feat: allow fetching token from shell command

internal/cmd/config/helptext/other.md

@@ -3,3 +3,4 @@
 | config | Config file path (default "~/.config/hcloud/cli.toml") | string |  | HCLOUD\_CONFIG | --config |
 | context | Currently active context | string | active\_context | HCLOUD\_CONTEXT | --context |
 | token | Hetzner Cloud API token | string | token | HCLOUD\_TOKEN |  |
+| token\_command | Command to retrieve Hetzner Cloud API token | string | token\_command | HCLOUD\_TOKEN\_COMMAND |  |

internal/cmd/config/helptext/other.txt

@@ -1,14 +1,18 @@
-┌─────────┬──────────────────────┬────────┬────────────────┬──────────────────────┬───────────┐
-│ OPTION  │ DESCRIPTION          │ TYPE   │ CONFIG KEY     │ ENVIRONMENT VARIABLE │ FLAG      │
-├─────────┼──────────────────────┼────────┼────────────────┼──────────────────────┼───────────┤
-│ config  │ Config file path     │ string │                │ HCLOUD_CONFIG        │ --config  │
-│         │ (default             │        │                │                      │           │
-│         │ "~/.config/hcloud/cl │        │                │                      │           │
-│         │ i.toml")             │        │                │                      │           │
-├─────────┼──────────────────────┼────────┼────────────────┼──────────────────────┼───────────┤
-│ context │ Currently active     │ string │ active_context │ HCLOUD_CONTEXT       │ --context │
-│         │ context              │        │                │                      │           │
-├─────────┼──────────────────────┼────────┼────────────────┼──────────────────────┼───────────┤
-│ token   │ Hetzner Cloud API    │ string │ token          │ HCLOUD_TOKEN         │           │
-│         │ token                │        │                │                      │           │
-└─────────┴──────────────────────┴────────┴────────────────┴──────────────────────┴───────────┘
+┌───────────────┬──────────────────────┬────────┬────────────────┬──────────────────────┬───────────┐
+│ OPTION        │ DESCRIPTION          │ TYPE   │ CONFIG KEY     │ ENVIRONMENT VARIABLE │ FLAG      │
+├───────────────┼──────────────────────┼────────┼────────────────┼──────────────────────┼───────────┤
+│ config        │ Config file path     │ string │                │ HCLOUD_CONFIG        │ --config  │
+│               │ (default             │        │                │                      │           │
+│               │ "~/.config/hcloud/cl │        │                │                      │           │
+│               │ i.toml")             │        │                │                      │           │
+├───────────────┼──────────────────────┼────────┼────────────────┼──────────────────────┼───────────┤
+│ context       │ Currently active     │ string │ active_context │ HCLOUD_CONTEXT       │ --context │
+│               │ context              │        │                │                      │           │
+├───────────────┼──────────────────────┼────────┼────────────────┼──────────────────────┼───────────┤
+│ token         │ Hetzner Cloud API    │ string │ token          │ HCLOUD_TOKEN         │           │
+│               │ token                │        │                │                      │           │
+├───────────────┼──────────────────────┼────────┼────────────────┼──────────────────────┼───────────┤
+│ token_command │ Command to retrieve  │ string │ token_command  │ HCLOUD_TOKEN_COMMAND │           │
+│               │ Hetzner Cloud API    │        │                │                      │           │
+│               │ token                │        │                │                      │           │
+└───────────────┴──────────────────────┴────────┴────────────────┴──────────────────────┴───────────┘

internal/cmd/context/create.go

@@ -17,7 +17,7 @@ import (
 
 func NewCreateCommand(s state.State) *cobra.Command {
 	cmd := &cobra.Command{
-		Use:                   "create [--token-from-env] <name>",
+		Use:                   "create [options] <name>",
 		Short:                 "Create a new context",
 		Args:                  util.Validate,
 		TraverseChildren:      true,
@@ -26,11 +26,14 @@ func NewCreateCommand(s state.State) *cobra.Command {
 		RunE:                  state.Wrap(s, runCreate),
 	}
 	cmd.Flags().Bool("token-from-env", false, "If true, the HCLOUD_TOKEN from the environment will be used without asking")
+	cmd.Flags().String("token-from-command", "", "If set, this command will be executed to retrieve the token on each run")
+	cmd.MarkFlagsMutuallyExclusive("token-from-env", "token-from-command")
 	return cmd
 }
 
 func runCreate(s state.State, cmd *cobra.Command, args []string) error {
 	tokenFromEnv, _ := cmd.Flags().GetBool("token-from-env")
+	tokenCmd, _ := cmd.Flags().GetString("token-from-command")
 
 	cfg := s.Config()
 	if !s.Terminal().StdoutIsTerminal() && !tokenFromEnv {
@@ -47,8 +50,7 @@ func runCreate(s state.State, cmd *cobra.Command, args []string) error {
 
 	var token string
 
-	envToken := os.Getenv("HCLOUD_TOKEN")
-	if envToken != "" {
+	if envToken := os.Getenv("HCLOUD_TOKEN"); tokenCmd == "" && envToken != "" {
 		switch {
 		case len(envToken) != 64:
 			if tokenFromEnv {
@@ -67,7 +69,7 @@ func runCreate(s state.State, cmd *cobra.Command, args []string) error {
 		}
 	}
 
-	if token == "" {
+	if tokenCmd == "" && token == "" {
 		if tokenFromEnv {
 			return errors.New("no token provided")
 		}
@@ -92,7 +94,7 @@ func runCreate(s state.State, cmd *cobra.Command, args []string) error {
 		}
 	}
 
-	context := config.NewContext(name, token)
+	context := config.NewContext(name, token, tokenCmd)
 
 	cfg.SetContexts(append(cfg.Contexts(), context))
 	cfg.SetActiveContext(context)

internal/state/config/config.go

@@ -1,7 +1,6 @@
 package config
 
 import (
-	"bytes"
 	"errors"
 	"fmt"
 	"io"
@@ -150,11 +149,13 @@ func (cfg *config) Read(f any) error {
 	}
 
 	if cfg.schema.ActiveContext != "" {
-		// ReadConfig resets the current config and reads the new values
+		// We set the currently active context using viper.MergeConfigMap.
 		// We don't use viper.Set here because of the value hierarchy. We want the env and flags to
 		// be able to override the currently active context. viper.Set would take precedence over
 		// env and flags.
-		err = cfg.v.ReadConfig(bytes.NewReader([]byte(fmt.Sprintf("context = %q\n", cfg.schema.ActiveContext))))
+		err = cfg.v.MergeConfigMap(map[string]any{
+			"context": cfg.schema.ActiveContext,
+		})
 		if err != nil {
 			return err
 		}
@@ -189,10 +190,13 @@ func (cfg *config) Read(f any) error {
 		if err = cfg.activeContext.ContextPreferences.merge(cfg.v); err != nil {
 			return err
 		}
-		// Merge token into viper
+		// Merge token and token_cmd into viper
 		// We use viper.MergeConfig here for the same reason as above, except for
 		// that we merge the config instead of replacing it.
-		if err = cfg.v.MergeConfig(bytes.NewReader([]byte(fmt.Sprintf(`token = "%s"`, cfg.activeContext.ContextToken)))); err != nil {
+		if err = cfg.v.MergeConfigMap(map[string]any{
+			"token":         cfg.activeContext.ContextToken,
+			"token_command": cfg.activeContext.ContextTokenCommand,
+		}); err != nil {
 			return err
 		}
 	}

internal/state/config/context.go

@@ -6,25 +6,27 @@ type Context interface {
 	Preferences() Preferences
 }
 
-func NewContext(name, token string) Context {
+func NewContext(name, token, tokenCmd string) Context {
 	return &context{
-		ContextName:  name,
-		ContextToken: token,
+		ContextName:         name,
+		ContextToken:        token,
+		ContextTokenCommand: tokenCmd,
 	}
 }
 
 type context struct {
-	ContextName        string      `toml:"name"`
-	ContextToken       string      `toml:"token"`
-	ContextPreferences Preferences `toml:"preferences"`
+	ContextName         string      `toml:"name"`
+	ContextToken        string      `toml:"token,omitempty"`
+	ContextTokenCommand string      `toml:"token_command,omitempty"`
+	ContextPreferences  Preferences `toml:"preferences"`
 }
 
 func (ctx *context) Name() string {
 	return ctx.ContextName
 }
 
 // Token returns the token for the context.
-// If you just need the token regardless of the context, please use [OptionToken] instead.
+// If you just need the token regardless of the context, please use [config.RetrieveToken] instead.
 func (ctx *context) Token() string {
 	return ctx.ContextToken
 }

internal/state/config/options.go

@@ -99,6 +99,15 @@ var (
 		nil,
 	)
 
+	OptionTokenCommand = newOpt(
+		"token_command",
+		"Command to retrieve Hetzner Cloud API token",
+		"",
+		OptionFlagConfig|OptionFlagEnv,
+		nil,
+		nil,
+	)
+
 	OptionContext = newOpt(
 		"context",
 		"Currently active context",

internal/state/config/token.go

@@ -0,0 +1,56 @@
+package config
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"runtime"
+	"strings"
+)
+
+func RetrieveToken(c Config) (string, error) {
+	tok, err := OptionToken.Get(c)
+	if err != nil {
+		return "", err
+	}
+	if tok != "" {
+		return tok, nil
+	}
+
+	cmdStr, err := OptionTokenCommand.Get(c)
+	if err != nil {
+		return "", err
+	}
+	if cmdStr != "" {
+		return tokenFromCommand(c, cmdStr)
+	}
+	return "", nil
+}
+
+// We might need to run the command to retrieve HCLOUD_TOKEN multiple times, for example when running tests.
+// Since the command is provided by the user and might be expensive, we cache the command result after the first successful run.
+var cmdCache = make(map[string]string)
+
+func tokenFromCommand(c Config, cmdStr string) (string, error) {
+	if tok, ok := cmdCache[cmdStr]; ok {
+		return tok, nil
+	}
+
+	var cmd *exec.Cmd
+	if runtime.GOOS == "windows" {
+		cmd = exec.Command("cmd", "/C", cmdStr)
+	} else {
+		cmd = exec.Command("sh", "-c", cmdStr)
+	}
+
+	cmd.Env = append(cmd.Environ(), fmt.Sprintf("HCLOUD_CONTEXT=%s", c.ActiveContext().Name()))
+	cmd.Stderr = os.Stderr
+
+	out, err := cmd.Output()
+	if err != nil {
+		return "", fmt.Errorf("could not retrieve token: %w", err)
+	}
+	tok := strings.TrimSpace(string(out))
+	cmdCache[cmdStr] = tok
+	return tok, nil
+}

internal/state/helpers.go

@@ -15,7 +15,7 @@ func Wrap(s State, f func(State, *cobra.Command, []string) error) func(*cobra.Co
 }
 
 func (c *state) EnsureToken(_ *cobra.Command, _ []string) error {
-	token, err := config.OptionToken.Get(c.config)
+	token, err := config.RetrieveToken(c.config)
 	if err != nil {
 		return err
 	}

internal/state/state.go

@@ -64,7 +64,7 @@ func (c *state) Terminal() terminal.Terminal {
 }
 
 func (c *state) newClient() (hcapi2.Client, error) {
-	tok, err := config.OptionToken.Get(c.config)
+	tok, err := config.RetrieveToken(c.config)
 	if err != nil {
 		return nil, err
 	}