fix(ske): address stateless login review feedback

Author: Galin-Karabadzhakov

internal/cmd/ske/kubeconfig/login/login.go

@@ -109,7 +109,11 @@ func NewCmd(params *types.CmdParams) *cobra.Command {
 				if err != nil {
 					return err
 				}
-				tokenEndpoint, err := auth.GetIDPTokenEndpoint(params.Printer)
+				getTokenEndpoint := auth.GetIDPTokenEndpoint
+				if statelessIDPMode {
+					getTokenEndpoint = auth.GetIDPTokenEndpointStateless
+				}
+				tokenEndpoint, err := getTokenEndpoint(params.Printer)
 				if err != nil {
 					return fmt.Errorf("get IDP token endpoint: %w", err)
 				}
@@ -186,11 +190,11 @@ func parseClusterConfig(p *print.Printer, cmd *cobra.Command, idpMode, workloadI
 		}
 	}
 
-	if clusterName := flags.FlagToStringValue(p, cmd, clusterNameFlag); clusterName != "" {
-		clusterConfig.ClusterName = clusterName
+	if clusterConfig.ClusterName == "" {
+		clusterConfig.ClusterName = flags.FlagToStringValue(p, cmd, clusterNameFlag)
 	}
-	if organizationID := flags.FlagToStringValue(p, cmd, organizationFlag); organizationID != "" {
-		clusterConfig.OrganizationID = organizationID
+	if clusterConfig.OrganizationID == "" {
+		clusterConfig.OrganizationID = flags.FlagToStringValue(p, cmd, organizationFlag)
 	}
 	globalFlags := globalflags.Parse(p, cmd)
 	if clusterConfig.STACKITProjectID == "" {

internal/cmd/ske/kubeconfig/login/login_test.go

@@ -115,6 +115,8 @@ func TestParseClusterConfigWithoutExecClusterInfo(t *testing.T) {
 func TestParseClusterConfigUsesExecClusterInfo(t *testing.T) {
 	viper.Reset()
 	t.Cleanup(viper.Reset)
+	viper.Set(config.ProjectIdKey, uuid.NewString())
+	viper.Set(config.RegionKey, "conflicting-region")
 	t.Setenv(envServiceAccountEmail, "workload@sa.stackit.cloud")
 
 	configJSON, err := json.Marshal(fixtureClusterConfig())
@@ -129,6 +131,12 @@ func TestParseClusterConfigUsesExecClusterInfo(t *testing.T) {
 	params := testparams.NewTestParams()
 	cmd := &cobra.Command{}
 	configureFlags(cmd)
+	if err := cmd.Flags().Set(clusterNameFlag, "conflicting-cluster"); err != nil {
+		t.Fatalf("set cluster name flag: %v", err)
+	}
+	if err := cmd.Flags().Set(organizationFlag, uuid.NewString()); err != nil {
+		t.Fatalf("set organization flag: %v", err)
+	}
 	actual, err := parseClusterConfig(params.Printer, cmd, true, true, true)
 	if err != nil {
 		t.Fatalf("parse cluster config: %v", err)

internal/pkg/auth/utils.go

@@ -71,14 +71,20 @@ func retrieveIDPWellKnownConfigWithStorage(p *print.Printer, persistTokenEndpoin
 	return idpWellKnownConfig, nil
 }
 
-// GetIDPTokenEndpoint returns the configured IdP token endpoint without requiring
-// authentication storage. Persisted configuration is reused when available.
+// GetIDPTokenEndpoint returns the persisted IdP token endpoint when available and
+// falls back to endpoint discovery.
 func GetIDPTokenEndpoint(p *print.Printer) (string, error) {
 	tokenEndpoint, err := GetAuthField(IDP_TOKEN_ENDPOINT)
 	if err == nil && tokenEndpoint != "" {
 		return tokenEndpoint, nil
 	}
 
+	return GetIDPTokenEndpointStateless(p)
+}
+
+// GetIDPTokenEndpointStateless discovers the IdP token endpoint without reading
+// from or writing to authentication storage.
+func GetIDPTokenEndpointStateless(p *print.Printer) (string, error) {
 	wellKnownConfig, err := retrieveIDPWellKnownConfigWithStorage(p, false)
 	if err != nil {
 		return "", err

internal/pkg/auth/utils_test.go

@@ -1,13 +1,16 @@
 package auth
 
 import (
+	"net/http"
+	"net/http/httptest"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/spf13/viper"
 	"github.com/zalando/go-keyring"
 
 	"github.com/stackitcloud/stackit-cli/internal/pkg/config"
+	"github.com/stackitcloud/stackit-cli/internal/pkg/testparams"
 )
 
 func TestGetWellKnownConfig(t *testing.T) {
@@ -229,3 +232,47 @@ func TestParseWellKnownConfigWithoutStorage(t *testing.T) {
 		t.Fatalf("Expected token endpoint not to be changed, got %q", storedTokenEndpoint)
 	}
 }
+
+func TestGetIDPTokenEndpointStatelessIgnoresStorage(t *testing.T) {
+	viper.Reset()
+	t.Cleanup(viper.Reset)
+	keyring.MockInit()
+
+	const storedEndpoint = "https://stored.stackit.cloud/oauth"
+	if err := SetAuthField(IDP_TOKEN_ENDPOINT, storedEndpoint); err != nil {
+		t.Fatalf("Set stored token endpoint: %v", err)
+	}
+
+	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"issuer":"https://issuer.stackit.cloud/endpoint","authorization_endpoint":"https://auth.stackit.cloud/endpoint","token_endpoint":"https://discovered.stackit.cloud/oauth"}`))
+	}))
+	defer server.Close()
+
+	originalTransport := http.DefaultTransport
+	http.DefaultTransport = server.Client().Transport
+	t.Cleanup(func() {
+		http.DefaultTransport = originalTransport
+	})
+	viper.Set(config.IdentityProviderCustomWellKnownConfigurationKey, server.URL)
+	viper.Set(config.AllowedUrlDomainKey, "")
+
+	params := testparams.NewTestParams()
+	params.Printer.AssumeYes = true
+	actual, err := GetIDPTokenEndpointStateless(params.Printer)
+	if err != nil {
+		t.Fatalf("Get stateless token endpoint: %v", err)
+	}
+	const discoveredEndpoint = "https://discovered.stackit.cloud/oauth"
+	if actual != discoveredEndpoint {
+		t.Fatalf("Expected discovered endpoint %q, got %q", discoveredEndpoint, actual)
+	}
+
+	actualStoredEndpoint, err := GetAuthField(IDP_TOKEN_ENDPOINT)
+	if err != nil {
+		t.Fatalf("Get stored token endpoint: %v", err)
+	}
+	if actualStoredEndpoint != storedEndpoint {
+		t.Fatalf("Expected stored endpoint to remain %q, got %q", storedEndpoint, actualStoredEndpoint)
+	}
+}