feat(flags): remove deprecated literal secret flags, make stdin explicit (#1697)

STACKITCLI-490

Author: cgoetz-inovex

docs/stackit_beta_alb_observability-credentials_add.md

@@ -22,7 +22,7 @@ stackit beta alb observability-credentials add [flags]
 ```
   -d, --displayname string   Displayname for the credentials
   -h, --help                 Help for "stackit beta alb observability-credentials add"
-      --password string      Password. Can be a string (deprecated) or a file path, if prefixed with '@' (example: @./secret.txt). Will be read from stdin when empty.
+      --password secret      Password. Use @<file> to read from a file (example: @./secret.txt), or - to read from stdin (hidden input on a terminal). Literal values are not supported.
   -u, --username string      Username for the credentials
 ```
 

docs/stackit_beta_alb_observability-credentials_update.md

@@ -22,7 +22,7 @@ stackit beta alb observability-credentials update CREDENTIAL_REF_ARG [flags]
 ```
   -d, --displayname string   Displayname for the credentials
   -h, --help                 Help for "stackit beta alb observability-credentials update"
-      --password string      Password. Can be a string (deprecated) or a file path, if prefixed with '@' (example: @./secret.txt). Will be read from stdin when empty.
+      --password secret      Password. Use @<file> to read from a file (example: @./secret.txt), or - to read from stdin (hidden input on a terminal). Literal values are not supported.
   -u, --username string      Username for the credentials
 ```
 

docs/stackit_beta_cdn_distribution_create.md

@@ -19,12 +19,12 @@ stackit beta cdn distribution create [flags]
 
   Create a CDN distribution with an Object Storage backend
   $ stackit beta cdn distribution create --bucket --bucket-url https://bucket.example.com \
---bucket-credentials-access-key-id yyyy --bucket-region EU \
+--bucket-credentials-access-key-id yyyy --bucket-password - --bucket-region EU \
 --regions AF,EU
 
-  Create a CDN distribution passing the password via stdin, take care that there's a '\n' at the end of the input'
+  Create a CDN distribution passing the password via stdin
   $ cat secret.txt | stackit beta cdn distribution create -y --project-id xxx \
---bucket --bucket-url https://bucket.example.com --bucket-credentials-access-key-id yyyy --bucket-region EU \
+--bucket --bucket-url https://bucket.example.com --bucket-credentials-access-key-id yyyy --bucket-password - --bucket-region EU \
 --regions AF,EU
 ```
 
@@ -35,7 +35,7 @@ stackit beta cdn distribution create [flags]
       --blocked-ips strings                       Comma-separated list of IPv4 addresses to block (e.g., '10.0.0.8,127.0.0.1')
       --bucket                                    Use Object Storage backend
       --bucket-credentials-access-key-id string   Access Key ID for Object Storage backend
-      --bucket-password string                    Bucket-Password. Can be a string (deprecated) or a file path, if prefixed with '@' (example: @./secret.txt). Will be read from stdin when empty.
+      --bucket-password secret                    Bucket-Password. Use @<file> to read from a file (example: @./secret.txt), or - to read from stdin (hidden input on a terminal). Literal values are not supported.
       --bucket-region string                      Region for Object Storage backend
       --bucket-url string                         Bucket URL for Object Storage backend
       --default-cache-duration string             ISO8601 duration string for default cache duration (e.g., 'PT1H30M' for 1 hour and 30 minutes)
@@ -45,7 +45,7 @@ stackit beta cdn distribution create [flags]
       --http-origin-request-headers strings       Origin request headers for HTTP backend in the format 'HeaderName: HeaderValue', repeatable. WARNING: do not store sensitive values in the headers!
       --http-origin-url string                    Origin URL for HTTP backend
       --loki                                      Enable Loki log sink for the CDN distribution
-      --loki-password string                      Loki-Password. Can be a string (deprecated) or a file path, if prefixed with '@' (example: @./secret.txt). Will be read from stdin when empty.
+      --loki-password secret                      Loki-Password. Use @<file> to read from a file (example: @./secret.txt), or - to read from stdin (hidden input on a terminal). Literal values are not supported.
       --loki-push-url string                      Push URL for log sink
       --loki-username string                      Username for log sink
       --monthly-limit-bytes int                   Monthly limit in bytes for the CDN distribution

docs/stackit_beta_cdn_distribution_update.md

@@ -24,7 +24,7 @@ stackit beta cdn distribution update [flags]
       --blocked-ips strings                       Comma-separated list of IPv4 addresses to block (e.g., '10.0.0.8,127.0.0.1')
       --bucket                                    Use Object Storage backend
       --bucket-credentials-access-key-id string   Access Key ID for Object Storage backend
-      --bucket-password string                    Bucket-Password. Can be a string (deprecated) or a file path, if prefixed with '@' (example: @./secret.txt). Will be read from stdin when empty.
+      --bucket-password secret                    Bucket-Password. Use @<file> to read from a file (example: @./secret.txt), or - to read from stdin (hidden input on a terminal). Literal values are not supported.
       --bucket-region string                      Region for Object Storage backend
       --bucket-url string                         Bucket URL for Object Storage backend
       --default-cache-duration string             ISO8601 duration string for default cache duration (e.g., 'PT1H30M' for 1 hour and 30 minutes)
@@ -34,7 +34,7 @@ stackit beta cdn distribution update [flags]
       --http-origin-request-headers strings       Origin request headers for HTTP backend in the format 'HeaderName: HeaderValue', repeatable. WARNING: do not store sensitive values in the headers!
       --http-origin-url string                    Origin URL for HTTP backend
       --loki                                      Enable Loki log sink for the CDN distribution
-      --loki-password string                      Loki-Password. Can be a string (deprecated) or a file path, if prefixed with '@' (example: @./secret.txt). Will be read from stdin when empty.
+      --loki-password secret                      Loki-Password. Use @<file> to read from a file (example: @./secret.txt), or - to read from stdin (hidden input on a terminal). Literal values are not supported.
       --loki-push-url string                      Push URL for log sink
       --loki-username string                      Username for log sink
       --monthly-limit-bytes int                   Monthly limit in bytes for the CDN distribution

docs/stackit_beta_intake_user_create.md

@@ -13,11 +13,11 @@ stackit beta intake user create [flags]
 ### Examples
 
 ```
-  Create a new Intake User with required parameters
-  $ stackit beta intake user create --display-name intake-user --intake-id xxx --password "SuperSafepass123\!"
+  Create a new Intake User with required parameters, reading the password from stdin
+  $ stackit beta intake user create --display-name intake-user --intake-id xxx --password -
 
   Create a new Intake User for the dead-letter queue with labels
-  $ stackit beta intake user create --display-name dlq-user --intake-id xxx --password "SuperSafepass123\!" --type dead-letter --labels "env=prod"
+  $ stackit beta intake user create --display-name dlq-user --intake-id xxx --password @./password.txt --type dead-letter --labels "env=prod"
 ```
 
 ### Options
@@ -28,7 +28,7 @@ stackit beta intake user create [flags]
   -h, --help                    Help for "stackit beta intake user create"
       --intake-id string        The UUID of the Intake to associate the user with
       --labels stringToString   Labels in key=value format, separated by commas (default [])
-      --password string         Password. Can be a string (deprecated) or a file path, if prefixed with '@' (example: @./secret.txt). Will be read from stdin when empty. Must contain lower, upper, number, and special characters (min 12 chars)
+      --password secret         Password. Use @<file> to read from a file (example: @./secret.txt), or - to read from stdin (hidden input on a terminal). Literal values are not supported. Must contain lower, upper, number, and special characters (min 12 chars)
       --type string             Type of user. One of 'intake' (default) or 'dead-letter' (default "intake")
 ```
 

docs/stackit_beta_intake_user_update.md

@@ -17,7 +17,7 @@ stackit beta intake user update USER_ID [flags]
   $ stackit beta intake user update xxx --intake-id yyy --display-name "new-user-name"
 
   Update the password and description for an Intake User
-  $ stackit beta intake user update xxx --intake-id yyy --password "NewSecret123\!" --description "Updated description"
+  $ stackit beta intake user update xxx --intake-id yyy --password - --description "Updated description"
 ```
 
 ### Options
@@ -28,7 +28,7 @@ stackit beta intake user update USER_ID [flags]
   -h, --help                    Help for "stackit beta intake user update"
       --intake-id string        Intake ID
       --labels stringToString   Labels in key=value format, separated by commas. Example: --labels "key1=value1,key2=value2". (default [])
-      --password string         Password. Can be a string (deprecated) or a file path, if prefixed with '@' (example: @./secret.txt). Will be read from stdin when empty. Must contain lower, upper, number, and special characters (min 12 chars)
+      --password secret         Password. Use @<file> to read from a file (example: @./secret.txt), or - to read from stdin (hidden input on a terminal). Literal values are not supported. Must contain lower, upper, number, and special characters (min 12 chars)
       --type string             Type of user. One of 'intake' or 'dead-letter'
 ```
 

docs/stackit_load-balancer_observability-credentials_add.md

@@ -14,7 +14,7 @@ stackit load-balancer observability-credentials add [flags]
 
 ```
   Add observability credentials to a load balancer with username "xxx" and display name "yyy". The password is entered using the terminal
-  $ stackit load-balancer observability-credentials add --username xxx --display-name yyy
+  $ stackit load-balancer observability-credentials add --username xxx --display-name yyy --password -
 
   Add observability credentials to a load balancer with username "xxx" and display name "yyy", providing the path to a file with the password as flag
   $ stackit load-balancer observability-credentials add --username xxx --password @./password.txt --display-name yyy
@@ -25,7 +25,7 @@ stackit load-balancer observability-credentials add [flags]
 ```
       --display-name string   Credentials display name
   -h, --help                  Help for "stackit load-balancer observability-credentials add"
-      --password string       Password. Can be a string (deprecated) or a file path, if prefixed with '@' (example: @./secret.txt). Will be read from stdin when empty.
+      --password secret       Password. Use @<file> to read from a file (example: @./secret.txt), or - to read from stdin (hidden input on a terminal). Literal values are not supported.
       --username string       Username
 ```
 

docs/stackit_load-balancer_observability-credentials_update.md

@@ -14,7 +14,7 @@ stackit load-balancer observability-credentials update CREDENTIALS_REF [flags]
 
 ```
   Update the password and username of observability credentials of Load Balancer with credentials reference "credentials-xxx". The password is entered using the terminal
-  $ stackit load-balancer observability-credentials update credentials-xxx --username new-username
+  $ stackit load-balancer observability-credentials update credentials-xxx --username new-username --password -
 
   Update the password of observability credentials of Load Balancer with credentials reference "credentials-xxx", by providing the path to a file with the new password as flag
   $ stackit load-balancer observability-credentials update credentials-xxx --password @./new-password.txt
@@ -25,7 +25,7 @@ stackit load-balancer observability-credentials update CREDENTIALS_REF [flags]
 ```
       --display-name string   Credentials name
   -h, --help                  Help for "stackit load-balancer observability-credentials update"
-      --password string       Password. Can be a string (deprecated) or a file path, if prefixed with '@' (example: @./secret.txt). Will be read from stdin when empty.
+      --password secret       Password. Use @<file> to read from a file (example: @./secret.txt), or - to read from stdin (hidden input on a terminal). Literal values are not supported.
       --username string       Username
 ```
 

internal/cmd/beta/alb/observability-credentials/add/add.go

@@ -92,8 +92,12 @@ func parseInput(p *print.Printer, cmd *cobra.Command, _ []string) (*inputModel,
 		GlobalFlagModel: globalFlags,
 		Username:        flags.FlagToStringPointer(p, cmd, usernameFlag),
 		Displayname:     flags.FlagToStringPointer(p, cmd, displaynameFlag),
-		Password:        flags.SecretFlagToStringPointer(p, cmd, passwordFlag),
 	}
+	pw, err := flags.ResolveSecretFlagWithAutoPrompt(p, cmd, passwordFlag) //nolint:staticcheck // Deprecated: preserve automatic prompting until 2027-04 (STACKITCLI-549).
+	if err != nil {
+		return nil, err
+	}
+	model.Password = pw
 
 	p.DebugInputModel(model)
 	return &model, nil

internal/cmd/beta/alb/observability-credentials/add/add_test.go

@@ -2,11 +2,16 @@ package add
 
 import (
 	"context"
+	"strings"
 	"testing"
+	"testing/fstest"
+
+	"github.com/spf13/cobra"
 
 	"github.com/stackitcloud/stackit-cli/internal/pkg/globalflags"
 	"github.com/stackitcloud/stackit-cli/internal/pkg/testparams"
 	"github.com/stackitcloud/stackit-cli/internal/pkg/testutils"
+	"github.com/stackitcloud/stackit-cli/internal/pkg/types"
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
@@ -27,13 +32,15 @@ var (
 	testPassword    = "testpassword"
 )
 
+const testPwFile = "pw.txt"
+
 func fixtureFlagValues(mods ...func(flagValues map[string]string)) map[string]string {
 	flagValues := map[string]string{
 		globalflags.ProjectIdFlag: testProjectId,
 		globalflags.RegionFlag:    testRegion,
 		usernameFlag:              testUsername,
 		displaynameFlag:           testDisplayname,
-		passwordFlag:              testPassword,
+		passwordFlag:              "@" + testPwFile,
 	}
 	for _, mod := range mods {
 		mod(flagValues)
@@ -81,6 +88,7 @@ func fixturePayload(mods ...func(payload *alb.CreateCredentialsPayload)) alb.Cre
 
 func TestParseInput(t *testing.T) {
 	tests := []struct {
+		stdin         string
 		description   string
 		argValues     []string
 		flagValues    map[string]string
@@ -98,11 +106,47 @@ func TestParseInput(t *testing.T) {
 			flagValues:  map[string]string{},
 			isValid:     false,
 		},
+		{
+			description: "password from explicit stdin",
+			stdin:       "stdin-pw\n",
+			flagValues: fixtureFlagValues(func(flagValues map[string]string) {
+				flagValues[passwordFlag] = "-"
+			}),
+			isValid: true,
+			expectedModel: fixtureInputModel(func(model *inputModel) {
+				model.Password = new("stdin-pw")
+			}),
+		},
+		{
+			// Deprecated compatibility behavior; remove this case when automatic prompting is removed in 2027-04 (STACKITCLI-549).
+			description: "password from implicit stdin",
+			stdin:       "stdin-pw\n",
+			flagValues: fixtureFlagValues(func(flagValues map[string]string) {
+				delete(flagValues, passwordFlag)
+			}),
+			isValid: true,
+			expectedModel: fixtureInputModel(func(model *inputModel) {
+				model.Password = new("stdin-pw")
+			}),
+		},
+		{
+			description: "literal password rejected",
+			flagValues: fixtureFlagValues(func(flagValues map[string]string) {
+				flagValues[passwordFlag] = "top-secret"
+			}),
+			isValid: false,
+		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.description, func(t *testing.T) {
-			testutils.TestParseInput(t, NewCmd, parseInput, tt.expectedModel, tt.argValues, tt.flagValues, tt.isValid)
+			testutils.TestParseInput(t, func(params *types.CmdParams) *cobra.Command {
+				params.Fs = fstest.MapFS{
+					testPwFile: {Data: []byte(testPassword)},
+				}
+				params.Printer.StdIn = strings.NewReader(tt.stdin)
+				return NewCmd(params)
+			}, parseInput, tt.expectedModel, tt.argValues, tt.flagValues, tt.isValid)
 		})
 	}
 }