stdin functionality not working for sf org login sfdx-url

[k-capehart]

Summary

A few weeks ago, I helped create a new flag for the org login sfdx-url command called sfdx-url-stdin, which (in conjunction with a new oclif feature) alloows piping in a value from standard input. This new feature passed all tests during development.

However, now that this is released, when attempting the above I get this error:
Error (1): Invalid SFDX auth URL. Must be in the format "force://<clientId>:<clientSecret>:<refreshToken>@<instanceUrl>". Note that the SFDX auth URL uses the "force" protocol, and not "http" or "https". Also note that the "instanceUrl" inside the SFDX auth URL doesn't include the protocol ("https://").

When using auth file method, the same URL works as expected.

Here are the relevant PRs for reference. This still works locally, so either I'm not understanding how the releases work or something else is wrong.

• feat: allow stdin for sfdx-url salesforcecli/plugin-auth#886
• feat: allowStdin option for flags oclif/core#894

Steps To Reproduce

1. sf org display --verbose
2. Copy outputted SFDX Auth URL and provide in next step.
3. echo url | sf org login sfdx-url --sfdx-url-stdin -
4. Note that the '-' character is given as the value, but the URL should be piped in. The command correctly gives an error if any other value other than '-' is given.
5. Invalid SFDX auth URL error is generated.

Expected result

A successful authentication message should have appeared.

Actual result

The following error is displayed instead: Error (1): Invalid SFDX auth URL. Must be in the format "force://<clientId>:<clientSecret>:<refreshToken>@<instanceUrl>". Note that the SFDX auth URL uses the "force" protocol, and not "http" or "https". Also note that the "instanceUrl" inside the SFDX auth URL doesn't include the protocol ("https://").

System Information

Using zsh on MacOS

{
  "architecture": "darwin-arm64",
  "cliVersion": "@salesforce/cli/2.26.10",
  "nodeVersion": "node-v21.6.1",
  "osVersion": "Darwin 22.3.0",
  "rootPath": "/opt/homebrew/lib/node_modules/@salesforce/cli",
  "shell": "zsh",
  "pluginVersions": [
    "@oclif/plugin-autocomplete 3.0.5 (core)",
    "@oclif/plugin-commands 3.1.1 (core)",
    "@oclif/plugin-help 6.0.12 (core)",
    "@oclif/plugin-not-found 3.0.9 (core)",
    "@oclif/plugin-plugins 4.1.21 (core)",
    "@oclif/plugin-search 1.0.12 (core)",
    "@oclif/plugin-update 4.1.8 (core)",
    "@oclif/plugin-version 2.0.11 (core)",
    "@oclif/plugin-warn-if-update-available 3.0.9 (core)",
    "@oclif/plugin-which 3.0.15 (core)",
    "@salesforce/cli 2.26.10 (core)",
    "apex 3.0.20 (core)",
    "auth 3.3.3 (core)",
    "data 3.0.17 (core)",
    "deploy-retrieve 2.2.12 (user)",
    "dev 2.1.4 (user)",
    "info 3.0.18 (core)",
    "limits 3.1.5 (core)",
    "marketplace 1.0.18 (core)",
    "org 3.3.8 (core)",
    "packaging 1.26.3 (user)",
    "schema 3.1.0 (core)",
    "settings 2.0.19 (core)",
    "signups 2.0.15 (user)",
    "sobject 1.1.3 (core)",
    "source 3.1.6 (core)",
    "telemetry 3.1.10 (core)",
    "templates 56.0.11 (core)",
    "trust 3.3.2 (core)",
    "user 3.2.4 (core)",
    "@salesforce/sfdx-plugin-lwc-test 1.1.1 (user)",
    "@salesforce/sfdx-scanner 3.19.0 (user)"
  ]
}

[github-actions]

Thank you for filing this issue. We appreciate your feedback and will review the issue as soon as possible. Remember, however, that GitHub isn't a mechanism for receiving support under any agreement or SLA. If you require immediate assistance, contact Salesforce Customer Support.

[k-capehart]

@mdonnalley I wanted to grab your attention on this, since you helped me implement this feature at the time and may have insight on why this may not be working in prod.

[mdonnalley]

@k-capehart Looks like the flag is being parsed twice in production for some reason. So it gets the correct url from stdin on the first parse but then the second parse doesn't find anything in stdin so it returns the -, which of course isn't a valid auth url

Still getting to the bottom of this but I'll hopefully get a PR to oclif/core today to fix it

[mdonnalley]

@k-capehart I have a workaround for you - disable telemetry either by setting the SF_DISABLE_TELEMETRY=true env var or by running sf config set disable-telemetry=true --global

The issue is that our telemetry is calling parse to get information about the flags, so it's essentially stealing the stdin value from the actual command

[k-capehart]

@k-capehart I have a workaround for you - disable telemetry either by setting the SF_DISABLE_TELEMETRY=true env var or by running sf config set disable-telemetry=true --global

The issue is that our telemetry is calling parse to get information about the flags, so it's essentially stealing the stdin value from the actual command

Oh interesting. Thank you, that at least let's me use the functionality for now.

[git2gus]

This issue has been linked to a new work item: W-14954770

[jshackell-sfdc]

This issue is fixed in version 2.28.6.

[k-capehart]

Thanks all! I just verified that everything is working on my end now

[tggagne]

Is it possible the error has returned? I'm trying to get it to work inside the sf-provided docker container for cicd and it's complaining.
I've tried

1. echo $SFALIAS | sf org login sfdx-url --sfdx-url-stdin
2. echo $SFALIAS | sf org login sfdx-url --sfdx-url-stdin -
3. echo $SFALIAS | jq | sf org login sfdx-url --sfdx-url-stdin
4. echo $SFALIAS | jq | sf org login sfdx-url --sfdx-url-stdin -
5. echo $SFALIAS | jq > authfile && sf org login sfdx-url --sfdx-url-file authfile

And they all return the error:

Error (INVALID_SFDX_AUTH_URL): Invalid SFDX auth URL. Must be in the format "force://<clientId>:<clientSecret>:<refreshToken>@<instanceUrl>". Note that the SFDX auth URL uses the "force" protocol, and not "http" or "https". Also note that the "instanceUrl" inside the SFDX auth URL doesn't include the protocol ("https://").

The sfdxAuthUrl resembles:

sandbox
"force://PlatformCLI::[email protected]"

production
"force://PlatformCLI::[email protected]"

root@f4f85afa0859:/# sf version --verbose
CLI Version:
@salesforce/cli/2.58.7 published 18 days ago (Wed Sep 04 2024)

Architecture:
linux-x64

Node Version:
node-v20.17.0

Plugin Version:
@oclif/plugin-autocomplete 3.2.2 (core)
@oclif/plugin-commands 4.0.13 (core)
@oclif/plugin-help 6.2.10 (core)
@oclif/plugin-not-found 3.2.18 (core)
@oclif/plugin-plugins 5.4.6 (core)
@oclif/plugin-search 1.2.7 (core)
@oclif/plugin-update 4.5.5 (core)
@oclif/plugin-version 2.2.11 (core)
@oclif/plugin-warn-if-update-available 3.1.13 (core)
@oclif/plugin-which 3.2.12 (core)
@salesforce/cli 2.58.7 (core)
apex 3.4.8 (core)
api 1.2.1 (core)
auth 3.6.54 (core)
data 3.6.5 (core)
deploy-retrieve 3.12.3 (core)
info 3.4.3 (core)
limits 3.3.29 (core)
marketplace 1.2.25 (core)
org 4.5.7 (core)
packaging 2.8.2 (core)
schema 3.3.26 (core)
settings 2.3.16 (core)
sobject 1.4.33 (core)
source 3.5.18 (core)
telemetry 3.6.10 (core)
templates 56.3.17 (core)
trust 3.7.27 (core)
user 3.5.29 (core)
sfdx-git-delta 5.45.0 (user) published 3 days ago (Fri Sep 20 2024)

OS and Version:
Linux 6.6.16-linuxkit

Shell:
bash

Root Path:
/usr/local/lib/nodejs/lib/node_modules/@salesforce/cli

[WillieRuemmele]

@tggagne - make sure the $SFALIAS doesn't have any quotes surrounding the URL... I had it in a file, with quotes, and at first it failed

 ➜  cat authFile.json | sf auth sfdxurl store --sfdx-url-stdin -
Error (INVALID_SFDX_AUTH_URL): Invalid SFDX authorization URL. Must be in the format "force://<clientId>:<clientSecret>:<refreshToken>@<instanceUrl>". Note that the "instanceUrl" inside the SFDX authorization URL doesn\'t include the protocol ("https://"). Run "org display --target-org" on an org to see an example of an SFDX authorization URL.

➜  dreamhouse-lwc git:(main) ✗  hub:(GLOBAL - DevHub) scratch:([email protected])
 ➜  cat authFile.json | sf auth sfdxurl store --sfdx-url-stdin -
Successfully authorized [email protected] with org ID 00DDJ000000PWk22AG

once the file contained only the url, it worked

[k-capehart]

@tggagne I just ran my own CI and confirmed it's working there as well. Here's what I have: https://github.com/k-capehart/sfdc-dev-org/blob/098ed3c79435d7248dce1e07c16d157d69a5daea/.github/workflows/main.yml#L28

[tggagne]

Thank you both, @WillieRuemmele and @k-capehart . I was under the false impression that the entirety of the json should be written to the auth file or into the environment variable. It's ONLY the value of sfdxAuthUrl that's passed.

Thanks.

FTR -- because my desktop doesn't have jq but my container does (running from the desktop), I run this command inside my container after it starts.

echo $SFALIAS | jq --raw-output .result.sfdxAuthUrl | sf org login sfdx-url -s -a target -u