Hide sensitive environment variables

[rgreinho]

Make sure you completed the following tasks

• Searched the discussions
• Searched the closed issues

Describe your use case

I would like to use sensitive information from environment variables and have them being hidden from the CLI help. In my case I would like to hide my GitHub token.

I found the feature I wanted in clap 2 with ArgSettings::HideEnvValues, but it looks like it has not been ported to Clap 3.

I am also trying to make arguments backed by an environment variable optional (it is currently shown as a mandatory option):

1. Check for a token specified via the cli (i.e. via --token)
2. If not provided via the cli, check the environment variables (i.e. via GITHUB_TOKEN)
3. If not found, the parsing fails and the help message is being displayed

Describe the solution you'd like

Create a project:

cd /tmp
cargo new sensitive-env-var
cd sensitive-env-var/
cargo add clap --allow-prerelease

The code:

use clap::Clap;

/// A utility to collect GitHub information.
#[derive(Clap, Debug)]
pub struct Opts {
    // Set GitHub token.
    #[clap(long, env = "GITHUB_TOKEN")]
    token: String,
}

fn main() {
    let opts: Opts = Opts::parse();
    dbg!(opts);
    println!("A GitHub token was provided!");
}

And unset the GitHub token with unset GITHUB_TOKEN.

First case, no token is provided at all:

$ cargo run -q
error: The following required arguments were not provided:
    --token <token>

USAGE:
    sensitive-env-var --token <token>

For more information try --help

Clap shows an error, everything as expected, except for the fact that --token <token> is shown as a mandatory option.

Second case, we pass a token via the cli:

$ cargo run -q -- --token 1234abcd
[src/main.rs:13] opts = Opts {
    token: "1234abcd",
}
A GitHub token was provided!

Here, we are happy, no problem.

Third case, we pass a token via the environment variable:

$ export GITHUB_TOKEN=0987poiu
$ cargo run -q
[src/main.rs:13] opts = Opts {
    token: "0987poiu",
}
A GitHub token was provided!

We are also happy with the application behavior, however, the token is displayed on the help screen:

$ cargo run -q -- --help
sensitive-env-var
A utility to collect GitHub information

USAGE:
    sensitive-env-var --token <token>

FLAGS:
    -h, --help       Prints help information
    -V, --version    Prints version information

OPTIONS:
        --token <token>     [env: GITHUB_TOKEN=0987poiu]

The sensitive value should be hidden here.

My ultimate use case:

I modified my Opts structure to put the token in an Option:

token: Option<String>,

And now what I would like to achieve:

$ cargo run -q -- --help
sensitive-env-var
A utility to collect GitHub information

USAGE:
    sensitive-env-var [OPTIONS]

FLAGS:
    -h, --help       Prints help information
    -V, --version    Prints version information

OPTIONS:
        --token <token>     [env: GITHUB_TOKEN]

1. The GITHUB_TOKEN value does not appear on the help screen
2. The --token does not appear as mandatory on the CLI, because it is backed by an environment variable
3. If none of them if provided, Clap shows the same error message as before.

[CreepySkeleton]

I found the feature I wanted in clap 2 with ArgSettings::HideEnvValues, but it looks like it has not been ported to Clap 3.

Wait a minute, I see it! It's right there! Unless I'm having hallucinations - but this is unlikely because I'm out of crack - you should be able to just use it, can't you? Or are you reporting it fails to work?

[rgreinho]

Then maybe an example with derive? I tried a few combinations, like this:

#[clap(long, env = "GITHUB_TOKEN", hideenvvalues)]

but I was not able to get it to work.

[newAM]

This should work:

#[clap(long, env = "GITHUB_TOKEN", setting = ArgSettings::HideEnvValues)]

[astraw]

See #2101 (comment) for an answer that works with clap 4.

[rgreinho]

That worked! Thank you very much!

I solved my problem number 2 ("I don't want the --token to appear as mandatory on the CLI, because it is backed by an environment variable"), by combining it with the ensure!() macro from `anyhow:

use anyhow::{ensure, Result};
use clap::{ArgSettings, Clap};

/// A utility to collect GitHub information.
#[derive(Clap, Debug)]
pub struct Opts {
    // Set GitHub token.
    #[clap(long, env = "GITHUB_TOKEN", setting = ArgSettings::HideEnvValues)]
    token: Option<String>,
}

fn main() -> Result<()> {
    let opts: Opts = Opts::parse();
    ensure!(opts.token.is_some(), "A GitHub token must be provided.");
    println!("A GitHub token was provided!");
    Ok(())
}

Is there a more clap-like approach to achieve this?

[CreepySkeleton]

Sure, just use String instead of Option<String>. That will make the option required, as it already de-facto is.

I don't want the --token to appear as mandatory on the CLI, because it is backed by an environment variable

But it is mandatory, isn't it? The fact that it's backed by an env var will be reflected in the help message:

OPTIONS:
        --token <token>     [env: GITHUB_TOKEN]

[pksunkara]

validators are made for this scenario.

I am moving this to discussion.

[EnigmaCurry]

I ran into this again in v4.3.23, and the syntax for the fix has since changed. I now use hide_env_vars(true) like this instead and it is working:

#[derive(Args, Debug, Serialize, Clone)]
#[command(author, version, about, long_about = None)]
pub struct ServerArgs {
    #[arg(env, hide_env_values(true), default_value_t = String::from("insecure-app-secret-change-me-now"))]
    #[serde(skip_serializing)]
    pub app_secret: String,
}