fix: send the rate-limit header from the test browser

cmd/cloudx/client/sdks.go

@@ -22,10 +22,18 @@ const (
 	RateLimitHeaderKey = "ORY_RATE_LIMIT_HEADER"
 	ConsoleURLKey      = "ORY_CONSOLE_URL"
 	OryAPIsURLKey      = "ORY_ORYAPIS_URL"
+
+	rateLimitHeaderName = "Ory-RateLimit-Action"
 )
 
 var rateLimitHeader = os.Getenv(RateLimitHeaderKey)
 
+// RateLimitHeader returns the header that exempts a caller from Ory Network's
+// per-IP rate limits, and whether one is configured at all.
+func RateLimitHeader() (name, value string, ok bool) {
+	return rateLimitHeaderName, rateLimitHeader, rateLimitHeader != ""
+}
+
 func CloudConsoleURL(prefix string) *url.URL {
 	// we load the URL from the env here instead of init() because the tests might want to change this
 	consoleURL, err := url.ParseRequestURI(cmp.Or(os.Getenv(ConsoleURLKey), "https://console.ory.com"))
@@ -58,7 +66,7 @@ func newSDKConfiguration(uri string) *cloud.Configuration {
 	conf.OperationServers = nil
 	conf.HTTPClient = &http.Client{Timeout: time.Second * 30}
 	if rateLimitHeader != "" {
-		conf.AddDefaultHeader("Ory-RateLimit-Action", rateLimitHeader)
+		conf.AddDefaultHeader(rateLimitHeaderName, rateLimitHeader)
 	}
 	return conf
 }
@@ -126,7 +134,7 @@ func (h *CommandHelper) newProjectHTTPClient(ctx context.Context) (*http.Client,
 		Source: tokenSource,
 	}
 	if rateLimitHeader != "" {
-		c.Transport = &setHeaderTransport{base: c.Transport, key: "Ory-RateLimit-Action", value: rateLimitHeader}
+		c.Transport = &setHeaderTransport{base: c.Transport, key: rateLimitHeaderName, value: rateLimitHeader}
 	}
 
 	return c, baseURL, nil

cmd/cloudx/relationtuples/permissions.go

@@ -12,7 +12,24 @@ import (
 func NewAllowedCmd() *cobra.Command {
 	cmd := check.NewCheckCmd()
 	wrapForOryCLI(cmd)
-	cmd.Use = "allowed <subject> <relation> <namespace> <object>"
+
+	cmd.Use = "allowed <subject> <relation> <object_namespace>:<object_id>"
+	// wrapForOryCLI sets the aliases of the relationships command, which do not
+	// belong on a permission check.
+	cmd.Aliases = nil
+	cmd.Long = `Check whether a subject has a relation on an object.
+
+The subject is either a subject set ` + "`<namespace>:<object>#<relation>`" + ` or a
+plain subject ID. Ory Network no longer accepts relationships written with a
+plain subject ID, so a subject set is what a check against it will match.
+
+Passing the object as two separate arguments still works but is deprecated;
+use ` + "`<object_namespace>:<object_id>`" + ` instead.`
+	cmd.Example = `$ {{ .CommandPath }} 'groups:engineering#member' view documents:readme
+
+{
+  "allowed": true
+}`
 
 	return cmd
 }

cmd/cloudx/relationtuples/relationtuples_test.go

@@ -92,12 +92,20 @@ func TestCRUD(t *testing.T) {
 	t.Parallel()
 	createLegacyNamespace(t, defaultProject.Id, `{"name": "n", "id": 0}`)
 
+	// Ory Network rejects writes carrying a subject_id — "subject_id is not
+	// supported; please migrate to subject sets" — for every form of it (plain
+	// string, UUID, namespaced) and under both legacy and OPL namespaces, so the
+	// tuples here are subject sets.
 	tuple := func(object string) string {
 		return fmt.Sprintf(`[{
 	"namespace": "n",
 	"object": %q,
 	"relation": "r",
-	"subject_id": "s"
+	"subject_set": {
+		"namespace": "n",
+		"object": "s",
+		"relation": "r"
+	}
 }]`, object)
 	}
 	create := func(t *testing.T, object string) string {
@@ -111,14 +119,6 @@ func TestCRUD(t *testing.T) {
 		require.NoError(t, err, stderr)
 		return stdout
 	}
-	isAllowed := func(t *testing.T, subject, relation, namespace, object string) string {
-		stdout, stderr, err := defaultCmd.Exec(nil,
-			"is", "allowed", subject, relation, namespace, object,
-			"--project", defaultProject.Id, "--format", "json")
-		require.NoError(t, err, stderr)
-		return stdout
-	}
-
 	// 1. create a tuple
 	stdout := create(t, "o1")
 	require.JSONEq(t, tuple("o1"), stdout)
@@ -127,9 +127,11 @@ func TestCRUD(t *testing.T) {
 	stdout = list(t)
 	require.JSONEq(t, tuple("o1"), gjson.Get(stdout, "relation_tuples").Raw, stdout)
 
-	// check that it is allowed
-	stdout = isAllowed(t, "s", "r", "n", "o1")
-	require.JSONEq(t, `{"allowed":true}`, stdout, stdout)
+	// This does not assert on `ory is allowed`. The check runs against a
+	// subject-set tuple, but answers false whatever it is given: a permission
+	// that evaluates to true needs a relationship whose subject is a plain ID,
+	// which the server refuses to store. Asserting that would pin the server's
+	// state rather than the CLI's behaviour.
 
 	// 3. delete with --all but without --force
 	stdout, stderr, err := defaultCmd.Exec(nil, "delete", "relation-tuples", "--format", "json", "--project", defaultProject.Id,

cmd/cloudx/testhelpers/redact_test.go

@@ -0,0 +1,138 @@
+// Copyright © 2026 Ory Corp
+// SPDX-License-Identifier: Apache-2.0
+
+package testhelpers
+
+import (
+	"archive/zip"
+	"encoding/json"
+	"io"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestRedactInZip pins the guarantee the Playwright traces depend on: this
+// repository is public and CI uploads the traces as an artifact, so the
+// rate-limit header value must not survive anywhere inside one.
+func TestRedactInZip(t *testing.T) {
+	const secret = `s3cret"value\with-escapes`
+
+	writeArchive := func(t *testing.T, entries map[string]string) string {
+		path := filepath.Join(t.TempDir(), "trace.zip")
+		f, err := os.Create(path)
+		require.NoError(t, err)
+		defer f.Close()
+
+		w := zip.NewWriter(f)
+		for name, content := range entries {
+			e, err := w.Create(name)
+			require.NoError(t, err)
+			_, err = e.Write([]byte(content))
+			require.NoError(t, err)
+		}
+		require.NoError(t, w.Close())
+		return path
+	}
+
+	readArchive := func(t *testing.T, path string) map[string]string {
+		r, err := zip.OpenReader(path)
+		require.NoError(t, err)
+		defer r.Close()
+
+		out := make(map[string]string, len(r.File))
+		for _, f := range r.File {
+			src, err := f.Open()
+			require.NoError(t, err)
+			content, err := io.ReadAll(src)
+			require.NoError(t, err)
+			require.NoError(t, src.Close())
+			out[f.Name] = string(content)
+		}
+		return out
+	}
+
+	// The trace stores headers as JSON string values, so the secret appears in
+	// its escaped spelling rather than verbatim.
+	escaped, err := json.Marshal(secret)
+	require.NoError(t, err)
+	jsonEncoded := string(escaped)
+
+	t.Run("case=removes the secret in both spellings", func(t *testing.T) {
+		path := writeArchive(t, map[string]string{
+			"trace.network": `{"headers":[{"name":"Ory-RateLimit-Action","value":` + jsonEncoded + `}]}`,
+			"trace.trace":   "prefix " + secret + " suffix",
+			"resources/1":   "a response body mentioning nothing",
+		})
+
+		require.NoError(t, redactInZip(path, secret))
+
+		for name, content := range readArchive(t, path) {
+			assert.NotContains(t, content, secret, "%s still holds the raw secret", name)
+			assert.NotContains(t, content, jsonEncoded[1:len(jsonEncoded)-1], "%s still holds the escaped secret", name)
+		}
+	})
+
+	t.Run("case=leaves the rest of the trace intact", func(t *testing.T) {
+		path := writeArchive(t, map[string]string{
+			"trace.trace": "keep me " + secret + " keep me too",
+			"resources/1": "untouched",
+		})
+
+		require.NoError(t, redactInZip(path, secret))
+
+		got := readArchive(t, path)
+		assert.Equal(t, "keep me "+redactedPlaceholder+" keep me too", got["trace.trace"])
+		assert.Equal(t, "untouched", got["resources/1"])
+	})
+
+	t.Run("case=no configured secret leaves the archive alone", func(t *testing.T) {
+		path := writeArchive(t, map[string]string{"trace.trace": "verbatim"})
+
+		require.NoError(t, redactInZip(path, ""))
+
+		assert.Equal(t, "verbatim", readArchive(t, path)["trace.trace"])
+	})
+
+	t.Run("case=an unreadable archive is an error, so the caller can delete it", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "not-a-zip.zip")
+		require.NoError(t, os.WriteFile(path, []byte("definitely not a zip"), 0o600))
+
+		assert.Error(t, redactInZip(path, secret))
+	})
+
+	t.Run("case=a missing archive is not an error", func(t *testing.T) {
+		// Tracing does not always leave a file behind, and an archive that was
+		// never written cannot leak anything.
+		assert.NoError(t, redactInZip(filepath.Join(t.TempDir(), "absent.zip"), secret))
+	})
+
+	// Tracing().Stop() assembles the archive before the call that finishes
+	// tracing, and that call may fail on its own, so a trace can be left behind
+	// complete or truncated even when stopping reports an error. Neither may
+	// reach the uploaded artifact carrying the secret.
+	t.Run("case=an unrewritable archive is removed", func(t *testing.T) {
+		path := filepath.Join(t.TempDir(), "truncated.zip")
+		full := writeArchive(t, map[string]string{"trace.trace": secret})
+		content, err := os.ReadFile(full)
+		require.NoError(t, err)
+		require.NoError(t, os.WriteFile(path, content[:len(content)/2], 0o600))
+
+		redactOrRemoveTrace(t, path, secret)
+
+		_, err = os.Stat(path)
+		assert.ErrorIs(t, err, os.ErrNotExist, "a trace that could not be redacted must not survive")
+	})
+
+	t.Run("case=a rewritable archive is kept, redacted", func(t *testing.T) {
+		path := writeArchive(t, map[string]string{"trace.trace": "before " + secret + " after"})
+
+		redactOrRemoveTrace(t, path, secret)
+
+		require.FileExists(t, path, "a redacted trace is still worth uploading")
+		assert.Equal(t, "before "+redactedPlaceholder+" after", readArchive(t, path)["trace.trace"])
+	})
+}