fix(lk): --dev under --user-auth is an error

cmd/lk/credential_property_test.go

@@ -538,15 +538,15 @@ func requestProject(line string) (string, bool) {
 	return strings.TrimSuffix(host, ".test"), true
 }
 
-// mustFail is set when lk can't act: both mode flags at once, a Public API
-// command outside --user-auth, --dev with an inline key or secret outside
-// --user-auth, or, under --user-auth, no user who can act (no unexpired
-// session, a --user with no unexpired session, or a Public API URL nobody is
-// signed in to). Every drawn user is signed in to publicAPI.
+// mustFail is set when lk can't act: both mode flags at once, --dev under
+// --user-auth, a Public API command outside --user-auth, --dev with an inline
+// key or secret outside --user-auth, or, under --user-auth, no user who can
+// act (no unexpired session, a --user with no unexpired session, or a Public
+// API URL nobody is signed in to). Every drawn user is signed in to publicAPI.
 func (c credentialCase) mustFail() bool {
 	_, key, secret := c.inlineCredentials()
 	switch {
-	case c.userAuth && c.legacyAuth:
+	case c.userAuth && (c.legacyAuth || c.dev):
 		return true
 	case !c.userAuth:
 		return c.command.publicAPI || c.dev && (key != "" || secret != "")

cmd/lk/main.go

@@ -226,6 +226,10 @@ func initLogger(ctx context.Context, cmd *cli.Command) (context.Context, error)
 	}
 	util.DetectBackground()
 
+	if err := devUnderUserAuthGate(cmd); err != nil {
+		return nil, err
+	}
+
 	showBanner(ctx, cmd)
 
 	// Nudge users still on API-key auth toward the new account-based flow.

cmd/lk/testdata/script/dev-with-user-auth.txtar

@@ -0,0 +1,35 @@
+# --dev under --user-auth is an error naming what to remove. lk never acts
+# on the session's project instead of the dev server: the fake would answer
+# that project's server, so lk can only fail by refusing.
+respond POST http://one.test/twirp/livekit.RoomService/ListRooms 200 ''
+respond POST http://dev.test/twirp/livekit.RoomService/ListRooms 200 ''
+respond GET http://publicapi.test/v0/projects 200 '{"items":[{"id":"p_1","name":"one"}]}'
+
+! exec lk --user-auth --dev --url ws://dev.test room list
+stderr '^--dev can''t be combined with --user-auth; remove --user-auth or drop --dev$'
+
+! exec lk --user-auth project list --dev
+stderr '^--dev can''t be combined with --user-auth; remove --user-auth or drop --dev$'
+
+requests
+! stdout .
+
+# --dev alone still uses the dev credentials, at --url, with a user signed in.
+exec lk --dev --url ws://dev.test room list
+stderr '^Using dev credentials$'
+requests
+cmp stdout want-requests
+
+-- home/.livekit/cli-config.yaml --
+default_user: u_1
+users:
+  - id: u_1
+    email: dev@example.com
+    session_token: st_1
+    api_url: http://publicapi.test
+    projects:
+      - project_id: p_1
+        name: one
+        url: ws://one.test
+-- want-requests --
+POST http://dev.test/twirp/livekit.RoomService/ListRooms apikey=devkey

cmd/lk/user_auth.go

@@ -91,6 +91,16 @@ func userAuthGate(cmd *cli.Command) error {
 	return nil
 }
 
+// devUnderUserAuthGate refuses --dev under --user-auth. --dev asks for the
+// local dev server's API key, which no user-auth path reads, so lk would
+// otherwise act on the session's cloud project instead of the dev server.
+func devUnderUserAuthGate(cmd *cli.Command) error {
+	if userAuthEnabled(cmd) && cmd.Bool("dev") {
+		return errors.New("--dev can't be combined with --user-auth; remove --user-auth or drop --dev")
+	}
+	return nil
+}
+
 // authModeFlags declares, for a dual-mode command, which flags are valid only in
 // one auth mode. It lets a command reject cross-mode misuse up front with a clear
 // message instead of silently ignoring a flag the active mode can't honor:

cmd/lk/user_auth_test.go

@@ -112,6 +112,34 @@ func TestUserAuthEnabled(t *testing.T) {
 	assert.False(t, enabled(t, "--legacy-auth"))
 }
 
+// TestDevUnderUserAuthGate checks that --dev under --user-auth, in either
+// spelling, is an error, and that each flag alone is not.
+func TestDevUnderUserAuthGate(t *testing.T) {
+	gate := func(t *testing.T, args ...string) error {
+		t.Helper()
+		var err error
+		cmd := &cli.Command{
+			Name: "lk",
+			Flags: []cli.Flag{
+				&cli.BoolFlag{Name: "user-auth", Aliases: []string{"experimental-auth"}},
+				&cli.BoolFlag{Name: "dev"},
+			},
+			Action: func(_ context.Context, cmd *cli.Command) error {
+				err = devUnderUserAuthGate(cmd)
+				return nil
+			},
+		}
+		require.NoError(t, cmd.Run(context.Background(), append([]string{"lk"}, args...)))
+		return err
+	}
+
+	const want = "--dev can't be combined with --user-auth; remove --user-auth or drop --dev"
+	assert.EqualError(t, gate(t, "--user-auth", "--dev"), want)
+	assert.EqualError(t, gate(t, "--experimental-auth", "--dev"), want)
+	assert.NoError(t, gate(t, "--dev"))
+	assert.NoError(t, gate(t, "--user-auth"))
+}
+
 func TestRequireUserSessionAPIURL(t *testing.T) {
 	const staging = "https://beta-api.staging.livekit.cloud"
 	setHome(t, t.TempDir())