From a207a3ac2108bad2d762c73b9196165855694129 Mon Sep 17 00:00:00 2001 From: Sundaram Kumar Jha Date: Tue, 7 Jul 2026 02:31:08 +0000 Subject: [PATCH 1/4] fix(cli): apply PHASE_VERIFY_SSL before any network call --- src/cmd/root.go | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/cmd/root.go b/src/cmd/root.go index 265cb76c..3d3ac141 100644 --- a/src/cmd/root.go +++ b/src/cmd/root.go @@ -7,6 +7,7 @@ import ( phaseerrors "github.com/phasehq/cli/pkg/errors" "github.com/phasehq/cli/pkg/version" "github.com/spf13/cobra" + "github.com/phasehq/cli/pkg/config" ) const phaseASCii = ` @@ -40,6 +41,13 @@ func Execute() { } func init() { + // Honor PHASE_VERIFY_SSL=False before any command runs so it applies to + // every network call — including pre-auth flows like + // `phase auth --mode aws-iam` / `--mode azure` that don't go through + // NewPhase(). The SDK caches its HTTP client on first use, so this must + // happen before any request is made. + config.ConfigureSSLVerification() + rootCmd.Version = version.Version rootCmd.SetVersionTemplate("{{ .Version }}\n") @@ -52,4 +60,4 @@ func init() { if helpCmd, _, _ := rootCmd.Find([]string{"help"}); helpCmd != nil { helpCmd.Short = "🤷\u200A" + helpCmd.Short } -} +} \ No newline at end of file From e54f37c6fd64e1720648c860e5a81e671bd68052 Mon Sep 17 00:00:00 2001 From: Sundaram Kumar Jha Date: Tue, 7 Jul 2026 02:31:44 +0000 Subject: [PATCH 2/4] feat(config): add PHASE_VERIFY_SSL parsing helper --- src/pkg/config/env.go | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 src/pkg/config/env.go diff --git a/src/pkg/config/env.go b/src/pkg/config/env.go new file mode 100644 index 00000000..313b1a64 --- /dev/null +++ b/src/pkg/config/env.go @@ -0,0 +1,24 @@ +package config + +import ( + "os" + "strings" + + "github.com/phasehq/golang-sdk/v2/phase/misc" +) + +// ConfigureSSLVerification reads the PHASE_VERIFY_SSL environment variable and +// disables TLS certificate verification in the SDK when it is set to "false" +// (case-insensitive). Any other value — or the variable being unset — keeps +// verification enabled. This mirrors the Python CLI's behavior +// (os.environ.get("PHASE_VERIFY_SSL", "True").lower() != "false") and makes +// the hint shown in SSL error messages ("You may set PHASE_VERIFY_SSL=False +// to bypass this check") actually work. +// +// It must run before any SDK network call: the SDK caches its HTTP client on +// first use, so changes to misc.VerifySSL after that have no effect. +func ConfigureSSLVerification() { + if strings.EqualFold(os.Getenv("PHASE_VERIFY_SSL"), "false") { + misc.VerifySSL = false + } +} \ No newline at end of file From b3b8f4bbe9b3fde62eefe7f753ef255423d1fff2 Mon Sep 17 00:00:00 2001 From: Sundaram Kumar Jha Date: Tue, 7 Jul 2026 02:32:13 +0000 Subject: [PATCH 3/4] test(config): cover PHASE_VERIFY_SSL semantics --- src/pkg/config/env_test.go | 50 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 src/pkg/config/env_test.go diff --git a/src/pkg/config/env_test.go b/src/pkg/config/env_test.go new file mode 100644 index 00000000..095e8e4f --- /dev/null +++ b/src/pkg/config/env_test.go @@ -0,0 +1,50 @@ +package config + +import ( + "os" + "testing" + + "github.com/phasehq/golang-sdk/v2/phase/misc" +) + +func TestConfigureSSLVerification(t *testing.T) { + tests := []struct { + name string + value string + unset bool + wantVerify bool + }{ + {name: "unset keeps verification enabled", unset: true, wantVerify: true}, + {name: "empty keeps verification enabled", value: "", wantVerify: true}, + {name: "False disables verification", value: "False", wantVerify: false}, + {name: "false disables verification", value: "false", wantVerify: false}, + {name: "FALSE disables verification", value: "FALSE", wantVerify: false}, + {name: "true keeps verification enabled", value: "true", wantVerify: true}, + {name: "True keeps verification enabled", value: "True", wantVerify: true}, + {name: "zero keeps verification enabled", value: "0", wantVerify: true}, + {name: "no keeps verification enabled", value: "no", wantVerify: true}, + {name: "arbitrary value keeps verification enabled", value: "banana", wantVerify: true}, + } + + original := misc.VerifySSL + t.Cleanup(func() { misc.VerifySSL = original }) + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + misc.VerifySSL = true // reset the global before each case + + // t.Setenv registers restoration of the original value; for the + // unset case we additionally clear it after registration. + t.Setenv("PHASE_VERIFY_SSL", tt.value) + if tt.unset { + os.Unsetenv("PHASE_VERIFY_SSL") + } + + ConfigureSSLVerification() + + if misc.VerifySSL != tt.wantVerify { + t.Errorf("PHASE_VERIFY_SSL=%q: misc.VerifySSL = %v, want %v", tt.value, misc.VerifySSL, tt.wantVerify) + } + }) + } +} \ No newline at end of file From cb8dac4aaf6292d02e9e8207f0d7412e4f64d06d Mon Sep 17 00:00:00 2001 From: Sundaram Kumar Jha Date: Tue, 7 Jul 2026 11:12:07 +0000 Subject: [PATCH 4/4] chore: format --- src/cmd/root.go | 10 +++++----- src/pkg/config/env.go | 2 +- src/pkg/config/env_test.go | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/cmd/root.go b/src/cmd/root.go index 3d3ac141..5c9d85ff 100644 --- a/src/cmd/root.go +++ b/src/cmd/root.go @@ -4,10 +4,10 @@ import ( "fmt" "os" + "github.com/phasehq/cli/pkg/config" phaseerrors "github.com/phasehq/cli/pkg/errors" "github.com/phasehq/cli/pkg/version" "github.com/spf13/cobra" - "github.com/phasehq/cli/pkg/config" ) const phaseASCii = ` @@ -26,9 +26,9 @@ const phaseASCii = ` const description = "Keep Secrets." var rootCmd = &cobra.Command{ - Use: "phase", - Short: description, - Long: description + "\n" + phaseASCii, + Use: "phase", + Short: description, + Long: description + "\n" + phaseASCii, SilenceUsage: true, SilenceErrors: true, } @@ -60,4 +60,4 @@ func init() { if helpCmd, _, _ := rootCmd.Find([]string{"help"}); helpCmd != nil { helpCmd.Short = "🤷\u200A" + helpCmd.Short } -} \ No newline at end of file +} diff --git a/src/pkg/config/env.go b/src/pkg/config/env.go index 313b1a64..619fc75d 100644 --- a/src/pkg/config/env.go +++ b/src/pkg/config/env.go @@ -21,4 +21,4 @@ func ConfigureSSLVerification() { if strings.EqualFold(os.Getenv("PHASE_VERIFY_SSL"), "false") { misc.VerifySSL = false } -} \ No newline at end of file +} diff --git a/src/pkg/config/env_test.go b/src/pkg/config/env_test.go index 095e8e4f..c5728274 100644 --- a/src/pkg/config/env_test.go +++ b/src/pkg/config/env_test.go @@ -47,4 +47,4 @@ func TestConfigureSSLVerification(t *testing.T) { } }) } -} \ No newline at end of file +}