fix: De Morgans law fix in lint

Author: dnitsch

cmd/saml.go

@@ -227,11 +227,15 @@ func ConfigFromFlags(fileConfig *credentialexchange.CredentialConfig, rf *RootCm
 
 func configValid(config *credentialexchange.CredentialConfig) error {
 	v := validator.New()
-
+	ssoVal := !config.IsSso
+	if config.IsSso {
+		ssoVal = len(config.SsoRole) > 0 && len(config.SsoRegion) > 0
+	}
 	v.RequiredString(config.ProviderUrl, "provider-url", "provider url must be specified").
 		RequiredString(config.BaseConfig.Role, "role", "role must be provided").
 		RequiredString(config.PrincipalArn, "principal-arn", "principal ARN must be provided").
-		CustomRule(!(len(config.BaseConfig.Role) > 1 && len(config.SsoRole) > 1), "sso-role", "sso-role cannot be specified when role is also set")
+		CustomRule(ssoVal, "is-sso", "sso-role must be specified when is-sso is set").
+		CustomRule((len(config.BaseConfig.Role) > 1 && len(config.SsoRole) < 1) || (len(config.BaseConfig.Role) < 1 && len(config.SsoRole) > 1), "sso-role", "sso-role cannot be specified when role is also set")
 
 	if v.IsFailed() {
 		return fmt.Errorf("%w %#q", ErrValidationFailed, v.Errors())

cmd/saml_test.go

@@ -68,19 +68,38 @@ func Test_ConfigMerge_fails_with_missing(t *testing.T) {
 			t.Error(err)
 		}
 	})
-	t.Run("role and sso-role provided", func(t *testing.T) {
+	t.Run("is-sso set but sso-role not set", func(t *testing.T) {
 
 		conf := &credentialexchange.CredentialConfig{
 			BaseConfig: credentialexchange.BaseConfig{
 				BrowserExecutablePath: "/foo/path",
 				Role:                  "",
 				RoleChain:             []string{"role-123"},
 			},
-			SsoRegion:   "foo",
-			SsoRole:     "foo:bar",
-			ProviderUrl: "https://my-idp.com/?app_id=testdd",
+			PrincipalArn: "some-arn",
+			SsoRegion:    "foo",
+			SsoRole:      "foo:bar",
+			ProviderUrl:  "https://my-idp.com/?app_id=testdd",
 		}
-		err := cmd.ConfigFromFlags(conf, &cmd.RootCmdFlags{}, &cmd.SamlCmdFlags{}, "me")
+		err := cmd.ConfigFromFlags(conf, &cmd.RootCmdFlags{}, &cmd.SamlCmdFlags{Role: "wrong-role"}, "me")
+		if !errors.Is(err, cmd.ErrValidationFailed) {
+			t.Error(err)
+		}
+	})
+	t.Run("role and sso-role both provided", func(t *testing.T) {
+
+		conf := &credentialexchange.CredentialConfig{
+			BaseConfig: credentialexchange.BaseConfig{
+				BrowserExecutablePath: "/foo/path",
+				Role:                  "",
+				RoleChain:             []string{"role-123"},
+			},
+			PrincipalArn: "some-arn",
+			SsoRegion:    "foo",
+			SsoRole:      "foo:bar",
+			ProviderUrl:  "https://my-idp.com/?app_id=testdd",
+		}
+		err := cmd.ConfigFromFlags(conf, &cmd.RootCmdFlags{}, &cmd.SamlCmdFlags{Role: "wrong-role"}, "me")
 		if !errors.Is(err, cmd.ErrValidationFailed) {
 			t.Error(err)
 		}