use separate key for organization list (#1051)

otherwise we overwrite groups info on orgs refresh

Author: sivukhin

internal/cmd/cache.go

@@ -123,7 +123,11 @@ func invalidateGroupsCache(org string) {
 }
 
 const (
-	ORGS_CACHE_KEY         = "organizations"
+	// ORGS_CACHE_KEY must not share a viper namespace with the per-org group
+	// cache (orgKey builds "organizations.<org>.groups"). Viper treats dots as
+	// nested maps, so a plain "organizations" key for the orgs list would
+	// collide with that nested key and the two caches would clobber each other.
+	ORGS_CACHE_KEY         = "organizations_list"
 	ORGS_CACHE_TTL_SECONDS = 30 * 60
 )
 

internal/cmd/cache_test.go

@@ -59,6 +59,36 @@ func Test_setDbTokenCache_expired(t *testing.T) {
 	}
 }
 
+// Regression test: the orgs-list cache and the per-org groups cache must not
+// share a viper namespace, otherwise writing one clobbers the other (viper
+// stores dotted keys as nested maps). See ORGS_CACHE_KEY.
+func Test_orgsAndGroupsCacheCoexist(t *testing.T) {
+	orgs := []turso.Organization{{ID: "org-id-123", Slug: "org-a", Type: "team"}}
+	groups := []turso.Group{{UUID: "group-uuid-abc", Name: "group-a"}}
+
+	assertCoexist := func(t *testing.T) {
+		t.Helper()
+		if got := getOrgsCache(); len(got) != 1 || got[0].ID != "org-id-123" {
+			t.Errorf("orgs cache clobbered: getOrgsCache() = %#v", got)
+		}
+		if got := getGroupsCache("org-a"); len(got) != 1 || got[0].UUID != "group-uuid-abc" {
+			t.Errorf("groups cache clobbered: getGroupsCache() = %#v", got)
+		}
+	}
+
+	t.Run("orgs then groups", func(t *testing.T) {
+		setOrgsCache(orgs)
+		setGroupsCache("org-a", groups)
+		assertCoexist(t)
+	})
+
+	t.Run("groups then orgs", func(t *testing.T) {
+		setGroupsCache("org-a", groups)
+		setOrgsCache(orgs)
+		assertCoexist(t)
+	})
+}
+
 func Test_setLocationsCache(t *testing.T) {
 	locs := map[string]string{
 		"ams": "Amsterdam, Netherlands",

internal/cmd/db_generatetoken.go

@@ -81,7 +81,7 @@ func getToken(
 		if database.Group == "" {
 			return "", errors.New("--group flag can only be set with group databases")
 		}
-		return client.Groups.Token(database.Group, expiration, readOnly, claim, fineGrainedPermissions)
+		return getGroupToken(client, turso.Group{Name: database.Group}, expiration, readOnly, claim, fineGrainedPermissions)
 	}
 	if !flags.V3Api() {
 		return getTokenV2(client, database, expiration, readOnly, claim, fineGrainedPermissions)

internal/cmd/group_tokens.go

@@ -127,7 +127,7 @@ var groupCreateTokenCmd = &cobra.Command{
 		if err != nil {
 			return err
 		}
-		token, err := client.Groups.Token(group.Name, expiration, flags.ReadOnly(), claim, permission)
+		token, err := getGroupToken(client, group, expiration, flags.ReadOnly(), claim, permission)
 		if err != nil {
 			return fmt.Errorf("error creating token: %w", err)
 		}
@@ -137,6 +137,37 @@ var groupCreateTokenCmd = &cobra.Command{
 	},
 }
 
+// getGroupToken creates a group token, using the V3 API when enabled and the
+// org/group IDs can be resolved. The V3 endpoint does not support attach
+// claims, so requests with a claim fall back to the V2 API.
+func getGroupToken(
+	client *turso.Client,
+	group turso.Group,
+	expiration string,
+	readOnly bool,
+	claim *turso.PermissionsClaim,
+	fineGrainedPermissions []flags.FineGrainedPermissions,
+) (string, error) {
+	if !flags.V3Api() || claim != nil {
+		return client.Groups.Token(group.Name, expiration, readOnly, claim, fineGrainedPermissions)
+	}
+	orgID, err := tryResolveOrgID(client)
+	if err != nil {
+		return "", err
+	}
+	groupID := group.UUID
+	if groupID == "" {
+		groupID, err = tryResolveGroupID(client, group.Name)
+		if err != nil {
+			return "", err
+		}
+	}
+	if orgID == "" || groupID == "" {
+		return client.Groups.Token(group.Name, expiration, readOnly, claim, fineGrainedPermissions)
+	}
+	return client.GroupsV3.Token(orgID, groupID, expiration, readOnly, fineGrainedPermissions)
+}
+
 func validateDBNames(client *turso.Client, dbNames []string) error {
 	databasesMap, err := getDatabasesMap(client, false)
 	if err != nil {

internal/cmd/ids.go

@@ -5,8 +5,6 @@ import (
 )
 
 func tryResolveOrgID(client *turso.Client) (string, error) {
-	groups := getGroupsCache(client.Org)
-
 	slug := client.Org
 	if orgs := getOrgsCache(); orgs != nil {
 		if id := findOrgID(orgs, slug); id != "" {
@@ -18,7 +16,6 @@ func tryResolveOrgID(client *turso.Client) (string, error) {
 		return "", err
 	}
 	setOrgsCache(orgs)
-	setGroupsCache(client.Org, groups)
 	return findOrgID(orgs, slug), nil
 }
 

internal/turso/groups_v3.go

@@ -3,6 +3,9 @@ package turso
 import (
 	"fmt"
 	"net/http"
+	"net/url"
+
+	"github.com/tursodatabase/turso-cli/internal/flags"
 )
 
 type GroupsV3Client client
@@ -52,3 +55,46 @@ func (g *GroupsV3Client) Get(orgID, groupID string) (Group, error) {
 	}
 	return resp.Group, nil
 }
+
+func (g *GroupsV3Client) Token(
+	orgID, groupID string,
+	expiration string,
+	readOnly bool,
+	fineGrainedPermissions []flags.FineGrainedPermissions,
+) (string, error) {
+	q := url.Values{}
+	if expiration != "" {
+		q.Set("expiration", expiration)
+	}
+	if readOnly {
+		q.Set("authorization", "read-only")
+	}
+	path := g.url(orgID, "/"+groupID+"/auth/tokens")
+	if enc := q.Encode(); enc != "" {
+		path += "?" + enc
+	}
+
+	req := GroupTokenRequest{FineGrainedPermissions: fineGrainedPermissions}
+	body, err := marshal(req)
+	if err != nil {
+		return "", fmt.Errorf("could not serialize request body: %w", err)
+	}
+	r, err := g.client.Post(path, body)
+	if err != nil {
+		return "", fmt.Errorf("failed to get group token: %w", err)
+	}
+	defer r.Body.Close()
+
+	if r.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("failed to get group token: %w", parseResponseError(r))
+	}
+
+	type response struct {
+		Jwt string `json:"jwt"`
+	}
+	resp, err := unmarshal[response](r)
+	if err != nil {
+		return "", err
+	}
+	return resp.Jwt, nil
+}