fix(objectstore): guard credential secret against unsafe args[0] indexing and reject extra args

cmd/objectstore/objectstore_credential_secret.go

@@ -14,6 +14,7 @@ var objectStoreCredentialSecretCmd = &cobra.Command{
 	Use:     "secret",
 	Short:   "Access the secret key for the Object Store by providing your access key.",
 	Example: "civo objectstore credential secret --access-key ACCESS_KEY",
+	Args:    cobra.MaximumNArgs(1),
 	Run: func(cmd *cobra.Command, args []string) {
 		utility.EnsureCurrentRegion()
 
@@ -27,12 +28,7 @@ var objectStoreCredentialSecretCmd = &cobra.Command{
 			client.Region = common.RegionSet
 		}
 
-		var key string
-		if accessKey != "" {
-			key = accessKey
-		} else if args[0] != "" {
-			key = args[0]
-		}
+		key := resolveAccessKey(accessKey, args)
 
 		if key == "" {
 			utility.Error("You must provide an access key. See --help for more information.")
@@ -66,3 +62,16 @@ var objectStoreCredentialSecretCmd = &cobra.Command{
 		}
 	},
 }
+
+// resolveAccessKey returns the access key to use for the command: the
+// --access-key flag takes precedence, otherwise the first positional
+// argument is used, if any.
+func resolveAccessKey(accessKey string, args []string) string {
+	if accessKey != "" {
+		return accessKey
+	}
+	if len(args) > 0 {
+		return args[0]
+	}
+	return ""
+}

cmd/objectstore/objectstore_credential_secret_test.go

@@ -0,0 +1,46 @@
+package objectstore
+
+import "testing"
+
+func TestResolveAccessKey(t *testing.T) {
+	tests := []struct {
+		name      string
+		accessKey string
+		args      []string
+		expected  string
+	}{
+		{
+			name:      "no flag and no args",
+			accessKey: "",
+			args:      []string{},
+			expected:  "",
+		},
+		{
+			name:      "positional arg only",
+			accessKey: "",
+			args:      []string{"abc123"},
+			expected:  "abc123",
+		},
+		{
+			name:      "flag only",
+			accessKey: "flagkey",
+			args:      []string{},
+			expected:  "flagkey",
+		},
+		{
+			name:      "flag takes precedence over positional arg",
+			accessKey: "flagkey",
+			args:      []string{"abc123"},
+			expected:  "flagkey",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := resolveAccessKey(tt.accessKey, tt.args)
+			if result != tt.expected {
+				t.Errorf("resolveAccessKey(%q, %v) = %q, want %q", tt.accessKey, tt.args, result, tt.expected)
+			}
+		})
+	}
+}