review fixes

Author: cgoetz-inovex

docs/stackit_beta_intake_user_create.md

@@ -13,7 +13,7 @@ stackit beta intake user create [flags]
 ### Examples
 
 ```
-  Create a new Intake User with required parameters
+  Create a new Intake User with required parameters, reading the password from stdin
   $ stackit beta intake user create --display-name intake-user --intake-id xxx --password -
 
   Create a new Intake User for the dead-letter queue with labels

internal/cmd/beta/alb/observability-credentials/add/add.go

@@ -93,7 +93,7 @@ func parseInput(p *print.Printer, cmd *cobra.Command, _ []string) (*inputModel,
 		Username:        flags.FlagToStringPointer(p, cmd, usernameFlag),
 		Displayname:     flags.FlagToStringPointer(p, cmd, displaynameFlag),
 	}
-	pw, err := flags.ResolveSecretFlagWithAutoPrompt(p, cmd, passwordFlag) //nolint:staticcheck // preserve existing functionality until deprecation period is over
+	pw, err := flags.ResolveSecretFlagWithAutoPrompt(p, cmd, passwordFlag) //nolint:staticcheck // Deprecated: preserve automatic prompting until 2027-04 (STACKITCLI-549).
 	if err != nil {
 		return nil, err
 	}

internal/cmd/beta/alb/observability-credentials/add/add_test.go

@@ -118,6 +118,7 @@ func TestParseInput(t *testing.T) {
 			}),
 		},
 		{
+			// Deprecated compatibility behavior; remove this case when automatic prompting is removed in 2027-04 (STACKITCLI-549).
 			description: "password from implicit stdin",
 			stdin:       "stdin-pw\n",
 			flagValues: fixtureFlagValues(func(flagValues map[string]string) {

internal/cmd/beta/cdn/distribution/create/create.go

@@ -219,15 +219,18 @@ func parseInput(p *print.Printer, cmd *cobra.Command, _ []string) (*inputModel,
 		bucketURL := flags.FlagToStringValue(p, cmd, flagBucketURL)
 		accessKeyID := flags.FlagToStringValue(p, cmd, flagBucketCredentialsAccessKeyID)
 		region := flags.FlagToStringValue(p, cmd, flagBucketRegion)
-		password, err := flags.ResolveSecretFlagWithAutoPrompt(p, cmd, flagBucketPassword) //nolint:staticcheck // preserve existing functionality until deprecation period is over
+		password, err := flags.ResolveSecretFlagWithAutoPrompt(p, cmd, flagBucketPassword) //nolint:staticcheck // Deprecated: preserve automatic prompting until 2027-04 (STACKITCLI-549).
 		if err != nil {
 			return nil, err
 		}
+		if password == nil || *password == "" {
+			return nil, fmt.Errorf("--%s must not be empty", flagBucketPassword)
+		}
 
 		bucket = &bucketInputModel{
 			URL:         bucketURL,
 			AccessKeyID: accessKeyID,
-			Password:    utils.PtrString(password),
+			Password:    *password,
 			Region:      region,
 		}
 	}
@@ -243,11 +246,14 @@ func parseInput(p *print.Printer, cmd *cobra.Command, _ []string) (*inputModel,
 			Username: flags.FlagToStringValue(p, cmd, flagLokiUsername),
 			PushURL:  flags.FlagToStringValue(p, cmd, flagLokiPushURL),
 		}
-		password, err := flags.ResolveSecretFlagWithAutoPrompt(p, cmd, flagLokiPassword) //nolint:staticcheck // preserve existing functionality until deprecation period is over
+		password, err := flags.ResolveSecretFlagWithAutoPrompt(p, cmd, flagLokiPassword) //nolint:staticcheck // Deprecated: preserve automatic prompting until 2027-04 (STACKITCLI-549).
 		if err != nil {
 			return nil, err
 		}
-		loki.Password = utils.PtrString(password)
+		if password == nil || *password == "" {
+			return nil, fmt.Errorf("--%s must not be empty", flagLokiPassword)
+		}
+		loki.Password = *password
 	}
 
 	optimizer := flags.FlagToBoolValue(p, cmd, flagOptimizer)

internal/cmd/beta/cdn/distribution/create/create_test.go

@@ -296,6 +296,7 @@ func TestParseInput(t *testing.T) {
 			),
 		},
 		{
+			// Deprecated compatibility behavior; remove this case when automatic prompting is removed in 2027-04 (STACKITCLI-549).
 			description: "bucket backend password implicit stdin",
 			flagValues: fixtureFlagValues(
 				flagsBucketBackend(),
@@ -461,6 +462,7 @@ func TestParseInput(t *testing.T) {
 			),
 		},
 		{
+			// Deprecated compatibility behavior; remove this case when automatic prompting is removed in 2027-04 (STACKITCLI-549).
 			description: "loki password implicit stdin",
 			flagValues: fixtureFlagValues(
 				flagsLoki(),

internal/cmd/beta/cdn/distribution/update/update.go

@@ -164,6 +164,15 @@ func parseInput(p *print.Printer, cmd *cobra.Command, inputArgs []string) (*inpu
 
 	regions := flagRegions.Get()
 
+	// Reject passwords that would otherwise be silently omitted from the API payload,
+	// before resolving secrets or reading stdin.
+	if cmd.Flags().Changed(flagBucketPassword) && (!flags.FlagToBoolValue(p, cmd, flagBucket) || flags.FlagToStringValue(p, cmd, flagBucketCredentialsAccessKeyID) == "") {
+		return nil, fmt.Errorf("--%s requires --%s and a non-empty --%s", flagBucketPassword, flagBucket, flagBucketCredentialsAccessKeyID)
+	}
+	if cmd.Flags().Changed(flagLokiPassword) && (!flags.FlagToBoolValue(p, cmd, flagLoki) || flags.FlagToStringValue(p, cmd, flagLokiUsername) == "") {
+		return nil, fmt.Errorf("--%s requires --%s and a non-empty --%s", flagLokiPassword, flagLoki, flagLokiUsername)
+	}
+
 	var http *httpInputModel
 	if flags.FlagToBoolValue(p, cmd, flagHTTP) {
 		originURL := flags.FlagToStringValue(p, cmd, flagHTTPOriginURL)
@@ -192,23 +201,22 @@ func parseInput(p *print.Printer, cmd *cobra.Command, inputArgs []string) (*inpu
 		bucketURL := flags.FlagToStringValue(p, cmd, flagBucketURL)
 		accessKeyID := flags.FlagToStringValue(p, cmd, flagBucketCredentialsAccessKeyID)
 		region := flags.FlagToStringValue(p, cmd, flagBucketRegion)
-		// Only credential replacements need an implicit password. Other bucket
-		// patches must not read stdin when the password is omitted.
-		resolvePassword := flags.ResolveSecretFlag
-		if accessKeyID != "" {
-			resolvePassword = flags.ResolveSecretFlagWithAutoPrompt //nolint:staticcheck // preserve existing functionality until deprecation period is over
-		}
-		password, err := resolvePassword(p, cmd, flagBucketPassword)
-		if err != nil {
-			return nil, err
-		}
-
 		bucket = &bucketInputModel{
 			URL:         bucketURL,
 			AccessKeyID: accessKeyID,
-			Password:    utils.PtrString(password),
 			Region:      region,
 		}
+		// Only credential replacements need a password. Other bucket patches must not read stdin.
+		if accessKeyID != "" {
+			password, err := flags.ResolveSecretFlagWithAutoPrompt(p, cmd, flagBucketPassword) //nolint:staticcheck // Deprecated: preserve automatic prompting until 2027-04 (STACKITCLI-549).
+			if err != nil {
+				return nil, err
+			}
+			if password == nil || *password == "" {
+				return nil, fmt.Errorf("--%s must not be empty", flagBucketPassword)
+			}
+			bucket.Password = *password
+		}
 	}
 
 	blockedCountries := flags.FlagToStringSliceValue(p, cmd, flagBlockedCountries)
@@ -223,15 +231,16 @@ func parseInput(p *print.Printer, cmd *cobra.Command, inputArgs []string) (*inpu
 			PushURL:  flags.FlagToStringValue(p, cmd, flagLokiPushURL),
 		}
 		// A push URL patch does not replace credentials unless a username is set.
-		resolvePassword := flags.ResolveSecretFlag
 		if loki.Username != "" {
-			resolvePassword = flags.ResolveSecretFlagWithAutoPrompt //nolint:staticcheck // preserve existing functionality until deprecation period is over
-		}
-		password, err := resolvePassword(p, cmd, flagLokiPassword)
-		if err != nil {
-			return nil, err
+			password, err := flags.ResolveSecretFlagWithAutoPrompt(p, cmd, flagLokiPassword) //nolint:staticcheck // Deprecated: preserve automatic prompting until 2027-04 (STACKITCLI-549).
+			if err != nil {
+				return nil, err
+			}
+			if password == nil || *password == "" {
+				return nil, fmt.Errorf("--%s must not be empty", flagLokiPassword)
+			}
+			loki.Password = *password
 		}
-		loki.Password = utils.PtrString(password)
 	}
 
 	var optimizer *bool

internal/cmd/beta/cdn/distribution/update/update_test.go

@@ -184,6 +184,7 @@ func TestParseInput(t *testing.T) {
 			}),
 		},
 		{
+			// Deprecated compatibility behavior; remove this case when automatic prompting is removed in 2027-04 (STACKITCLI-549).
 			description: "loki password implicit stdin",
 			argValues:   []string{testDistributionID},
 			flagValues: fixtureFlagValues(func(flagValues map[string]string) {
@@ -289,6 +290,7 @@ func TestParseInput(t *testing.T) {
 			),
 		},
 		{
+			// Deprecated compatibility behavior; remove this case when automatic prompting is removed in 2027-04 (STACKITCLI-549).
 			description: "bucket password implicit stdin",
 			argValues:   []string{testDistributionID},
 			flagValues: fixtureFlagValues(

internal/cmd/beta/intake/user/create/create.go

@@ -49,7 +49,7 @@ func NewCmd(p *types.CmdParams) *cobra.Command {
 		Args:  args.NoArgs,
 		Example: examples.Build(
 			examples.NewExample(
-				`Create a new Intake User with required parameters`,
+				`Create a new Intake User with required parameters, reading the password from stdin`,
 				`$ stackit beta intake user create --display-name intake-user --intake-id xxx --password -`),
 			examples.NewExample(
 				`Create a new Intake User for the dead-letter queue with labels`,
@@ -132,7 +132,7 @@ func parseInput(p *print.Printer, cmd *cobra.Command) (*inputModel, error) {
 		Description:     flags.FlagToStringPointer(p, cmd, descriptionFlag),
 		Labels:          flags.FlagToStringToStringPointer(p, cmd, labelsFlag),
 	}
-	pw, err := flags.ResolveSecretFlagWithAutoPrompt(p, cmd, passwordFlag) //nolint:staticcheck // preserve existing functionality until deprecation period is over
+	pw, err := flags.ResolveSecretFlag(p, cmd, passwordFlag)
 	if err != nil {
 		return nil, err
 	}

internal/cmd/beta/intake/user/create/create_test.go

@@ -166,7 +166,7 @@ func TestParseInput(t *testing.T) {
 				globalflags.RegionFlag:    testRegion,
 				displayNameFlag:           testDisplayName,
 				intakeIdFlag:              testIntakeId,
-				passwordFlag:              "@pw.txt",
+				passwordFlag:              "@" + testPwFile,
 				userTypeFlag:              testUserType,
 			},
 			isValid: true,

internal/cmd/load-balancer/observability-credentials/add/add.go

@@ -109,7 +109,7 @@ func parseInput(p *print.Printer, cmd *cobra.Command, _ []string) (*inputModel,
 		DisplayName:     flags.FlagToStringPointer(p, cmd, displayNameFlag),
 		Username:        flags.FlagToStringPointer(p, cmd, usernameFlag),
 	}
-	pw, err := flags.ResolveSecretFlagWithAutoPrompt(p, cmd, passwordFlag) //nolint:staticcheck // preserve existing functionality until deprecation period is over
+	pw, err := flags.ResolveSecretFlagWithAutoPrompt(p, cmd, passwordFlag) //nolint:staticcheck // Deprecated: preserve automatic prompting until 2027-04 (STACKITCLI-549).
 	if err != nil {
 		return nil, err
 	}