From e85d356d11177d9ecbf1f4432373ec7304b3f6a8 Mon Sep 17 00:00:00 2001 From: Grzegorz Zdunek Date: Thu, 21 Nov 2024 18:25:44 +0100 Subject: [PATCH] Do not require user interaction in `tsh status` when using hardware keys (#48972) --- tool/tsh/common/tsh.go | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/tool/tsh/common/tsh.go b/tool/tsh/common/tsh.go index a65866b796d18..b7f0ddf919d2f 100644 --- a/tool/tsh/common/tsh.go +++ b/tool/tsh/common/tsh.go @@ -4521,7 +4521,18 @@ func onStatus(cf *CLIConf) error { return trace.Wrap(err) } - if err := printLoginInformation(cf, profile, profiles, cf.getAccessListsToReview(tc)); err != nil { + // `tsh status` should run without requiring user interaction. + // To achieve this, we avoid remote calls that might prompt for + // hardware key touch or require a PIN. + hardwareKeyInteractionRequired := tc.PrivateKeyPolicy.MFAVerified() + + var accessListsToReview []*accesslist.AccessList + if hardwareKeyInteractionRequired { + log.Debug("Skipping fetching access lists to review due to Hardware Key PIN/Touch requirement.") + } else { + accessListsToReview = cf.getAccessListsToReview(tc) + } + if err := printLoginInformation(cf, profile, profiles, accessListsToReview); err != nil { return trace.Wrap(err) } @@ -4534,7 +4545,7 @@ func onStatus(cf *CLIConf) error { return trace.NotFound("Active profile expired.") } - if tc.PrivateKeyPolicy.MFAVerified() { + if hardwareKeyInteractionRequired { log.Debug("Skipping cluster alerts due to Hardware Key PIN/Touch requirement.") } else { if err := common.ShowClusterAlerts(cf.Context, tc, os.Stderr, nil,