Misleading parameters in get-access-token

[systemstart]

Description

The subcommand get-access-token offers a parameter --project-id.

One might get the idea the resulting token is valid for that project only, which is not the case since --project-id (and --region for example) is not used.

Steps to reproduce

1. Run TOKEN=$(stackit auth get-access-token --project-id=$PROJECT_ID)
2. Run curl -H "Authorization: Bearer $TOKEN" https://ske.api.stackit.cloud/v2/projects/$OTHER_PROJECT_ID/regions/eu01/clusters/$SOME_CLUSTER_ID

Actual behavior

The --project-id parameter has no effect on the resulting token.

Expected behavior

I would either assume

• the token to be only valid for the project ID provided to get-access-token
• or not showing the parameter in get-access-token --help.

Environment

• OS: Linux
• Version of STACKIT CLI (see stackit --version): v0.42.0

[rubenhoenle]

Hi @systemstart,

thanks for your message. You're indeed correct here that the --project-id flag is prone to misleading users.

stackit-cli/internal/cmd/root.go

Line 155 in d68210b

err := globalflags.Configure(cmd.PersistentFlags())

stackit-cli/internal/pkg/globalflags/global_flags.go

Line 44 in d68210b

flagSet.VarP(flags.UUIDFlag(), ProjectIdFlag, "p", "Project ID")

Sadly we can't disable the --project-id flag for the stackit auth get-access-token because we're using cobra's persistent flag feature to provide common flags across all STACKIT CLI subcommands. There's an GitHub issue open on cobra side for this which doesn't seem to make some progress: spf13/cobra#1982

Nevertheless, I have created some PR to hide the --project-id flag from the stackit auth get-access-token --help output. I guess that's the best we can do here for now.

Best regards
Ruben from STACKIT Developer tools team

[rubenhoenle]

With our latest v0.47.0 release of the STACKIT CLI (see https://github.com/stackitcloud/stackit-cli/releases/tag/v0.47.0) the --project-id flag should be hidden from the stackit auth get-access-token --help output.