Change behavior of -token and -password to support env/file only (#2327)

* Revert "Remove `-token` flag (#2303)"

This reverts commit 65cff995d7.

* Change behavior of -token

* Add use of MustParsePath

* Update changelog

* Use errors.Is

internal/cmd/base/base.go

@@ -21,6 +21,7 @@ import (
 	"github.com/hashicorp/go-hclog"
 	wrapping "github.com/hashicorp/go-kms-wrapping/v2"
 	configutil "github.com/hashicorp/go-secure-stdlib/configutil/v2"
+	"github.com/hashicorp/go-secure-stdlib/parseutil"
 	"github.com/hashicorp/go-secure-stdlib/pluginutil/v2"
 	"github.com/mitchellh/cli"
 	"github.com/pkg/errors"
@@ -93,6 +94,7 @@ type Command struct {
 	flagTLSInsecure   bool
 
 	flagFormat           string
+	FlagToken            string
 	FlagTokenName        string
 	FlagKeyringType      string
 	FlagRecoveryConfig   string
@@ -273,6 +275,22 @@ func (c *Command) Client(opt ...Option) (*api.Client, error) {
 
 		c.client.SetRecoveryKmsWrapper(wrapper)
 
+	case c.FlagToken != "":
+		token, err := parseutil.MustParsePath(c.FlagToken)
+		switch {
+		case err == nil:
+		case errors.Is(err, parseutil.ErrNotParsed):
+			return nil, errors.New("Token flag must be used with env:// or file:// syntax")
+		default:
+			return nil, fmt.Errorf("error parsing token flag: %w", err)
+		}
+		c.client.SetToken(token)
+
+	case c.FlagToken == "" && os.Getenv(envToken) != "":
+		// Backwards compat: allow reading from existing BOUNDARY_TOKEN env var
+		c.UI.Warn(`Direct usage of BOUNDARY_TOKEN env var is deprecated; please use "-token env://<env var nameL>" format, e.g. "-token env://BOUNDARY_TOKEN" to specify an env var to use.`)
+		c.client.SetToken(os.Getenv(envToken))
+
 	case c.client.Token() == "" && strings.ToLower(c.FlagKeyringType) != "none":
 		keyringType, tokenName, err := c.DiscoverKeyringTokenInfo()
 		if err != nil {
@@ -393,6 +411,13 @@ func (c *Command) FlagSet(bit FlagSetBit) *FlagSets {
 				Usage:   `The type of keyring to use. Defaults to "auto" which will use the Windows credential manager, OSX keychain, or cross-platform password store depending on platform. Set to "none" to disable keyring functionality. Available types, depending on platform, are: "wincred", "keychain", "pass", and "secret-service".`,
 			})
 
+			f.StringVar(&StringVar{
+				Name:   "token",
+				Target: &c.FlagToken,
+				EnvVar: envToken,
+				Usage:  `A URL pointing to a file on disk (file://) from which a token will be read or an env var (env://) from which the token will be read. Overrides the "token-name" parameter.`,
+			})
+
 			f.StringVar(&StringVar{
 				Name:   "recovery-config",
 				Target: &c.FlagRecoveryConfig,