fix: fix auth flow when creating project with access token

Relates to STACKITTPR-761

Author: SerseusWasTaken

internal/cmd/project/create/create.go

@@ -148,29 +148,9 @@ func parseInput(p *print.Printer, cmd *cobra.Command, _ []string) (*inputModel,
 func buildRequest(ctx context.Context, model *inputModel, apiClient *resourcemanager.APIClient) (resourcemanager.ApiCreateProjectRequest, error) {
 	req := apiClient.DefaultAPI.CreateProject(ctx)
 
-	authFlow, err := auth.GetAuthFlow()
+	email, err := auth.GetAuthEmail()
 	if err != nil {
-		return req, fmt.Errorf("get authentication flow: %w", err)
-	}
-	var email string
-	switch authFlow {
-	case auth.AUTH_FLOW_SERVICE_ACCOUNT_TOKEN:
-		email, err = auth.GetAuthField(auth.SERVICE_ACCOUNT_EMAIL)
-		if err != nil {
-			return req, fmt.Errorf("get email of the service account that was used to authenticate: %w", err)
-		}
-	case auth.AUTH_FLOW_SERVICE_ACCOUNT_KEY:
-		email, err = auth.GetAuthField(auth.SERVICE_ACCOUNT_EMAIL)
-		if err != nil {
-			return req, fmt.Errorf("get email of the service account that was used to authenticate: %w", err)
-		}
-	case auth.AUTH_FLOW_USER_TOKEN:
-		email, err = auth.GetAuthField(auth.USER_EMAIL)
-		if err != nil {
-			return req, fmt.Errorf("get your user email from configuration: %w", err)
-		}
-	default:
-		return req, fmt.Errorf("the configured authentication flow (%s) is not supported, please report this issue", authFlow)
+		return req, fmt.Errorf("get email of authenticated user: %w", err)
 	}
 
 	if email == "" {

internal/cmd/project/create/create_test.go

@@ -2,6 +2,9 @@ package create
 
 import (
 	"context"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
@@ -25,6 +28,15 @@ var testParentId = uuid.NewString()
 var testNetworkAreaId = uuid.NewString()
 var testEmail = "email"
 
+// buildTestJWT creates an unsigned JWT token containing the given email claim.
+// getEmailFromToken uses ParseUnverified, so no real signing key is needed.
+func buildTestJWT(email string) string {
+	header, _ := json.Marshal(map[string]string{"alg": "HS256", "typ": "JWT"})
+	payload, _ := json.Marshal(map[string]string{"email": email})
+	enc := base64.RawURLEncoding
+	return fmt.Sprintf("%s.%s.fakesig", enc.EncodeToString(header), enc.EncodeToString(payload))
+}
+
 func fixtureFlagValues(mods ...func(flagValues map[string]string)) map[string]string {
 	flagValues := map[string]string{
 		parentIdFlag:      testParentId,
@@ -193,6 +205,7 @@ func TestBuildRequest(t *testing.T) {
 		authFlow        auth.AuthFlow
 		sa_email        *string
 		user_email      *string
+		accessToken     *string
 		expectedRequest resourcemanager.ApiCreateProjectRequest
 		isValid         bool
 	}{
@@ -220,6 +233,13 @@ func TestBuildRequest(t *testing.T) {
 			expectedRequest: fixtureRequest(),
 			isValid:         true,
 		},
+		{
+			description:     "access_token_env_var_no_stored_auth_flow",
+			model:           fixtureInputModel(),
+			accessToken:     utils.Ptr(buildTestJWT(testEmail)),
+			expectedRequest: fixtureRequest(),
+			isValid:         true,
+		},
 		{
 			description: "missing_network_area_id sa_key",
 			model: fixtureInputModel(
@@ -296,6 +316,9 @@ func TestBuildRequest(t *testing.T) {
 					t.Fatalf("Failed to set user email in storage: %v", err)
 				}
 			}
+			if tt.accessToken != nil {
+				t.Setenv("STACKIT_ACCESS_TOKEN", *tt.accessToken)
+			}
 			request, err := buildRequest(testCtx, tt.model, testClient)
 			if err != nil {
 				if !tt.isValid {