[sujal-maheshwari2004]

What was wrong

Only whole-line # comments were skipped. In a trailing comment every word became a field, and any non-keyword word was taken as the org (last one wins):

• tokens file (authn.LoadTokens): <tok> acme rw # ci runner → token scoped to org runner.
• clients.txt / groups.txt (configLines / parseGrant): prompt-admins rw # platform team (the README's own example) → tokens issued with org:"team".

Fix

• A field starting with # (after the token / client id / group) ends the line.
• A second org-looking field is now an error instead of a silent last-wins (LoadTokens returns an error; priompt-auth serve exits with <file>: client|group <name>: two orgs (...)). LoadTokens also rejects two expiries.

Tests

New: TestLoadTokensTrailingComment, TestLoadTokensRejectsExtraFields (authn), TestConfigTrailingComments, TestParseGrantRejectsExtraFields (cmd/priompt-auth).

Before the fix (on main):

--- FAIL: TestLoadTokensTrailingComment
    trailing comment changed scope: want org=acme rw, got {Org:runner ... Write:true}
    comment-only tail: want admin read-only, got {Org:orgs ...}
--- FAIL: TestLoadTokensRejectsExtraFields
    "tok acme rw ci runner": want an error, got map[tok:{Org:runner ...}]
--- FAIL: TestConfigTrailingComments
    trailing comments parsed as fields: [{group:prompt-admins grant:{org:team rw:true}} {group:acme-readers grant:{org:read-only rw:false}}]
    trailing comment changed the client grant: {secretHash:abcd grant:{org:runner rw:true}}

After: GOWORK=off go build ./... && go vet ./... && go test ./...

ok  	github.com/priompt/auth/authn
ok  	github.com/priompt/auth/cmd/priompt-auth

Live run: priompt-auth serve -clients-file clients.txt with ci-bot sha256:… acme rw # ci runner, then POST /token (client_credentials), decoded claims:

before: {"sub":"ci-bot","org":"runner","rw":true,...}
after:  {"sub":"ci-bot","org":"acme","rw":true,...}

And a line with no # (ci-bot sha256:abcd acme rw ci runner) now refuses to start:

bad.txt: client ci-bot: two orgs ("acme", "ci"); a trailing comment needs a leading #
exit=1

Fixes #2

🤖 Generated with Claude Code