DownloadAuth resolves the credential and team used to download (and meter) plugins. In the headless platform-destination flow — a cqpd_ token in CQ_PLATFORM_TOKEN or CLOUDQUERY_API_KEY (see platformToken) — it returns that token and the team from its `tm` claim, so a sync needs no `cloudquery login`
(ctx context.Context, logger zerolog.Logger, sources []*specs.Source, destinations []*specs.Destination, transformers []*specs.Transformer)
| 219 | // back to the cloud login / team-API-key token and its team. Centralizing the |
| 220 | // env read keeps sync and migrate from drifting. |
| 221 | func DownloadAuth(ctx context.Context, logger zerolog.Logger, sources []*specs.Source, destinations []*specs.Destination, transformers []*specs.Transformer) (token, team string, err error) { |
| 222 | if t := platformToken(); t != "" { |
| 223 | return t, TeamFromToken(t), nil |
| 224 | } |
| 225 | authToken, err := cqauth.GetAuthTokenIfNeeded(logger, sources, destinations, transformers) |
| 226 | if err != nil { |
| 227 | return "", "", fmt.Errorf("failed to get auth token: %w", err) |
| 228 | } |
| 229 | teamName, err := cqauth.GetTeamForToken(ctx, authToken) |
| 230 | if err != nil { |
| 231 | return "", "", fmt.Errorf("failed to get team name from token: %w", err) |
| 232 | } |
| 233 | return authToken.Value, teamName, nil |
| 234 | } |
| 235 | |
| 236 | // TeamFromToken returns the cloud team (`tm` claim) embedded in a cqpd_ token, |
| 237 | // or "" if absent/malformed. The CLI uses it to target the team-scoped |