command/login: Require "yes" to confirm

[alisdair]

This is for consistency with other commands which use prompts, all of which require "yes" rather than "y" to confirm. Fixes #24514.

After review, this change also includes adding secret/password entry to the UIInput interface and implementation, using the same logic as in mitchellh/cli:

terraform/command/ui_input.go

Lines 135 to 140 in 5a74460

	if opts.Secret && isatty.IsTerminal(os.Stdin.Fd()) {
	line, err = speakeasy.Ask("")
	} else {
	buf := bufio.NewReader(r)
	line, err = buf.ReadString('\n')
	}

Also includes an exciting new horizontal rule in the UI to fix some confusing spacing. Screenshot:

Screenshots

Password/secret prompt (iTerm uses the 🔑 icon to indicate that echo is off):

Login completed, without the token being displayed:

[codecov]

Codecov Report

Merging #25379 into master will increase coverage by 0.00%.
The diff coverage is 86.20%.

Impacted Files	Coverage Δ
command/ui_input.go	61.03% <57.14%> (-1.47%)	⬇️
command/login.go	50.95% <95.45%> (+2.54%)	⬆️
command/cli_ui.go	87.50% <0.00%> (-12.50%)	⬇️
backend/remote/backend_common.go	54.57% <0.00%> (-0.68%)	⬇️

[mildwonkey]

We have an existing pattern for requesting user input (that I only encountered recently myself):
https://github.com/hashicorp/terraform/blob/master/command/013_config_upgrade.go#L149-L166

I genuinely do not know, but I presume there are benefits to this method that might be worth looking into.

[alisdair]

I genuinely do not know, but I presume there are benefits to this method that might be worth looking into.

There are some benefits! Most obvious is that the UI prompts are more helpful, and I think it's better to be consistent with the UI throughout where we can.

But also, testing using UIInput is clearer. We can specify IDs for queries, and a map of ID to answers for test responses. Order then isn't important, and missing IDs in the test map throw useful errors. For cli.Ui.Ask/AskSecret, we have to supply a string of input, each response separated by newlines.

However, UIInput does not support disabling echo for asking passwords, and from my attempts it doesn't seem to be possible to mix the two under test—they have incompatible ways of mocking user input.

So in my latest commit, I added support for a Secret option to UIInput, and migrated the login command across. This does make the change more invasive, but I think it's probably worth it.

Screenshots

Password/secret prompt (iTerm uses the 🔑 icon to indicate that echo is off):

Login completed, without the token being displayed:

[mildwonkey]

This looks good, thanks for digging into command.UIInput!

PS: It looks like you ran go mod tidy, which I completely forgot to run before merging my recent library-bumping PR. Thanks and sorry for the oversight!

[pselle]

I also appreciate this branch name

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.