Add --lk as an argument for ALL commands (except `impt auth logout`)

[deldrid1]

@ppetrosh - We are using impt as a part of a Bamboo CI pipeline. Unfortunately, our build server is a shared resource that I have no way to lock down for me exclusively due to IT insanity...

Is there a chance that ALL impt commands can take --lk (+ $bamboo_EI_PROD_LOGINKEY_PASSWORD in my case) as an argument and use that as the auth mechanism for that specific command. This would prevent me from having to make sure that everyone using the build server remembers to impt auth logout at the end of their scripts (on success or exception) and prevent a possible insider threat from gaining access to our production account.

[ppetrosh]

1. I would be more concerned about passing the lk in the command line, disclose it in the shell history and the environment variable.
2. The file location can be protected by appropriate file permissions.
3. A leak of lk is potentially more dangerous than that of refresh and access tokens.

[deldrid1]

1. I have shell history disabled and the environment variable is managed by Bamboo as a build variable password - it is set and destroyed when the build starts/finishes respectively and is not viewable once it has been saved.
2. All builds triggered by Bamboo use the same user. Since I can't restrict the server to only my access (its anyone who can kick off builds on the Bamboo instance), this approach doesn't work...
3. Understood, but I have to store the long lived credential somewhere for the build server to be able to do its job. Bamboo doesn't feel inappropriate to me?

[alexey-nbl]

To fully support such a feature all four options from the login cmd should be in place - lk, user, pwd, endpoint.
It's not a good idea to add them to every other command.
But alternatively, we suggest to add environment variables for the same purpose.

The full proposal is below. Please review.

[alexey-nbl]

Env variables:

IMPT_AUTH_FILE_PATH - a path to a directory with an auth file

IMPT_LOGINKEY - a login key for the account
IMPT_USER - an account identifier: a username or an email address
IMPT_PASSWORD - an account password
IMPT_ENDPOINT - an impCentral API endpoint

impt command execution context:

1. If the current directory contains an auth file, the command is executed in the context defined by that file. (If the file is broken, the command fails.)

2. Otherwise, if IMPT_AUTH_FILE_PATH is set, the command is executed in the context defined by the auth file in the referenced directory. (If the file does not exist or is broken, the command fails.)

3. Otherwise, if IMPT_LOGINKEY is set, impt tries to login using the login key and then the command is executed in the context of this login. (If the login fails, the command fails.)
   If IMPT_ENDPOINT is set, it is used as impCentral API endpoint. Else, the default endpoint is used.

4. Otherwise, if IMPT_USER is set, impt tries to login using the account identifier and the password and then the command is executed in the context of this login. (If the login fails, the command fails.)
   If IMPT_PASSWORD is set, it is used as password. Else, password is empty.
   If IMPT_ENDPOINT is set, it is used as impCentral API endpoint. Else, the default endpoint is used.

5. Otherwise, if the global auth file exists, the command is executed in the context defined by that file. (If the file is broken, the command fails.)

6. Otherwise, the command fails (as no login).

Commands:

impt auth info - the specification will not be changed but it will output which context would be used if a command is executed from the current directory in the current environment + other applicable details.
impt auth login - will not be changed.
impt auth logout - will not be changed.
No any changes in the specifications of all other commands.

[deldrid1]

It seems like the global auth file should take precedence over the environment variables IMHO but sounds like it would accomplish what I’m looking for in the easiest way possible!

[ppetrosh]

IMPT_ENDPOINT should probably be IMPT_API_BASE_URL, however, it should also be consistent with the endpoint argument of the impt itself. So I have no strong preference here. Otherwise looks good to me.

[betzrhodes]

This looks reasonable. I vote for keeping the naming consistent and making sure docs give extra details where needed.

[alexey-nbl]

@deldrid1 - the global auth should be the last one as it's the most common (one per the tool installation). The env vars are more specific, as they may be different in different processes/consoles.

All - thanks for the feedback.

[alexey-nbl]

Minor update in the proposal - in 4:
If IMPT_PASSWORD is set, it is used as password. Else, a password is asked before execution of every command.
This is for total "paranoic" users :) Plus it's more consistent in the implementation (the same behavior as when a password is not specified in the impt auth login command).

Also note, even if the both IMPT_USER and IMPT_PASSWORD env vars are set but 2FA is switched on, a one-time password will be asked before execution of every command.

[ppetrosh]

Fixed