From 3e79dbb3f568c01004efa9c5db2614a291b0da2b Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Wed, 18 Sep 2024 01:34:01 +0400 Subject: [PATCH] feat(cli): warning when logged in and using token at the same time --- cli/packages/cmd/export.go | 8 +++---- cli/packages/cmd/folder.go | 8 +++---- cli/packages/cmd/root.go | 3 +++ cli/packages/cmd/run.go | 8 +++---- cli/packages/cmd/secrets.go | 32 ++++++++++++++------------ cli/packages/config/config.go | 1 + cli/packages/models/cli.go | 5 ++-- cli/packages/util/auth.go | 43 +++++++++++++++++++++++++++++++++++ cli/packages/util/helper.go | 12 ++++++---- 9 files changed, 87 insertions(+), 33 deletions(-) diff --git a/cli/packages/cmd/export.go b/cli/packages/cmd/export.go index f6b028b7a..cac014834 100644 --- a/cli/packages/cmd/export.go +++ b/cli/packages/cmd/export.go @@ -94,9 +94,9 @@ var exportCmd = &cobra.Command{ IncludeImport: includeImports, } - if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER { + if util.ShouldUseInfisicalToken(token, []string{util.SERVICE_TOKEN_IDENTIFIER}) { request.InfisicalToken = token.Token - } else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER { + } else if util.ShouldUseInfisicalToken(token, []string{util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER}) { request.UniversalAuthAccessToken = token.Token } @@ -141,9 +141,9 @@ var exportCmd = &cobra.Command{ authParams := models.ExpandSecretsAuthentication{} - if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER { + if util.ShouldUseInfisicalToken(token, []string{util.SERVICE_TOKEN_IDENTIFIER}) { authParams.InfisicalToken = token.Token - } else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER { + } else if util.ShouldUseInfisicalToken(token, []string{util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER}) { authParams.UniversalAuthAccessToken = token.Token } diff --git a/cli/packages/cmd/folder.go b/cli/packages/cmd/folder.go index 538f1e2dc..a634abbeb 100644 --- a/cli/packages/cmd/folder.go +++ b/cli/packages/cmd/folder.go @@ -53,9 +53,9 @@ var getCmd = &cobra.Command{ FoldersPath: foldersPath, } - if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER { + if util.ShouldUseInfisicalToken(token, []string{util.SERVICE_TOKEN_IDENTIFIER}) { request.InfisicalToken = token.Token - } else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER { + } else if util.ShouldUseInfisicalToken(token, []string{util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER}) { request.UniversalAuthAccessToken = token.Token } @@ -125,7 +125,7 @@ var createCmd = &cobra.Command{ WorkspaceId: projectId, } - if token != nil && (token.Type == util.SERVICE_TOKEN_IDENTIFIER || token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER) { + if util.ShouldUseInfisicalToken(token, nil) { params.InfisicalToken = token.Token } @@ -193,7 +193,7 @@ var deleteCmd = &cobra.Command{ FolderPath: folderPath, } - if token != nil && (token.Type == util.SERVICE_TOKEN_IDENTIFIER || token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER) { + if util.ShouldUseInfisicalToken(token, nil) { params.InfisicalToken = token.Token } diff --git a/cli/packages/cmd/root.go b/cli/packages/cmd/root.go index 482c6f78a..2f6b4cefc 100644 --- a/cli/packages/cmd/root.go +++ b/cli/packages/cmd/root.go @@ -44,6 +44,7 @@ func init() { rootCmd.PersistentPreRun = func(cmd *cobra.Command, args []string) { silent, err := cmd.Flags().GetBool("silent") config.INFISICAL_URL = util.AppendAPIEndpoint(config.INFISICAL_URL) + if err != nil { util.HandleError(err) } @@ -51,6 +52,8 @@ func init() { if !util.IsRunningInDocker() && !silent { util.CheckForUpdate() } + + config.INFISICAL_SILENT_MODE = silent } // if config.INFISICAL_URL is set to the default value, check if INFISICAL_URL is set in the environment diff --git a/cli/packages/cmd/run.go b/cli/packages/cmd/run.go index fa5176d89..d33d3c2a8 100644 --- a/cli/packages/cmd/run.go +++ b/cli/packages/cmd/run.go @@ -439,9 +439,9 @@ func executeCommandWithWatchMode(commandFlag string, args []string, watchModeInt func fetchAndFormatSecretsForShell(request models.GetAllSecretsParameters, projectConfigDir string, secretOverriding bool, shouldExpandSecrets bool, token *models.TokenDetails) (models.InjectableEnvironmentResult, error) { - if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER { + if util.ShouldUseInfisicalToken(token, []string{util.SERVICE_TOKEN_IDENTIFIER}) { request.InfisicalToken = token.Token - } else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER { + } else if util.ShouldUseInfisicalToken(token, []string{util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER}) { request.UniversalAuthAccessToken = token.Token } @@ -461,9 +461,9 @@ func fetchAndFormatSecretsForShell(request models.GetAllSecretsParameters, proje authParams := models.ExpandSecretsAuthentication{} - if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER { + if util.ShouldUseInfisicalToken(token, []string{util.SERVICE_TOKEN_IDENTIFIER}) { authParams.InfisicalToken = token.Token - } else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER { + } else if util.ShouldUseInfisicalToken(token, []string{util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER}) { authParams.UniversalAuthAccessToken = token.Token } diff --git a/cli/packages/cmd/secrets.go b/cli/packages/cmd/secrets.go index c9ac36852..d0bbdb596 100644 --- a/cli/packages/cmd/secrets.go +++ b/cli/packages/cmd/secrets.go @@ -87,9 +87,9 @@ var secretsCmd = &cobra.Command{ Recursive: recursive, } - if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER { + if util.ShouldUseInfisicalToken(token, []string{util.SERVICE_TOKEN_IDENTIFIER}) { request.InfisicalToken = token.Token - } else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER { + } else if util.ShouldUseInfisicalToken(token, []string{util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER}) { request.UniversalAuthAccessToken = token.Token } @@ -106,9 +106,10 @@ var secretsCmd = &cobra.Command{ if shouldExpandSecrets { authParams := models.ExpandSecretsAuthentication{} - if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER { + + if util.ShouldUseInfisicalToken(token, []string{util.SERVICE_TOKEN_IDENTIFIER}) { authParams.InfisicalToken = token.Token - } else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER { + } else if util.ShouldUseInfisicalToken(token, []string{util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER}) { authParams.UniversalAuthAccessToken = token.Token } @@ -160,19 +161,19 @@ var secretsSetCmd = &cobra.Command{ util.HandleError(err, "Unable to parse flag") } - if (token == nil) { + if token == nil { util.RequireLocalWorkspaceFile() } environmentName, _ := cmd.Flags().GetString("env") if !cmd.Flags().Changed("env") { - environmentFromWorkspace := util.GetEnvFromWorkspaceFile() + environmentFromWorkspace := util.GetEnvFromWorkspaceFile() if environmentFromWorkspace != "" { environmentName = environmentFromWorkspace } } - projectId, err := cmd.Flags().GetString("projectId") + projectId, err := cmd.Flags().GetString("projectId") if err != nil { util.HandleError(err, "Unable to parse flag") } @@ -188,7 +189,7 @@ var secretsSetCmd = &cobra.Command{ } var secretOperations []models.SecretSetOperation - if token != nil && (token.Type == util.SERVICE_TOKEN_IDENTIFIER || token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER) { + if util.ShouldUseInfisicalToken(token, nil) { if projectId == "" { util.PrintErrorMessageAndExit("When using service tokens or machine identities, you must set the --projectId flag") } @@ -282,7 +283,7 @@ var secretsDeleteCmd = &cobra.Command{ projectId = workspaceFile.WorkspaceId } - if token != nil && (token.Type == util.SERVICE_TOKEN_IDENTIFIER || token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER) { + if util.ShouldUseInfisicalToken(token, nil) { httpClient.SetAuthToken(token.Token) } else { util.RequireLogin() @@ -390,9 +391,9 @@ func getSecretsByNames(cmd *cobra.Command, args []string) { Recursive: recursive, } - if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER { + if util.ShouldUseInfisicalToken(token, []string{util.SERVICE_TOKEN_IDENTIFIER}) { request.InfisicalToken = token.Token - } else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER { + } else if util.ShouldUseInfisicalToken(token, []string{util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER}) { request.UniversalAuthAccessToken = token.Token } @@ -409,9 +410,10 @@ func getSecretsByNames(cmd *cobra.Command, args []string) { if shouldExpand { authParams := models.ExpandSecretsAuthentication{} - if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER { + + if util.ShouldUseInfisicalToken(token, []string{util.SERVICE_TOKEN_IDENTIFIER}) { authParams.InfisicalToken = token.Token - } else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER { + } else if util.ShouldUseInfisicalToken(token, []string{util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER}) { authParams.UniversalAuthAccessToken = token.Token } @@ -485,9 +487,9 @@ func generateExampleEnv(cmd *cobra.Command, args []string) { IncludeImport: true, } - if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER { + if util.ShouldUseInfisicalToken(token, []string{util.SERVICE_TOKEN_IDENTIFIER}) { request.InfisicalToken = token.Token - } else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER { + } else if util.ShouldUseInfisicalToken(token, []string{util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER}) { request.UniversalAuthAccessToken = token.Token } diff --git a/cli/packages/config/config.go b/cli/packages/config/config.go index c5e162c92..a9640236e 100644 --- a/cli/packages/config/config.go +++ b/cli/packages/config/config.go @@ -1,5 +1,6 @@ package config +var INFISICAL_SILENT_MODE bool var INFISICAL_URL string var INFISICAL_URL_MANUAL_OVERRIDE string var INFISICAL_LOGIN_URL string diff --git a/cli/packages/models/cli.go b/cli/packages/models/cli.go index 1bad5e327..3a6484e89 100644 --- a/cli/packages/models/cli.go +++ b/cli/packages/models/cli.go @@ -63,8 +63,9 @@ type DynamicSecretLease struct { } type TokenDetails struct { - Type string - Token string + Type string + Token string + PassedAsFlag bool } type SingleFolder struct { diff --git a/cli/packages/util/auth.go b/cli/packages/util/auth.go index cdcd7b50a..8333d2427 100644 --- a/cli/packages/util/auth.go +++ b/cli/packages/util/auth.go @@ -1,5 +1,12 @@ package util +import ( + "fmt" + + "github.com/Infisical/infisical-merge/packages/config" + "github.com/Infisical/infisical-merge/packages/models" +) + type AuthStrategyType string var AuthStrategy = struct { @@ -43,3 +50,39 @@ func IsAuthMethodValid(authMethod string, allowUserAuth bool) (isValid bool, str } return false, "" } + +func ShouldUseInfisicalToken(token *models.TokenDetails, validTokenTypes []string) bool { + + if token == nil { + return false + } + + // If nil is passed, we assume both service and universal tokens are acceptable. + if validTokenTypes == nil { + validTokenTypes = []string{SERVICE_TOKEN_IDENTIFIER, UNIVERSAL_AUTH_TOKEN_IDENTIFIER} + } + + for _, tokenType := range validTokenTypes { + if token.Type != tokenType { + continue + } + + details, err := GetCurrentLoggedInUserDetails() + if err == nil && details.IsUserLoggedIn && !details.LoginExpired && !config.INFISICAL_SILENT_MODE { + + var usingFrom string + if token.PassedAsFlag { + usingFrom = "--token flag" + } else { + usingFrom = "INFISICAL_TOKEN environment variable" + } + PrintWarning(fmt.Sprintf("You are currently logged in, but the command will be using the token provided from the %s.", usingFrom)) + + } + + return true + } + + return false + +} diff --git a/cli/packages/util/helper.go b/cli/packages/util/helper.go index b758ebd9d..bcae127b5 100644 --- a/cli/packages/util/helper.go +++ b/cli/packages/util/helper.go @@ -87,6 +87,8 @@ func GetInfisicalToken(cmd *cobra.Command) (token *models.TokenDetails, err erro return nil, err } + passedAsFlag := infisicalToken != "" + if infisicalToken == "" { // If no flag is passed, we first check for the universal auth access token env variable. infisicalToken = os.Getenv(INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN_NAME) @@ -101,14 +103,16 @@ func GetInfisicalToken(cmd *cobra.Command) (token *models.TokenDetails, err erro if strings.HasPrefix(infisicalToken, "st.") { return &models.TokenDetails{ - Type: SERVICE_TOKEN_IDENTIFIER, - Token: infisicalToken, + Type: SERVICE_TOKEN_IDENTIFIER, + Token: infisicalToken, + PassedAsFlag: passedAsFlag, }, nil } return &models.TokenDetails{ - Type: UNIVERSAL_AUTH_TOKEN_IDENTIFIER, - Token: infisicalToken, + Type: UNIVERSAL_AUTH_TOKEN_IDENTIFIER, + Token: infisicalToken, + PassedAsFlag: passedAsFlag, }, nil }