Environment
bl 1.20.0, macOS- Alibaba Cloud international account, console gateway
ap-southeast-1 / international
- Profile:
token-plan (base_url https://token-plan.ap-southeast-1.maas.aliyuncs.com)
- Credentials: RAM user (Permanent AccessKey only) with
AliyunBailianFullAccess
Expected (per #95)
After bl auth login --open-api, a console command that hits NotLogined silently refreshes the access token from AK/SK and retries successfully.
Actual
The refresh runs and GenerateCLIAccessToken returns 200 with a cliAccessToken, but the retried console call still fails with Console session is not logged in or has expired. (exit 3). Every console command is affected (usage token-plan, usage free, workspace list).
Two separate problems observed:
1. Region resolution falls back to cn for non-DashScope base URLs
packages/core/src/auth/refresh-token.ts → resolveRegion() only matches the three REGIONS DashScope URLs. A token-plan profile (*.ap-southeast-1.maas.aliyuncs.com) doesn't match, so the refresh goes to modelstudio.cn-beijing.aliyuncs.com for an international account.
> POST https://bailian-singapore-cs.alibabacloud.com/cli/api.json?action=IntlBroadScopeAspnGateway&...
< 200
Refreshing access token...
> POST https://modelstudio.cn-beijing.aliyuncs.com/modelstudio/cli/generateAccessToken
< 200 OK
> POST https://bailian-singapore-cs.alibabacloud.com/cli/api.json?...
< 200
Error: Console session is not logged in or has expired.
2. Even with the correct intl host, the token is rejected
To rule out (1) I created a profile with base_url=https://dashscope-intl.aliyuncs.com, console_site=international, console_region=ap-southeast-1, then bl auth login --open-api. The refresh now hits modelstudio.ap-southeast-1.aliyuncs.com and gets a token, but the intl console gateway still answers NotLogined for all console commands.
So on the international site the token produced by GenerateCLIAccessToken does not appear to be accepted by IntlBroadScopeAspnGateway (at least for a RAM user). Is there a required RAM permission / workspace membership / site setting for this to work, or is intl not supported yet?
Side effect worth noting
bl auth login --open-api and every failed auto-refresh overwrite access_token in config.json, which replaces a still-valid browser-login console session with an unusable token. A guard (only overwrite when the new token actually passes a console call) would avoid that.
Repro
- International account, RAM user with
AliyunBailianFullAccess, Permanent AccessKey.
bl auth login --console (works), then bl auth login --open-api --access-key-id ... --access-key-secret ...bl usage token-plan --verbose → refresh 200, console still NotLogined.
Environment
bl1.20.0, macOSap-southeast-1/internationaltoken-plan(base_urlhttps://token-plan.ap-southeast-1.maas.aliyuncs.com)AliyunBailianFullAccessExpected (per #95)
After
bl auth login --open-api, a console command that hitsNotLoginedsilently refreshes the access token from AK/SK and retries successfully.Actual
The refresh runs and
GenerateCLIAccessTokenreturns 200 with acliAccessToken, but the retried console call still fails withConsole session is not logged in or has expired.(exit 3). Every console command is affected (usage token-plan,usage free,workspace list).Two separate problems observed:
1. Region resolution falls back to
cnfor non-DashScope base URLspackages/core/src/auth/refresh-token.ts→resolveRegion()only matches the threeREGIONSDashScope URLs. Atoken-planprofile (*.ap-southeast-1.maas.aliyuncs.com) doesn't match, so the refresh goes tomodelstudio.cn-beijing.aliyuncs.comfor an international account.2. Even with the correct intl host, the token is rejected
To rule out (1) I created a profile with
base_url=https://dashscope-intl.aliyuncs.com,console_site=international,console_region=ap-southeast-1, thenbl auth login --open-api. The refresh now hitsmodelstudio.ap-southeast-1.aliyuncs.comand gets a token, but the intl console gateway still answers NotLogined for all console commands.So on the international site the token produced by
GenerateCLIAccessTokendoes not appear to be accepted byIntlBroadScopeAspnGateway(at least for a RAM user). Is there a required RAM permission / workspace membership / site setting for this to work, or is intl not supported yet?Side effect worth noting
bl auth login --open-apiand every failed auto-refresh overwriteaccess_tokeninconfig.json, which replaces a still-valid browser-login console session with an unusable token. A guard (only overwrite when the new token actually passes a console call) would avoid that.Repro
AliyunBailianFullAccess, Permanent AccessKey.bl auth login --console(works), thenbl auth login --open-api --access-key-id ... --access-key-secret ...bl usage token-plan --verbose→ refresh 200, console still NotLogined.