{"record":{"id":"8f0d29904b1da39a","repo":"windmill-labs/windmill","slug":"when-base-url-is-set-token-is-required-for-pr","errorCode":null,"errorMessage":"When --base-url is set, --token is required for protection-rules.","messagePattern":"When --base-url is set, --token is required for protection-rules\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/src/commands/protection-rules/file.ts","lineNumber":108,"sourceCode":"//   1. explicit --base-url + --token  -> used as-is (stateless CI; no profile\n//      or wmill.yaml baseUrl required)\n//   2. otherwise, the stored profile matching wmill.yaml workspaces.<ws>\n//      (its baseUrl + token), with an explicit --token overriding the\n//      stored token\n//\n// Throws a clean error if the key is unknown or nothing resolves it — callers\n// decide whether to skip (--all) or fail (named arg).\nexport async function configureClientForWorkspace(\n  opts: GlobalOptions,\n  ws: string,\n  resolver: WorkspaceResolver,\n): Promise<string> {\n  const wsId = resolver.backendId(ws); // throws if not in wmill.yaml\n\n  // 1. Explicit credentials — honor them directly, like other commands do.\n  if (opts.baseUrl) {\n    if (!opts.token) {\n      throw new Error(\n        \"When --base-url is set, --token is required for protection-rules.\",\n      );\n    }\n    setClient(opts.token, opts.baseUrl.replace(/\\/+$/, \"\"));\n    return wsId;\n  }\n\n  // 2. Stored-profile resolution. Fresh opts so resolveWorkspace's per-call\n  // cache can't bleed across keys.\n  const resolved = await tryResolveBranchWorkspace({ ...opts }, ws);\n  if (!resolved) {\n    throw new Error(\n      `Could not resolve credentials for workspace '${ws}'. Either pass ` +\n        `--base-url and --token, or ensure wmill.yaml workspaces.${ws} has a ` +\n        `baseUrl and you've run 'wmill workspace add' for it.`,\n    );\n  }\n  // An explicit --token overrides the stored profile's token.","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/windmill-labs/windmill/blob/e474e8803ce2ff5c2df09a58dab51d45f5c922ca/cli/src/commands/protection-rules/file.ts#L90-L126","documentation":"Pair-check in configureClientForWorkspace: --base-url was supplied without --token. Protection-rules supports stateless CI usage via explicit credentials, but only as a pair — a base URL alone gives no authentication, and the fallback profile lookup is skipped the moment --base-url is set. The input at fault is the CLI invocation missing --token.","triggerScenarios":"Thrown at cli/src/commands/protection-rules/file.ts:108 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Pass both: --base-url https://... --token <token>","Drop --base-url to fall back to the stored profile / wmill.yaml workspaces.<ws> baseUrl resolution"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e474e8803ce2ff5c2df09a58dab51d45f5c922ca","analyzedAt":"2026-09-03T12:38:19.024Z","contentChangedAt":"2026-09-03T12:38:19.024Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}