iframe-proxy

nicknisi · 2026-04-30T15:47:11Z

Summary

Flag > env var > stored config: --api-key now beats WORKOS_API_KEY env var, matching standard CLI conventions (gh, aws, kubectl). Previously the env var always won, making --api-key and env switch silently ineffective.
Warning on env switch: When WORKOS_API_KEY is set in the shell, env switch warns that the env var will override the stored key. In JSON mode, warnings are embedded in the response object (not separate JSONL lines).
outputSuccess gains optional warnings: Centralizes warning delivery so JSON consumers get a single parseable object.
Pre-existing type fix: Adds non-null assertions to Hono route params in authorization routes (separate commit).

Reported via Slack by Fraser Langton -- env switch appeared to work but all API calls still hit the old environment because WORKOS_API_KEY was set in the shell.

Test plan

pnpm build passes
pnpm test passes (1621 tests)
pnpm typecheck passes
Manual test: WORKOS_API_KEY=sk_test_fake workos env switch prod --json returns single JSON with warnings array
Manual test: without env var, no warnings in output
Manual test: --api-key flag overrides env var

Summary by CodeRabbit

Release Notes

New Features
- Added warnings system for environment variable overrides with support for both JSON and human-readable output modes.
Bug Fixes
- Updated API key resolution priority: command-line flag now takes precedence over environment variable.
Tests
- Enhanced test coverage for warning emissions and API key precedence behavior.

Hono's `c.req.param()` returns `string | undefined` but these params are always present because they're defined in the route path pattern.

Previously the env var always won, making `--api-key` and `env switch` silently ineffective when WORKOS_API_KEY was set in the shell. Now the precedence follows standard CLI conventions: flag > env var > stored config. Also warns on `env switch` when WORKOS_API_KEY is set, since the env var will still override the stored environment key for commands that don't pass --api-key.

coderabbitai · 2026-04-30T15:47:25Z

Warning

Rate limit exceeded

@nicknisi has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 29 minutes and 38 seconds before requesting another review.

To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8f4c80d3-08e2-4fb3-bfa1-135ebe72e597

📥 Commits

Reviewing files that changed from the base of the PR and between 48f4680 and 7acaa3e.

📒 Files selected for processing (5)

README.md
src/commands/env.spec.ts
src/commands/env.ts
src/emulate/workos/routes/authorization-org-roles.ts
src/utils/output.ts

📝 Walkthrough

Walkthrough

Changes add warning emission for environment variable overrides and restructure API key resolution priority. The output utilities are enhanced to support warnings in both JSON and human-readable formats. API key flag now takes precedence over environment variables. Route handlers include non-null assertions for required URL parameters.

Changes

Cohort / File(s)	Summary
Output utilities and warning system `src/utils/output.ts`	Enhanced `outputSuccess` signature to accept optional `options` with `warnings` array. In JSON mode, output is restructured as an object with `status`, `message`, `data`, and `warnings`. In human mode, warnings are emitted to stderr in yellow. New `outputWarning` export added for single warning output.
Environment variable override warnings `src/commands/env.ts`, `src/commands/env.spec.ts`	`runEnvSwitch` now detects `WORKOS_API_KEY` environment variable and emits an `env_var_override` warning. Test coverage added to verify warning emission when the variable is set and its absence when not set, including JSON output validation.
API key resolution priority `src/lib/api-key.ts`, `src/lib/api-key.spec.ts`	Reordered `resolveApiKey` logic to prioritize `--api-key` flag over `WORKOS_API_KEY` environment variable. Removed redundant fallback check and updated documentation to reflect new precedence order. Tests updated to validate new priority behavior.
Route parameter assertions `src/emulate/workos/routes/authorization-org-roles.ts`, `src/emulate/workos/routes/authorization-roles.ts`	Added non-null assertions (`!`) for required URL parameters (`orgId`, `slug`) when invoking role helper functions and validation logic, clarifying that these values are definitively present at call sites.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 40.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix: --api-key flag takes precedence over WORKOS_API_KEY env var' is a concise, single-sentence description that clearly identifies the primary change: establishing correct precedence for the --api-key flag over the environment variable. While the PR also adds warning functionality and type fixes, the title accurately reflects the main behavioral objective documented in the PR summary.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/api-key-precedence-and-env-switch-warning

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Review rate limit: 0/1 reviews remaining, refill in 29 minutes and 38 seconds.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

greptile-apps · 2026-04-30T15:50:10Z

Greptile Summary

This PR fixes API key resolution priority so --api-key flag beats WORKOS_API_KEY env var (matching gh/aws/kubectl conventions), and adds a warning to env switch when the env var is present so users understand why their switch may appear ineffective. The outputSuccess helper is cleanly extended with an optional warnings array, keeping JSON consumers to a single parseable object.

Confidence Score: 5/5

Safe to merge; all changes are correct and well-tested, with only a minor spy-leak style issue in the new test helpers.

Only P2 findings present — the vi.spyOn(console, 'error') leak doesn't cause any current test failures and doesn't affect production code. Core logic (priority reorder, warning emission, JSON shape) is correct and covered by tests.

src/commands/env.spec.ts — spy teardown in the two new human-mode tests should call mockRestore().

Important Files Changed

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[resolveApiKey called] --> B{--api-key flag provided?}
    B -- yes --> C[Return flag value]
    B -- no --> D{WORKOS_API_KEY env var set?}
    D -- yes --> E[Return env var value]
    D -- no --> F{Active environment has stored key?}
    F -- yes --> G[Return stored key]
    F -- no --> H[exitWithError: no_api_key]

    subgraph env_switch [env switch command]
        I[runEnvSwitch] --> J[Save active env to config]
        J --> K{WORKOS_API_KEY env var set?}
        K -- yes --> L[Build warnings array: env_var_override]
        K -- no --> M[warnings = undefined]
        L --> N[outputSuccess with warnings]
        M --> N
    end

    subgraph output [outputSuccess]
        N --> O{JSON mode?}
        O -- yes --> P[console.log single JSON with optional warnings array]
        O -- no --> Q[console.log green message]
        Q --> R{warnings present?}
        R -- yes --> S[console.error yellow warning messages]
    end

_{Reviews (3): Last reviewed commit: "docs: update API key precedence order in..." | Re-trigger Greptile}

devin-ai-integration

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 4 additional findings.

- Remove unused `outputWarning` export (warnings are embedded in `outputSuccess` response instead) - Add missing `!` assertion on `orgId` in `listFilter` for consistency - Restore `WORKOS_API_KEY` env var in no-warning test to prevent leakage

Reflects the new flag > env var > stored config resolution order.

nicknisi added 2 commits April 30, 2026 10:46

fix: add non-null assertions for route params in authorization routes

dab94a3

Hono's `c.req.param()` returns `string | undefined` but these params are always present because they're defined in the route path pattern.

This comment was marked as resolved.

Sign in to view

devin-ai-integration Bot reviewed Apr 30, 2026

View reviewed changes

This comment was marked as resolved.

Sign in to view

nicknisi added 3 commits April 30, 2026 11:04

chore: formatting

9d173a2

fix: address PR review feedback

5b8a6ff

- Remove unused `outputWarning` export (warnings are embedded in `outputSuccess` response instead) - Add missing `!` assertion on `orgId` in `listFilter` for consistency - Restore `WORKOS_API_KEY` env var in no-warning test to prevent leakage

docs: update API key precedence order in README

7acaa3e

Reflects the new flag > env var > stored config resolution order.

nicknisi merged commit 4a18de1 into main Apr 30, 2026
7 checks passed

nicknisi deleted the fix/api-key-precedence-and-env-switch-warning branch April 30, 2026 16:22

github-actions Bot mentioned this pull request Apr 30, 2026

chore(main): release 0.13.3 #138

Merged

coderabbitai Bot mentioned this pull request May 5, 2026

feat(api): add generic workos api gateway #142

Merged

14 tasks

coderabbitai Bot mentioned this pull request May 13, 2026

fix: Make migrations API key optional #153

Merged

2 tasks

Sunbelt Computer Software

PL/B Language Development and Support

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: --api-key flag takes precedence over WORKOS_API_KEY env var#137

fix: --api-key flag takes precedence over WORKOS_API_KEY env var#137
nicknisi merged 5 commits into
mainfrom
fix/api-key-precedence-and-env-switch-warning

nicknisi commented Apr 30, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Apr 30, 2026 •

edited

Loading

Rate limit exceeded

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

greptile-apps Bot commented Apr 30, 2026 •

edited

Loading

Flowchart

Uh oh!

This comment was marked as resolved.

Uh oh!

devin-ai-integration Bot left a comment

Uh oh!

This comment was marked as resolved.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant

Sunbelt Computer Software

PL/B Language Development and Support

Uh oh!

Conversation

nicknisi commented Apr 30, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Release Notes

Uh oh!

coderabbitai Bot commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rate limit exceeded

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

greptile-apps Bot commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Flowchart

Uh oh!

This comment was marked as resolved.

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

✅ Devin Review: No Issues Found

Uh oh!

This comment was marked as resolved.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

1 participant

nicknisi commented Apr 30, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Apr 30, 2026 •

edited

Loading

greptile-apps Bot commented Apr 30, 2026 •

edited

Loading