Skip to content

fix: auto-authenticate with Universal Auth client credentials in GetInfisicalToken#201

Open
devin-ai-integration[bot] wants to merge 3 commits intomainfrom
devin/1777427505-universal-auth-auto-login
Open

fix: auto-authenticate with Universal Auth client credentials in GetInfisicalToken#201
devin-ai-integration[bot] wants to merge 3 commits intomainfrom
devin/1777427505-universal-auth-auto-login

Conversation

@devin-ai-integration
Copy link
Copy Markdown
Contributor

@devin-ai-integration devin-ai-integration Bot commented Apr 29, 2026 •
edited
Loading

Description 📣

When INFISICAL_UNIVERSAL_AUTH_CLIENT_ID and INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET environment variables are set, commands like infisical run, infisical export, and infisical secrets fail with "No valid login session found, triggering login flow" instead of automatically authenticating.

Root cause: GetInfisicalToken() only checks for pre-existing access tokens (--token flag, INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN, INFISICAL_TOKEN env vars). The client ID and client secret are credentials that need to be exchanged for an access token, but GetInfisicalToken() never performs that exchange — so it returns nil, and downstream code falls back to the interactive login flow.

Fix: In GetInfisicalToken(), right before returning nil when no explicit token is found, check if both INFISICAL_UNIVERSAL_AUTH_CLIENT_ID and INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET are set. If so, call the existing UniversalAuthLogin() function to exchange them for an access token. This fixes every command that uses GetInfisicalToken — run, export, secrets, etc. — in one shot.

This is critical for non-interactive environments like Claude Code, CI runners, and other automated tooling where the interactive login flow is not possible.

Codex Review Feedback (addressed in follow-up commit)

  1. Respect --auth-method over auto UA login — GetInfisicalToken now checks for --auth-method flag or INFISICAL_AUTH_METHOD env var before attempting auto-login. If either is set, it returns nil so the caller's auth-method flow (AWS, GCP, K8s, etc.) takes over. This prevents stale UA env vars from short-circuiting gateway/relay flows using other auth strategies.

  2. Fail-fast retries — Reduced UniversalAuthLogin from 10,000 retries / 20s max-wait (≈55h worst-case) to 3 retries with 2-5s wait, appropriate for one-shot CLI commands in CI/automation.

  3. No network call in PersistentPreRun — Split into DetectInfisicalToken (local-only, for the "session overwritten" warning) and GetInfisicalToken (with network exchange). The root command's PersistentPreRun now uses DetectInfisicalToken, eliminating the double token-minting and network dependency on every CLI invocation.

Type ✨

  • Bug fix
  • New feature
  • Improvement
  • Breaking change
  • Documentation

Tests 🛠️

  • Verified the project builds successfully with go build ./...
  • All 14 CI checks pass (unit tests, integration tests on Linux/macOS/Windows, E2E tests for CLI/PAM/Agent)

To verify manually:

export INFISICAL_UNIVERSAL_AUTH_CLIENT_ID="your-client-id"
export INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET="your-client-secret"

# Before this fix: "No valid login session found, triggering login flow"
# After this fix: auto-authenticates and fetches secrets
infisical run --projectId=<project-id> -- echo "it works"

Link to Devin session: https://app.devin.ai/sessions/28035c0473714f72a18187edc405bf38

@devin-ai-integration @jakehulberg
fix: auto-authenticate with Universal Auth client credentials in GetI…
9592fb9 
…nfisicalToken

When INFISICAL_UNIVERSAL_AUTH_CLIENT_ID and INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET
environment variables are set, GetInfisicalToken() now automatically exchanges them
for an access token using the existing UniversalAuthLogin() function.

Previously, GetInfisicalToken() only checked for pre-existing access tokens
(--token flag, INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN, INFISICAL_TOKEN env vars).
If none were found, it returned nil, causing commands like 'infisical run' to fall
back to the interactive login flow — which fails in non-interactive environments
like Claude Code, CI runners, and other automated tooling.

This fixes 'run', 'export', 'secrets', and all other commands that use
GetInfisicalToken.

Co-Authored-By: jake <jake@infisical.com>
@devin-ai-integration
Copy link
Copy Markdown
Contributor Author

devin-ai-integration Bot commented Apr 29, 2026

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

  • Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
  • Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

  • Disable automatic comment and CI monitoring

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Apr 29, 2026
View reviewed changes
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9592fb9063

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread packages/util/helper.go Outdated
claude[bot]
claude Bot reviewed Apr 29, 2026
View reviewed changes
Comment thread packages/util/helper.go Outdated
Comment thread packages/util/helper.go Outdated
@devin-ai-integration @jakehulberg
fix: address Codex review feedback on Universal Auth auto-login
4a991c2 
- Split GetInfisicalToken into local-only DetectInfisicalToken (for
  PersistentPreRun warning) and network-capable GetInfisicalToken, so
  the root command no longer performs a network call or double-mints
  tokens on every CLI invocation.

- Skip auto-UA-login when --auth-method flag or INFISICAL_AUTH_METHOD
  env var is set, so gateway/relay flows using AWS/GCP/K8s auth are
  not short-circuited by stale UA credentials in the environment.

- Reduce UniversalAuthLogin retry count from 10000 (≈55h worst-case)
  to 3 retries with 2-5s wait, so CLI commands fail fast on transport
  errors instead of blocking indefinitely.

Co-Authored-By: jake <jake@infisical.com>
@devin-ai-integration
Copy link
Copy Markdown
Contributor Author

devin-ai-integration Bot commented Apr 29, 2026

Addressed all three Codex review comments in 4a991c2:

  1. Respect --auth-method over auto UA login — GetInfisicalToken now checks for --auth-method flag or INFISICAL_AUTH_METHOD env var before attempting auto-login. If either is set, it returns nil so the caller's auth-method flow (AWS, GCP, K8s, etc.) takes over.

  2. Fail-fast retries — Reduced UniversalAuthLogin from 10,000 retries / 20s max-wait (≈55h worst-case) to 3 retries with 2-5s wait, appropriate for one-shot CLI commands in CI/automation.

  3. No network call in PersistentPreRun — Split into DetectInfisicalToken (local-only, for the "session overwritten" warning) and GetInfisicalToken (with network exchange). The root command's PersistentPreRun now uses DetectInfisicalToken, eliminating the double token-minting and network dependency on every CLI invocation.

@jakehulberg jakehulberg requested a review from varonix0 April 30, 2026 00:47
@varonix0
Copy link
Copy Markdown
Member

varonix0 commented Apr 30, 2026

@codex re-review this PR

@varonix0
Copy link
Copy Markdown
Member

varonix0 commented Apr 30, 2026

@claude re-review this PR

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Apr 30, 2026
View reviewed changes
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4a991c203e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread packages/util/helper.go
@devin-ai-integration @jakehulberg
fix: restrict auth-method bypass to commands that define the flag
b1fae84 
Only check INFISICAL_AUTH_METHOD env var when the command actually has the
--auth-method flag registered (e.g. gateway, relay). Commands like run, export,
and secrets do not define this flag, so a globally-set INFISICAL_AUTH_METHOD
should not prevent auto-login for those commands.

Co-Authored-By: jake <jake@infisical.com>
@varonix0
Copy link
Copy Markdown
Member

varonix0 commented Apr 30, 2026

@claude re-review this and be super cautious

@varonix0
Copy link
Copy Markdown
Member

varonix0 commented Apr 30, 2026

@codex re-review this and be super cautious

@chatgpt-codex-connector
Copy link
Copy Markdown

chatgpt-codex-connector Bot commented Apr 30, 2026

Codex Review: Didn't find any major issues. Hooray!

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments

@claude claude[bot] claude[bot] left review comments

@varonix0 varonix0 Awaiting requested review from varonix0

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@varonix0