From 8fce4c1586baef96976f3ad2be90c5f1f819db59 Mon Sep 17 00:00:00 2001 From: Grzegorz Zdunek Date: Wed, 13 Nov 2024 10:04:26 +0100 Subject: [PATCH] Do not require user interaction in `tsh status` when using hardware keys (#48837) --- tool/tsh/common/tsh.go | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/tool/tsh/common/tsh.go b/tool/tsh/common/tsh.go index 4875f836b3a4f..0ef322caa460a 100644 --- a/tool/tsh/common/tsh.go +++ b/tool/tsh/common/tsh.go @@ -4867,7 +4867,18 @@ func onStatus(cf *CLIConf) error { return trace.Wrap(err) } - if err := printLoginInformation(cf, profile, profiles, cf.getAccessListsToReview(tc)); err != nil { + // `tsh status` should run without requiring user interaction. + // To achieve this, we avoid remote calls that might prompt for + // hardware key touch or require a PIN. + hardwareKeyInteractionRequired := tc.PrivateKeyPolicy.MFAVerified() + + var accessListsToReview []*accesslist.AccessList + if hardwareKeyInteractionRequired { + log.Debug("Skipping fetching access lists to review due to Hardware Key PIN/Touch requirement.") + } else { + accessListsToReview = cf.getAccessListsToReview(tc) + } + if err := printLoginInformation(cf, profile, profiles, accessListsToReview); err != nil { return trace.Wrap(err) } @@ -4880,7 +4891,7 @@ func onStatus(cf *CLIConf) error { return trace.NotFound("Active profile expired.") } - if tc.PrivateKeyPolicy.MFAVerified() { + if hardwareKeyInteractionRequired { log.Debug("Skipping cluster alerts due to Hardware Key PIN/Touch requirement.") } else { if err := common.ShowClusterAlerts(cf.Context, tc, os.Stderr, nil,