cli/auth: surface the secret caveat in auth token help

58f798b·

georg·2w ago·1 file·+18 added/-13 removed

The "treat the output as a secret" warning only lived in the Go doc comment, which --help never shows. Now that the command is discoverable, put the caveat in Short (so it appears in the entire auth --help subcommand list) and add a Long + curl Example that carry it in full. Trim the doc comment to point at them instead of duplicating the prose.

Addresses Copilot review comment on #1619.

Sessions

56c477a9ab1fView transcript

Changes

1

• cmd/entire/cli

• Mauth.go+18/-13

125 unmodified lines

// --- token ------------------------------------------------------------------

// newAuthTokenCmd prints the active control-plane bearer to stdout so scripts
// (and ad-hoc curl) can authenticate against the core API without re-deriving
// the keychain slot — e.g.
//
//	curl -H "Authorization: Bearer $(entire auth token)" "$CORE/api/v1/clusters"
//
// It emits a live credential, so treat the output as a secret. It resolves the
// same bearer the API client would — ENTIRE_TOKEN verbatim when set, otherwise
// the active context's login JWT, refreshed if it's near expiry — and prints
// nothing but the token (errors and the not-logged-in hint go to stderr) so
// command substitution stays clean.
// newAuthTokenCmd prints the active control-plane bearer to stdout for
// scripting. The user-facing Long and Example carry the detail and the
// "treat the output as a secret" caveat; the token resolves the same way the
// API client's does (ENTIRE_TOKEN verbatim when set, otherwise the active
// context's login JWT, refreshed if it's near expiry), and only the token is
// printed — errors and the not-logged-in hint go to stderr so command
// substitution stays clean.
func newAuthTokenCmd() *cobra.Command {
    var insecureHTTPAuth bool
    cmd := &cobra.Command{
        Use:   "token",
        Short: "Print the active control-plane bearer token (for scripting)",
        Args:  cobra.NoArgs,
        Short: "Print the active control-plane bearer token — a live credential, treat as a secret",
        Long: "Print the active control-plane bearer token to stdout so scripts and\n" +
        "ad-hoc curl can authenticate against the core API without re-deriving the\n" +
        "keychain slot.\n\n" +
        "The output is a live credential — treat it as a secret. It is the same\n" +
        "bearer the API client uses: ENTIRE_TOKEN verbatim when set, otherwise the\n" +
        "active context's login JWT (refreshed if it's near expiry). Only the token\n" +
        "is printed to stdout; errors and the not-logged-in hint go to stderr so\n" +
        "command substitution stays clean.",
        Example: "  curl -H \"Authorization: Bearer $(entire auth token)\" \"$CORE/api/v1/clusters\"",
        Args:    cobra.NoArgs,
        RunE: func(cmd *cobra.Command, _ []string) error {
            // Refresh may exchange/refresh over the network; honor the\n			// plain-HTTP opt-in before resolving so local dev cores work.