[nick-y-snyk]

Pull Request Submission Checklist

• Follows CONTRIBUTING guidelines
• Commit messages
  are release-note ready, emphasizing
  what was changed, not how.
• Includes detailed description of changes
• Contains risk assessment (Low | Medium | High)
• Highlights breaking API changes (if applicable)
• Links to automated tests covering new functionality
• Includes manual testing instructions (if necessary)
• Updates relevant GitBook documentation (PR link: ___)
• Includes product update to be announced in the next stable release notes

What does this PR do?

snyk auth --client-id=<id> --client-secret="<PKCS#8 PEM>" logs in with the OAuth client credentials grant and a private_key_jwt client assertion (RFC 7523). The CLI stores the key and the minted token, so later commands work without the flags and mint a new token from the key when it expires. Other secrets are still sent as a shared secret. A rejected key exits with code 2 and keeps the existing login.

The logic is in snyk/go-application-framework#854. This PR pins GAF to that branch (d2f8720), which also brings in GAF v0.36.0. It stays a draft until #854 merges and the pin moves to a release.

Where should the reviewer start?

GAF #854, then test/jest/acceptance/auth.spec.ts.

How should this be manually tested?

On an instance with machine clients enabled:

1. snyk auth --client-id=<machine client id> --client-secret="$(cat key.pem)"
2. snyk whoami --experimental with no flags succeeds.

What's the product update that needs to be communicated to CLI users?

snyk auth accepts an unencrypted PKCS#8 RSA or P-256 private key as --client-secret.

Risk assessment (Low | Medium | High)?

Medium. Only PEM secrets take the new path, but the GAF bump includes v0.36.0.

Done: auth.spec.ts 12/12 on a public build; eslint, prettier, golangci clean; snyk-axi test sca 0 issues.
Pending: CI, GitBook docs.

What are the relevant tickets?

CLI-2022

---

Note

Medium Risk
Authentication and credential storage change via a multi-minor GAF bump; only PEM-shaped secrets take the new path, but the framework upgrade may affect other CLI behavior.

Overview
Bumps go-application-framework from v0.35.1 to v0.38.0 in cliv2 and cliv2-private so snyk auth --client-id=… --client-secret=<PEM> can use OAuth client credentials with a private_key_jwt assertion (RFC 7523). Shared-secret --client-secret behavior is unchanged.

Acceptance coverage adds auth.spec.ts scenarios that generate an RSA key, assert the CLI posts client_assertion_type=jwt-bearer to /oauth2/token, checks INTERNAL_MACHINE_IDENTITY_STORAGE / INTERNAL_OAUTH_TOKEN_STORAGE, and verifies later API calls use Bearer vs legacy token when auth fails. fake-server.ts simulates the JWT client-credentials grant (issuer check only), rejects wrong token auth on /authorization/*, and the suite uses a stable fake API token name.

^{Reviewed by Cursor Bugbot for commit 6bd39dd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues
✅	Secrets	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

	Warnings
⚠️	There are multiple commits on your branch, please squash them locally before merging!

Generated by 🚫 dangerJS against 6bd39dd

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f374de2. Configure here.}

[cursor]

Tests inherit process token environment

Medium Severity

The new private-key cases expect Bearer access_token_value after a successful login and token random after a rejected key, but env still spreads process.env. A set SNYK_TOKEN or SNYK_OAUTH_TOKEN overrides the cleared config and the host placeholder, so those header and ignore exit assertions can fail in CI.

Additional Locations (1)

• test/jest/acceptance/auth.spec.ts#L23-L30

 

^{Reviewed by Cursor Bugbot for commit f374de2. Configure here.}

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 8 relevant code sections from 5 files (average relevance: 1.00) CLAUDE.md (4 segments, lines 152-274) CONTRIBUTING.md (lines 135-311) package.json (lines 1-242) scripts/upgrade-snyk-go-dependencies.go (lines 1-149) cliv2/pkg/core/main.go (lines 1-197)

🤖 Repository instructions applied (from AGENTS.md)