Skip to content

fix(config): migrate legacy auth and subscription config keys#3895

Draft
cursor[bot] wants to merge 1 commit into
developfrom
cursor/critical-bug-investigation-5990
Draft

fix(config): migrate legacy auth and subscription config keys#3895
cursor[bot] wants to merge 1 commit into
developfrom
cursor/critical-bug-investigation-5990

Conversation

@cursor
Copy link
Copy Markdown

@cursor cursor Bot commented May 28, 2026

Bug and impact

Recent config refactors renamed authmfa and moved flat subscription_key* fields into a subscription block. Existing deployments that had not updated their config.json would silently lose:

  • TOTP/MFA enforcement — users with TOTP enrolled could log in without a second factor because totp.enabled was never loaded.
  • Pro subscription keyssubscription_key / subscription_key_file were ignored after upgrade.

This is a security and licensing regression with a concrete trigger: upgrade to current develop while keeping an older config file.

Root cause

JSON unmarshaling only binds the new field names. loadConfigEnvironment() then allocates empty nested structs, masking the absence of migrated values.

Fix

  • Re-read legacy auth and flat subscription_* keys during config load.
  • Run migrateLegacyConfig() after reading the config file and before environment/default loading.
  • Guard Config.Subscription with ensureSubscriptionConfig() before reading KeyFile.

Validation

  • Added unit tests for auth→mfa migration, mfa precedence, subscription migration, and legacy auth surviving env allocation.
  • go test ./util/... and go test ./services/project/... pass.
Open in Web View Automation 

The auth→mfa and flat subscription field refactors silently ignored
existing config.json values, disabling TOTP and Pro subscription keys
after upgrade. Restore backward-compatible unmarshaling and migrate
legacy fields before environment loading allocates empty nested structs.

Co-authored-by: Denis Gukov <fiftin@outlook.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant