feat(cli): warning when logged in and using token at the same time

cli/packages/cmd/export.go

@@ -94,9 +94,9 @@ var exportCmd = &cobra.Command{
 			IncludeImport: includeImports,
 		}
 
-		if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER {
+		if util.ShouldUseInfisicalToken(token, []string{util.SERVICE_TOKEN_IDENTIFIER}) {
 			request.InfisicalToken = token.Token
-		} else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER {
+		} else if util.ShouldUseInfisicalToken(token, []string{util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER}) {
 			request.UniversalAuthAccessToken = token.Token
 		}
 
@@ -141,9 +141,9 @@ var exportCmd = &cobra.Command{
 
 			authParams := models.ExpandSecretsAuthentication{}
 
-			if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER {
+			if util.ShouldUseInfisicalToken(token, []string{util.SERVICE_TOKEN_IDENTIFIER}) {
 				authParams.InfisicalToken = token.Token
-			} else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER {
+			} else if util.ShouldUseInfisicalToken(token, []string{util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER}) {
 				authParams.UniversalAuthAccessToken = token.Token
 			}
 

cli/packages/cmd/folder.go

@@ -53,9 +53,9 @@ var getCmd = &cobra.Command{
 			FoldersPath: foldersPath,
 		}
 
-		if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER {
+		if util.ShouldUseInfisicalToken(token, []string{util.SERVICE_TOKEN_IDENTIFIER}) {
 			request.InfisicalToken = token.Token
-		} else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER {
+		} else if util.ShouldUseInfisicalToken(token, []string{util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER}) {
 			request.UniversalAuthAccessToken = token.Token
 		}
 
@@ -125,7 +125,7 @@ var createCmd = &cobra.Command{
 			WorkspaceId: projectId,
 		}
 
-		if token != nil && (token.Type == util.SERVICE_TOKEN_IDENTIFIER || token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER) {
+		if util.ShouldUseInfisicalToken(token, nil) {
 			params.InfisicalToken = token.Token
 		}
 
@@ -193,7 +193,7 @@ var deleteCmd = &cobra.Command{
 			FolderPath:  folderPath,
 		}
 
-		if token != nil && (token.Type == util.SERVICE_TOKEN_IDENTIFIER || token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER) {
+		if util.ShouldUseInfisicalToken(token, nil) {
 			params.InfisicalToken = token.Token
 		}
 

cli/packages/cmd/root.go

@@ -44,6 +44,7 @@ func init() {
 	rootCmd.PersistentPreRun = func(cmd *cobra.Command, args []string) {
 		silent, err := cmd.Flags().GetBool("silent")
 		config.INFISICAL_URL = util.AppendAPIEndpoint(config.INFISICAL_URL)
+
 		if err != nil {
 			util.HandleError(err)
 		}
@@ -51,6 +52,8 @@ func init() {
 		if !util.IsRunningInDocker() && !silent {
 			util.CheckForUpdate()
 		}
+
+		config.INFISICAL_SILENT_MODE = silent
 	}
 
 	// if config.INFISICAL_URL is set to the default value, check if INFISICAL_URL is set in the environment

cli/packages/cmd/run.go

@@ -439,9 +439,9 @@ func executeCommandWithWatchMode(commandFlag string, args []string, watchModeInt
 
 func fetchAndFormatSecretsForShell(request models.GetAllSecretsParameters, projectConfigDir string, secretOverriding bool, shouldExpandSecrets bool, token *models.TokenDetails) (models.InjectableEnvironmentResult, error) {
 
-	if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER {
+	if util.ShouldUseInfisicalToken(token, []string{util.SERVICE_TOKEN_IDENTIFIER}) {
 		request.InfisicalToken = token.Token
-	} else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER {
+	} else if util.ShouldUseInfisicalToken(token, []string{util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER}) {
 		request.UniversalAuthAccessToken = token.Token
 	}
 
@@ -461,9 +461,9 @@ func fetchAndFormatSecretsForShell(request models.GetAllSecretsParameters, proje
 
 		authParams := models.ExpandSecretsAuthentication{}
 
-		if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER {
+		if util.ShouldUseInfisicalToken(token, []string{util.SERVICE_TOKEN_IDENTIFIER}) {
 			authParams.InfisicalToken = token.Token
-		} else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER {
+		} else if util.ShouldUseInfisicalToken(token, []string{util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER}) {
 			authParams.UniversalAuthAccessToken = token.Token
 		}
 

cli/packages/cmd/secrets.go

@@ -87,9 +87,9 @@ var secretsCmd = &cobra.Command{
 			Recursive:     recursive,
 		}
 
-		if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER {
+		if util.ShouldUseInfisicalToken(token, []string{util.SERVICE_TOKEN_IDENTIFIER}) {
 			request.InfisicalToken = token.Token
-		} else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER {
+		} else if util.ShouldUseInfisicalToken(token, []string{util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER}) {
 			request.UniversalAuthAccessToken = token.Token
 		}
 
@@ -106,9 +106,10 @@ var secretsCmd = &cobra.Command{
 
 		if shouldExpandSecrets {
 			authParams := models.ExpandSecretsAuthentication{}
-			if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER {
+
+			if util.ShouldUseInfisicalToken(token, []string{util.SERVICE_TOKEN_IDENTIFIER}) {
 				authParams.InfisicalToken = token.Token
-			} else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER {
+			} else if util.ShouldUseInfisicalToken(token, []string{util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER}) {
 				authParams.UniversalAuthAccessToken = token.Token
 			}
 
@@ -160,19 +161,19 @@ var secretsSetCmd = &cobra.Command{
 			util.HandleError(err, "Unable to parse flag")
 		}
 
-		if (token == nil) {
+		if token == nil {
 			util.RequireLocalWorkspaceFile()
 		}
 
 		environmentName, _ := cmd.Flags().GetString("env")
 		if !cmd.Flags().Changed("env") {
-			environmentFromWorkspace := util.GetEnvFromWorkspaceFile()	
+			environmentFromWorkspace := util.GetEnvFromWorkspaceFile()
 			if environmentFromWorkspace != "" {
 				environmentName = environmentFromWorkspace
 			}
 		}
 
-				projectId, err := cmd.Flags().GetString("projectId")
+		projectId, err := cmd.Flags().GetString("projectId")
 		if err != nil {
 			util.HandleError(err, "Unable to parse flag")
 		}
@@ -188,7 +189,7 @@ var secretsSetCmd = &cobra.Command{
 		}
 
 		var secretOperations []models.SecretSetOperation
-		if token != nil && (token.Type == util.SERVICE_TOKEN_IDENTIFIER || token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER) {
+		if util.ShouldUseInfisicalToken(token, nil) {
 			if projectId == "" {
 				util.PrintErrorMessageAndExit("When using service tokens or machine identities, you must set the --projectId flag")
 			}
@@ -282,7 +283,7 @@ var secretsDeleteCmd = &cobra.Command{
 			projectId = workspaceFile.WorkspaceId
 		}
 
-		if token != nil && (token.Type == util.SERVICE_TOKEN_IDENTIFIER || token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER) {
+		if util.ShouldUseInfisicalToken(token, nil) {
 			httpClient.SetAuthToken(token.Token)
 		} else {
 			util.RequireLogin()
@@ -390,9 +391,9 @@ func getSecretsByNames(cmd *cobra.Command, args []string) {
 		Recursive:     recursive,
 	}
 
-	if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER {
+	if util.ShouldUseInfisicalToken(token, []string{util.SERVICE_TOKEN_IDENTIFIER}) {
 		request.InfisicalToken = token.Token
-	} else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER {
+	} else if util.ShouldUseInfisicalToken(token, []string{util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER}) {
 		request.UniversalAuthAccessToken = token.Token
 	}
 
@@ -409,9 +410,10 @@ func getSecretsByNames(cmd *cobra.Command, args []string) {
 
 	if shouldExpand {
 		authParams := models.ExpandSecretsAuthentication{}
-		if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER {
+
+		if util.ShouldUseInfisicalToken(token, []string{util.SERVICE_TOKEN_IDENTIFIER}) {
 			authParams.InfisicalToken = token.Token
-		} else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER {
+		} else if util.ShouldUseInfisicalToken(token, []string{util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER}) {
 			authParams.UniversalAuthAccessToken = token.Token
 		}
 
@@ -485,9 +487,9 @@ func generateExampleEnv(cmd *cobra.Command, args []string) {
 		IncludeImport: true,
 	}
 
-	if token != nil && token.Type == util.SERVICE_TOKEN_IDENTIFIER {
+	if util.ShouldUseInfisicalToken(token, []string{util.SERVICE_TOKEN_IDENTIFIER}) {
 		request.InfisicalToken = token.Token
-	} else if token != nil && token.Type == util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER {
+	} else if util.ShouldUseInfisicalToken(token, []string{util.UNIVERSAL_AUTH_TOKEN_IDENTIFIER}) {
 		request.UniversalAuthAccessToken = token.Token
 	}
 

cli/packages/config/config.go

@@ -1,5 +1,6 @@
 package config
 
+var INFISICAL_SILENT_MODE bool
 var INFISICAL_URL string
 var INFISICAL_URL_MANUAL_OVERRIDE string
 var INFISICAL_LOGIN_URL string

cli/packages/models/cli.go

@@ -63,8 +63,9 @@ type DynamicSecretLease struct {
 }
 
 type TokenDetails struct {
-	Type  string
+	Type         string
-	Token string
+	Token        string
+	PassedAsFlag bool
 }
 
 type SingleFolder struct {

cli/packages/util/auth.go

@@ -1,5 +1,12 @@
 package util
 
+import (
+	"fmt"
+
+	"github.com/Infisical/infisical-merge/packages/config"
+	"github.com/Infisical/infisical-merge/packages/models"
+)
+
 type AuthStrategyType string
 
 var AuthStrategy = struct {
@@ -43,3 +50,39 @@ func IsAuthMethodValid(authMethod string, allowUserAuth bool) (isValid bool, str
 	}
 	return false, ""
 }
+
+func ShouldUseInfisicalToken(token *models.TokenDetails, validTokenTypes []string) bool {
+
+	if token == nil {
+		return false
+	}
+
+	// If nil is passed, we assume both service and universal tokens are acceptable.
+	if validTokenTypes == nil {
+		validTokenTypes = []string{SERVICE_TOKEN_IDENTIFIER, UNIVERSAL_AUTH_TOKEN_IDENTIFIER}
+	}
+
+	for _, tokenType := range validTokenTypes {
+		if token.Type != tokenType {
+			continue
+		}
+
+		details, err := GetCurrentLoggedInUserDetails()
+		if err == nil && details.IsUserLoggedIn && !details.LoginExpired && !config.INFISICAL_SILENT_MODE {
+
+			var usingFrom string
+			if token.PassedAsFlag {
+				usingFrom = "--token flag"
+			} else {
+				usingFrom = "INFISICAL_TOKEN environment variable"
+			}
+			PrintWarning(fmt.Sprintf("You are currently logged in, but the command will be using the token provided from the %s.", usingFrom))
+
+		}
+
+		return true
+	}
+
+	return false
+
+}

cli/packages/util/helper.go

@@ -87,6 +87,8 @@ func GetInfisicalToken(cmd *cobra.Command) (token *models.TokenDetails, err erro
 		return nil, err
 	}
 
+	passedAsFlag := infisicalToken != ""
+
 	if infisicalToken == "" { // If no flag is passed, we first check for the universal auth access token env variable.
 		infisicalToken = os.Getenv(INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN_NAME)
 
@@ -101,14 +103,16 @@ func GetInfisicalToken(cmd *cobra.Command) (token *models.TokenDetails, err erro
 
 	if strings.HasPrefix(infisicalToken, "st.") {
 		return &models.TokenDetails{
-			Type:  SERVICE_TOKEN_IDENTIFIER,
+			Type:         SERVICE_TOKEN_IDENTIFIER,
-			Token: infisicalToken,
+			Token:        infisicalToken,
+			PassedAsFlag: passedAsFlag,
 		}, nil
 	}
 
 	return &models.TokenDetails{
-		Type:  UNIVERSAL_AUTH_TOKEN_IDENTIFIER,
+		Type:         UNIVERSAL_AUTH_TOKEN_IDENTIFIER,
-		Token: infisicalToken,
+		Token:        infisicalToken,
+		PassedAsFlag: passedAsFlag,
 	}, nil
 
 }