Accept INI config files that open with a comment

readOrMigrate routed anything not starting with '[' to the legacy
"host token" path, so a valid INI file whose first line was a comment
failed the host check and was rejected as corrupt, locking the user
out of every command. Detect INI by parsing, since parseIni already
skips comment and blank lines, and fall back to the legacy format only
when no sections are found.

Author: myabc

components/configuration/profiles.go

@@ -283,28 +283,27 @@ func readOrMigrate(data []byte) (*iniFile, bool, error) {
 		return newIniFile(), false, nil
 	}
 
-	// Old format: no section headers. Check prefix rather than Contains so that
-	// IPv6 host URLs (e.g. http://[::1]) are not mis-detected as INI files.
-	if !strings.HasPrefix(content, "[") {
-		clean := common.SanitizeLineBreaks(content)
-		parts := strings.SplitN(clean, " ", 2)
-		// Require the first field to look like a real host URL, so a corrupt
-		// file is not migrated into bogus credentials just because it happens
-		// to contain a space.
-		if len(parts) == 2 && looksLikeHost(parts[0]) && parts[1] != "" {
-			f := newIniFile()
-			f.set(DefaultProfile, "host", parts[0])
-			f.set(DefaultProfile, "token", parts[1])
-			return f, true, nil
-		}
-		return nil, false, invalidConfigError()
-	}
-
-	f := parseIni(data)
-	if len(f.sections) == 0 {
-		return nil, false, invalidConfigError()
-	}
-	return f, false, nil
+	// Detect INI by parsing rather than a raw prefix check: parseIni skips
+	// comment and blank lines, so a valid INI file that opens with a comment
+	// still yields section headers. Any section present means INI format.
+	if f := parseIni(data); len(f.sections) > 0 {
+		return f, false, nil
+	}
+
+	// Old format: no section headers, so treat the content as a single
+	// "host token" line. Require the first field to look like a real host URL,
+	// so a corrupt file is not migrated into bogus credentials just because it
+	// happens to contain a space. looksLikeHost accepts IPv6 host URLs
+	// (e.g. http://[::1]).
+	clean := common.SanitizeLineBreaks(content)
+	parts := strings.SplitN(clean, " ", 2)
+	if len(parts) == 2 && looksLikeHost(parts[0]) && parts[1] != "" {
+		f := newIniFile()
+		f.set(DefaultProfile, "host", parts[0])
+		f.set(DefaultProfile, "token", parts[1])
+		return f, true, nil
+	}
+	return nil, false, invalidConfigError()
 }
 
 func invalidConfigError() error {

components/configuration/profiles_test.go

@@ -382,3 +382,22 @@ func TestMigration_oldFormatRewrittenAsIni(t *testing.T) {
 		t.Errorf("after migration: expected [default], got %v", profiles)
 	}
 }
+
+// A valid INI file may open with a comment line. parseIni skips comments, so
+// the reader must treat it as INI rather than mistaking it for the legacy
+// "host token" format and rejecting it as corrupt.
+func TestReadConfig_IniWithLeadingComment(t *testing.T) {
+	setupTempConfig(t)
+	writeRaw(t, "# my openproject config\n[default]\nhost = https://commented.example.com\ntoken = commenttoken\n")
+
+	host, token, err := configuration.ReadConfig("default")
+	if err != nil {
+		t.Fatalf("ReadConfig returned error for commented INI: %v", err)
+	}
+	if host != "https://commented.example.com" {
+		t.Errorf("host = %q, want %q", host, "https://commented.example.com")
+	}
+	if token != "commenttoken" {
+		t.Errorf("token = %q, want %q", token, "commenttoken")
+	}
+}