Change behavior of -token and -password to support env/file only (#2327)

* Revert "Remove `-token` flag (#2303)"

This reverts commit 65cff995d7.

* Change behavior of -token

* Add use of MustParsePath

* Update changelog

* Use errors.Is

internal/cmd/commands/credentialscmd/ssh-private-key_funcs.go

@@ -1,6 +1,9 @@
 package credentialscmd
 
 import (
+	"errors"
+	"fmt"
+
 	"github.com/hashicorp/boundary/api/credentials"
 	"github.com/hashicorp/boundary/internal/cmd/base"
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
@@ -58,9 +61,14 @@ func extraSshPrivateKeyFlagHandlingFuncImpl(c *SshPrivateKeyCommand, _ *base.Fla
 	switch c.flagPrivateKey {
 	case "":
 	default:
-		privateKey, err := parseutil.ParsePath(c.flagPrivateKey)
-		if err != nil && err.Error() != parseutil.ErrNotAUrl.Error() {
-			c.UI.Error("Error parsing private key flag: " + err.Error())
+		privateKey, err := parseutil.MustParsePath(c.flagPrivateKey)
+		switch {
+		case err == nil:
+		case errors.Is(err, parseutil.ErrNotParsed):
+			c.UI.Error("Private key flag must be used with env:// or file:// syntax")
+			return false
+		default:
+			c.UI.Error(fmt.Sprintf("Error parsing private key flag: %v", err))
 			return false
 		}
 		*opts = append(*opts, credentials.WithSshPrivateKeyCredentialPrivateKey(privateKey))

internal/cmd/commands/credentialscmd/username-password_funcs.go

@@ -1,6 +1,9 @@
 package credentialscmd
 
 import (
+	"errors"
+	"fmt"
+
 	"github.com/hashicorp/boundary/api/credentials"
 	"github.com/hashicorp/boundary/internal/cmd/base"
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
@@ -43,7 +46,7 @@ func extraUsernamePasswordFlagsFuncImpl(c *UsernamePasswordCommand, set *base.Fl
 			f.StringVar(&base.StringVar{
 				Name:   passwordFlagName,
 				Target: &c.flagPassword,
-				Usage:  "The password associated with the credential. This can be the value itself, refer to a file on disk (file://) from which the value will be read, or an env var (env://) from which the value will be read.",
+				Usage:  "The password associated with the credential. This can be a file on disk (file://) from which the value will be read, or an env var (env://) from which the value will be read.",
 			})
 		}
 	}
@@ -58,9 +61,14 @@ func extraUsernamePasswordFlagHandlingFuncImpl(c *UsernamePasswordCommand, _ *ba
 	switch c.flagPassword {
 	case "":
 	default:
-		password, err := parseutil.ParsePath(c.flagPassword)
-		if err != nil && err.Error() != parseutil.ErrNotAUrl.Error() {
-			c.UI.Error("Error parsing password flag: " + err.Error())
+		password, err := parseutil.MustParsePath(c.flagPassword)
+		switch {
+		case err == nil:
+		case errors.Is(err, parseutil.ErrNotParsed):
+			c.UI.Error("Password flag must be used with env:// or file:// syntax")
+			return false
+		default:
+			c.UI.Error(fmt.Sprintf("Error parsing password flag: %v", err))
 			return false
 		}
 		*opts = append(*opts, credentials.WithUsernamePasswordCredentialPassword(password))