Repository: nats-io/nsc (go)

Issue:
importing an activation token must handle IssuerAccount
When importing a token, if the account issuer is set the import must set the src account to IssuerAccount.

Pull request:
FIX #71
importing an activation token must handle the account issuer field, and set account to the account issuer if set.

Patch:
diff --git a/cmd/addimport.go b/cmd/addimport.go
index ba06fd6..2e13ca6 100644
--- a/cmd/addimport.go
+++ b/cmd/addimport.go
@@ -235,6 +235,9 @@ func (p *AddImportParams) initFromActivation(ctx ActionCtx) error {
 	}
 
 	p.srcAccount.publicKey = ac.Issuer
+	if ac.IssuerAccount != "" {
+		p.srcAccount.publicKey = ac.IssuerAccount
+	}
 
 	if ac.Subject != "public" && p.claim.Subject != ac.Subject {
 		return fmt.Errorf("activation is not intended for this account - it is for %q", ac.Subject)
diff --git a/cmd/generateactivation.go b/cmd/generateactivation.go
index add790c..2ec86b8 100644
--- a/cmd/generateactivation.go
+++ b/cmd/generateactivation.go
@@ -274,7 +274,7 @@ func (p *GenerateActivationParams) Run(ctx ActionCtx) error {
 		return err
 	}
 	if p.claims.Subject != spub {
-		p.activation.IssuerAccount = p.claims.Issuer
+		p.activation.IssuerAccount = p.claims.Subject
 	}
 
 	p.Token, err = p.activation.Encode(p.signerKP)


Test patch:
diff --git a/cmd/addimport_test.go b/cmd/addimport_test.go
index b4082e7..58f13ed 100644
--- a/cmd/addimport_test.go
+++ b/cmd/addimport_test.go
@@ -235,3 +235,40 @@ func Test_AddImport_PublicStreamInteractive(t *testing.T) {
 	require.Equal(t, jwt.Stream, ac.Imports[0].Type)
 	require.Equal(t, apub, ac.Imports[0].Account)
 }
+
+func Test_AddImportWithSigningKeyToken(t *testing.T) {
+	ts := NewTestStore(t, "test")
+	defer ts.Done(t)
+
+	_, pk, sk := CreateAccountKey(t)
+	ts.AddAccount(t, "A")
+	_, _, err := ExecuteCmd(createEditAccount(), "--sk", pk)
+	require.NoError(t, err)
+	ts.AddExport(t, "A", jwt.Stream, "foobar.>", false)
+
+	ts.AddAccount(t, "B")
+	token := ts.GenerateActivationWithSigner(t, "A", "foobar.>", "B", sk)
+	tp := filepath.Join(ts.Dir, "token.jwt")
+	require.NoError(t, Write(tp, []byte(token)))
+	bc, err := ts.Store.ReadAccountClaim("B")
+	require.NoError(t, err)
+
+	// decode the activation
+	acc, err := jwt.DecodeActivationClaims(token)
+	require.NoError(t, err)
+	// issuer is the signing key
+	require.Equal(t, acc.Issuer, pk)
+	// issuer account is account A
+	ac, err := ts.Store.ReadAccountClaim("A")
+	require.NoError(t, err)
+	require.Equal(t, acc.IssuerAccount, ac.Subject)
+	// account to import is B
+	require.Equal(t, acc.Subject, bc.Subject)
+
+	_, _, err = ExecuteCmd(createAddImportCmd(), "--account", "B", "--token", tp)
+	require.NoError(t, err)
+	acb, err := ts.Store.ReadAccountClaim("B")
+	require.NoError(t, err)
+	require.Len(t, acb.Imports, 1)
+	require.Equal(t, acb.Imports[0].Account, ac.Subject)
+}
diff --git a/cmd/cmd_test.go b/cmd/cmd_test.go
index f8d2914..a2eeb24 100644
--- a/cmd/cmd_test.go
+++ b/cmd/cmd_test.go
@@ -105,6 +105,8 @@ func ExecuteCmd(root *cobra.Command, args ...string) (stdout string, stderr stri
 	os.Stdout = old
 	_, _ = io.Copy(&stdoutBuf, r)
 
+	ResetSharedFlags()
+
 	return stdoutBuf.String(), stderrBuf.String(), err
 }
 
@@ -126,5 +128,7 @@ func ExecuteInteractiveCmd(root *cobra.Command, inputs []interface{}, args ...st
 	os.Stdout = old
 	_, _ = io.Copy(&stdoutBuf, r)
 
+	ResetSharedFlags()
+
 	return stdoutBuf.String(), stderrBuf.String(), err
 }
diff --git a/cmd/generateactivation_test.go b/cmd/generateactivation_test.go
index ca31b0f..b835074 100644
--- a/cmd/generateactivation_test.go
+++ b/cmd/generateactivation_test.go
@@ -229,5 +229,5 @@ func Test_GenerateActivationUsingSigningKey(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, actc.Issuer, pk)
 	require.True(t, ac.DidSign(actc))
-	require.Equal(t, actc.IssuerAccount, ac.Issuer)
+	require.Equal(t, actc.IssuerAccount, ac.Subject)
 }
diff --git a/cmd/util_test.go b/cmd/util_test.go
index bb77835..bb9db9c 100644
--- a/cmd/util_test.go
+++ b/cmd/util_test.go
@@ -45,6 +45,10 @@ type TestStore struct {
 // Some globals must be reset
 func ResetForTests() {
 	config = ToolConfig{}
+	ResetSharedFlags()
+}
+
+func ResetSharedFlags() {
 	KeyPathFlag = ""
 }