() - if sole := c.soleProject(); !c.userAuth && c.command.fallback && sole != "" { - // Known bug: when resolving what the user named fails, room list - // falls back to the only configured project (mistyped-project.txtar). + _, key, secret := c.inlineCredentials() + tomlUnresolved := !c.dev && (key == "" || secret == "") && c.toml != "" && !c.configured(c.toml) + if sole := c.soleProject(); !c.userAuth && c.command.fallback && sole != "" && + c.project == "" && c.subdomain == "" && tomlUnresolved { + // With no project named on the command line, room list falls back + // to the only configured project when resolving fails. lk keeps + // that on purpose for a livekit.toml naming a project that isn't + // configured, so an agent repo still gets a project to choose. allowed = append(allowed, sole) } named := false @@ -266,8 +271,9 @@ type credentialCase struct { type credentialCommand struct { args []string // fallback is set when, in API-key mode, a failure to resolve a project - // falls back to the only configured one (requireProjectWithOpts); - // loadProjectDetails fails instead. + // that --project, --subdomain or --dev didn't ask for falls back to the + // only configured one (requireProjectWithOpts); loadProjectDetails fails + // instead. fallback bool // publicAPI is set for a command that calls the Public API directly with // the session (and only runs under --user-auth), instead of using a