From 5e866aa12c40c1b43b4c20a38624cac3d9ded3bf Mon Sep 17 00:00:00 2001
From: Allen Lew <alew@magnite.com>
Date: Thu, 30 Jul 2026 15:06:59 -0700
Subject: [PATCH] fix: use env vars for Akamai credential provisioning

The DefaultProvisioner wrote a temp .edgerc file and appended
--edgerc/--section flags to the command line. This breaks with Akamai
CLI sub-packages (e.g. cli-gtm) because:

- op's SDK appends these flags AFTER the subcommand, but cli-gtm reads
  the path via c.GlobalString("edgerc"), which only captures the flag
  when it appears BEFORE the subcommand. The flag is silently dropped.
- The EDGERC env var this plugin set is only read by the Akamai
  Terraform provider, not by the akamai CLI or its sub-packages.

With both paths ineffective, edgegrid falls back to the default
~/.edgerc, which doesn't exist for plugin users, causing:

  unable to load config from environment or .edgerc file:
  loading config file: open ~/.edgerc: no such file or directory

cli-gtm (and other Go/edgegrid-v2 based packages) call
edgegrid.New(WithEnv(true), ...), which tries AKAMAI_HOST,
AKAMAI_CLIENT_TOKEN, AKAMAI_CLIENT_SECRET, and AKAMAI_ACCESS_TOKEN
before falling back to any file. Switching the DefaultProvisioner to
provision.EnvVars sets those directly, which the child process
inherits regardless of argument position, sidestepping the
arg-placement bug entirely.

Verified locally with a build override (make akamai/build) against:
  akamai gtm query-status rubiconproject.net.akadns.net \
    --property=video-server --verbose

Before this fix: failed with the .edgerc error above.
After this fix: authenticated via 1Password-injected environment
variables and returned real GTM property status (domain, property,
and reporting period).
---
 plugins/akamai/api_client_credentials.go      | 39 ++++++-------------
 plugins/akamai/api_client_credentials_test.go |  9 ++---
 2 files changed, 15 insertions(+), 33 deletions(-)

diff --git a/plugins/akamai/api_client_credentials.go b/plugins/akamai/api_client_credentials.go
index 87fda0dbf..3364a83ea 100644
--- a/plugins/akamai/api_client_credentials.go
+++ b/plugins/akamai/api_client_credentials.go
@@ -71,39 +71,22 @@ func APIClientCredentials() schema.CredentialType {
 				},
 			},
 		},
-		DefaultProvisioner: provision.TempFile(configFile,
-			provision.Filename(".edgerc"),
-			provision.AddArgs(
-				"--edgerc", "{{ .Path }}",
-				"--section", "default",
-			),
-			provision.SetPathAsEnvVar("EDGERC"), // for Akamai Terraform provider
-		),
+		DefaultProvisioner: provision.EnvVars(defaultEnvVarMapping),
 		Importer: importer.TryAll(
 			TryAkamaiConfigFile(),
 		)}
 }
 
-func configFile(in sdk.ProvisionInput) ([]byte, error) {
-	contents := "[default]\n"
-
-	if clientsecret, ok := in.ItemFields[fieldname.ClientSecret]; ok {
-		contents += "client_secret = " + clientsecret + "\n"
-	}
-
-	if host, ok := in.ItemFields[fieldname.Host]; ok {
-		contents += "host = " + host + "\n"
-	}
-
-	if accesstoken, ok := in.ItemFields[fieldname.AccessToken]; ok {
-		contents += "access_token = " + accesstoken + "\n"
-	}
-
-	if clienttoken, ok := in.ItemFields[fieldname.ClientToken]; ok {
-		contents += "client_token = " + clienttoken + "\n"
-	}
-
-	return []byte(contents), nil
+// Akamai's edgegrid library (used by the Akamai CLI and its sub-packages) checks these
+// environment variables before falling back to the ~/.edgerc file. Using them avoids
+// relying on command-line flag injection, which several Akamai CLI packages (e.g. cli-gtm)
+// don't parse correctly when the flags are appended after the subcommand.
+// See: https://github.com/akamai/AkamaiOPEN-edgegrid-golang/blob/master/pkg/edgegrid/config.go
+var defaultEnvVarMapping = map[string]sdk.FieldName{
+	"AKAMAI_HOST":          fieldname.Host,
+	"AKAMAI_CLIENT_TOKEN":  fieldname.ClientToken,
+	"AKAMAI_CLIENT_SECRET": fieldname.ClientSecret,
+	"AKAMAI_ACCESS_TOKEN":  fieldname.AccessToken,
 }
 
 // Load credentials from the ~/.edgerc file.
diff --git a/plugins/akamai/api_client_credentials_test.go b/plugins/akamai/api_client_credentials_test.go
index 3ec4bc893..13bcbb6bb 100644
--- a/plugins/akamai/api_client_credentials_test.go
+++ b/plugins/akamai/api_client_credentials_test.go
@@ -18,12 +18,11 @@ func TestAPIClientCredentialsProvisioner(t *testing.T) {
 				fieldname.ClientToken:  "akab-nomoflavjuc4422e-fa2xznerxrm3teg7",
 			},
 			ExpectedOutput: sdk.ProvisionOutput{
-				CommandLine: []string{"--edgerc", "/tmp/.edgerc", "--section", "default"},
-				Files: map[string]sdk.OutputFile{
-					"/tmp/.edgerc": {Contents: []byte(plugintest.LoadFixture(t, ".edgerc-single"))},
-				},
 				Environment: map[string]string{
-					"EDGERC": "/tmp/.edgerc",
+					"AKAMAI_HOST":          "akab-lmn789n2k53w7qrs-nfkxaa4lfk3kd6ym.luna.akamaiapis.net",
+					"AKAMAI_CLIENT_TOKEN":  "akab-nomoflavjuc4422e-fa2xznerxrm3teg7",
+					"AKAMAI_CLIENT_SECRET": "abcdE23FNkBxy456z25qx9Yp5CPUxlEfQeTDkfh4QA=I",
+					"AKAMAI_ACCESS_TOKEN":  "akab-zyx987xa6osbli4k-e7jf5ikib5jknes3",
 				},
 			},
 		},