Function MaybeInjectDestination

cli/internal/platform/inject.go:280–358

MaybeInjectDestination injects a `platform` destination carrying a freshly minted cqpd_ token — but only when the spec opts in by listing `platform` in a source's `destinations`. If the user already declares a `platform` destination themselves (e.g. for debugging), theirs is used as-is. With no opt-

(ctx context.Context, logger zerolog.Logger, token, teamName string, sources []*specs.Source, destinations []*specs.Destination)

// destination themselves (e.g. for debugging), theirs is used as-is. With no
// opt-in, or on any credential/tenant failure, the spec is returned unchanged.
func MaybeInjectDestination(ctx context.Context, logger zerolog.Logger, token, teamName string, sources []*specs.Source, destinations []*specs.Destination) ([]*specs.Destination, error) {
	if os.Getenv(envDisable) == "1" {
		return destinations, nil
	}
	if env.IsCloud() {
		return destinations, nil
	}

	// Opt-in only: inject solely when a source targets the platform destination.
	// No source references it → nothing to do (no cloud calls, no surprise
	// dual-write).
	if !anySourceTargetsPlatform(sources) {
		return destinations, nil
	}
	// The user defined the `platform` destination themselves (debugging/override)
	// — respect it, don't inject over it.
	if hasPlatformDestination(destinations) {
		return destinations, nil
	}

	// Direct token: a pre-minted cqpd_ token supplied via env (CQ_PLATFORM_TOKEN
	// or a cqpd_ in CLOUDQUERY_API_KEY) injects the destination without cloud
	// login, tenant discovery or a session mint — the token already identifies
	// the tenant and carries its API URL.
	if t := platformToken(); t != "" {
		// Recommended plugin version: the env override wins (so skip the lookup),
		// otherwise ask the platform's whoami so the headless flow pins the right
		// version — the non-headless path gets this from the session mint instead.
		recommendedVersion := ""
		if os.Getenv(envPluginVersion) == "" {
			recommendedVersion = recommendedVersionFromWhoami(ctx, logger, t)
		}
		// No tenant id: the direct path doesn't parse the token's claims.
		return injectPlatformDestination(logger, destinations, sources, t, recommendedVersion, ""), nil
	}

	// The caller only fetches a token for cloudquery-registry specs; resolve
	// directly so source-only specs can still inject. Failure just skips.
	if token == "" {
		var err error
		if token, teamName, err = resolveCredentials(ctx); err != nil {
			logger.Debug().Err(err).Msg("platform destination: credentials unavailable, skipping auto-injection")
			return destinations, nil
		}
	}
	if token == "" || teamName == "" {
		return destinations, nil
	}

	cl, err := api.NewClient(token)
	if err != nil {
		logger.Debug().Err(err).Msg("platform destination: api client init failed, skipping auto-injection")
		return destinations, nil
	}

	tenants, err := activeTenants(ctx, cl, teamName)
	if err != nil {
		logger.Debug().Err(err).Msg("platform destination: tenant discovery failed, skipping auto-injection")