From 8427a0b81907f39d591ddf89e81eb0d7cc30b325 Mon Sep 17 00:00:00 2001
From: Hami0095 <abdman0095@gmail.com>
Date: Mon, 14 Sep 2026 13:19:07 +0200
Subject: [PATCH] fix(auth): don't fail ACL preflight when self-read fails

CheckACLs reads the API key's own ACLs via GET /1/keys/{key} to
compare against what the command declares it needs. That endpoint
requires the `search` ACL, which is unrelated to most commands, so a
key that's missing it (or otherwise can't self-read) gets a bare
error from the preflight and the command never runs, even when the
key holds every ACL it actually needs.

Make the self-read failure non-fatal, the same way the admin-key
check above it already treats a failing ListApiKeys as "not admin"
rather than an error. The real API call remains the authority on
whether the key is sufficient.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 pkg/auth/auth_check.go      |  3 ++-
 pkg/auth/auth_check_test.go | 31 ++++++++++++++++++++++++++++++-
 2 files changed, 32 insertions(+), 2 deletions(-)

diff --git a/pkg/auth/auth_check.go b/pkg/auth/auth_check.go
index f7857c67..50c13d3d 100644
--- a/pkg/auth/auth_check.go
+++ b/pkg/auth/auth_check.go
@@ -125,7 +125,8 @@ func CheckACLs(cmd *cobra.Command, f *cmdutil.Factory) error {
 	}
 	apiKey, err := client.GetApiKey(client.NewApiGetApiKeyRequest(key))
 	if err != nil {
-		return err
+		// Self-read requires its own ACL; don't fail on that, let the real call decide.
+		return nil
 	}
 
 	var hasAcls []string
diff --git a/pkg/auth/auth_check_test.go b/pkg/auth/auth_check_test.go
index fac8075a..9aad0996 100644
--- a/pkg/auth/auth_check_test.go
+++ b/pkg/auth/auth_check_test.go
@@ -71,6 +71,7 @@ func Test_CheckACLs(t *testing.T) {
 		cmd            *cobra.Command
 		adminKey       bool
 		ACLs           []search.Acl
+		selfReadFails  bool
 		wantErr        bool
 		wantErrMessage string
 	}{
@@ -132,6 +133,29 @@ See https://www.algolia.com/doc/guides/security/api-keys/#rights-and-restriction
 			ACLs:     []search.Acl{search.ACL_SEARCH},
 			wantErr:  false,
 		},
+		{
+			name: "self-read fails, need non-admin ACLs",
+			cmd: &cobra.Command{
+				Annotations: map[string]string{
+					"acls": "settings",
+				},
+			},
+			adminKey:      false,
+			selfReadFails: true,
+			wantErr:       false,
+		},
+		{
+			name: "self-read fails, need admin key",
+			cmd: &cobra.Command{
+				Annotations: map[string]string{
+					"acls": "admin",
+				},
+			},
+			adminKey:       false,
+			selfReadFails:  true,
+			wantErr:        true,
+			wantErrMessage: "this command requires an admin API key. Use the `--api-key` flag with a valid admin API key",
+		},
 	}
 
 	for _, tt := range tests {
@@ -149,7 +173,12 @@ See https://www.algolia.com/doc/guides/security/api-keys/#rights-and-restriction
 				)
 			}
 
-			if tt.ACLs != nil && !tt.adminKey {
+			if tt.selfReadFails && !tt.adminKey {
+				r.Register(
+					httpmock.REST("GET", "1/keys/test"),
+					httpmock.ErrorResponse(),
+				)
+			} else if tt.ACLs != nil && !tt.adminKey {
 				r.Register(
 					httpmock.REST("GET", "1/keys/test"),
 					httpmock.JSONResponse(search.ApiKey{Acl: tt.ACLs}),