add error for adding incorrect env flag for service token

cli/packages/util/secrets.go

@@ -17,10 +17,10 @@ import (
 	"github.com/go-resty/resty/v2"
 )
 
-func GetPlainTextSecretsViaServiceToken(fullServiceToken string) ([]models.SingleEnvironmentVariable, error) {
+func GetPlainTextSecretsViaServiceToken(fullServiceToken string) ([]models.SingleEnvironmentVariable, api.GetServiceTokenDetailsResponse, error) {
 	serviceTokenParts := strings.SplitN(fullServiceToken, ".", 4)
 	if len(serviceTokenParts) < 4 {
-		return nil, fmt.Errorf("invalid service token entered. Please double check your service token and try again")
+		return nil, api.GetServiceTokenDetailsResponse{}, fmt.Errorf("invalid service token entered. Please double check your service token and try again")
 	}
 
 	serviceToken := fmt.Sprintf("%v.%v.%v", serviceTokenParts[0], serviceTokenParts[1], serviceTokenParts[2])
@@ -32,7 +32,7 @@ func GetPlainTextSecretsViaServiceToken(fullServiceToken string) ([]models.Singl
 
 	serviceTokenDetails, err := api.CallGetServiceTokenDetailsV2(httpClient)
 	if err != nil {
-		return nil, fmt.Errorf("unable to get service token details. [err=%v]", err)
+		return nil, api.GetServiceTokenDetailsResponse{}, fmt.Errorf("unable to get service token details. [err=%v]", err)
 	}
 
 	encryptedSecrets, err := api.CallGetSecretsV2(httpClient, api.GetEncryptedSecretsV2Request{
@@ -41,25 +41,25 @@ func GetPlainTextSecretsViaServiceToken(fullServiceToken string) ([]models.Singl
 	})
 
 	if err != nil {
-		return nil, err
+		return nil, api.GetServiceTokenDetailsResponse{}, err
 	}
 
 	decodedSymmetricEncryptionDetails, err := GetBase64DecodedSymmetricEncryptionDetails(serviceTokenParts[3], serviceTokenDetails.EncryptedKey, serviceTokenDetails.Iv, serviceTokenDetails.Tag)
 	if err != nil {
-		return nil, fmt.Errorf("unable to decode symmetric encryption details [err=%v]", err)
+		return nil, api.GetServiceTokenDetailsResponse{}, fmt.Errorf("unable to decode symmetric encryption details [err=%v]", err)
 	}
 
 	plainTextWorkspaceKey, err := crypto.DecryptSymmetric([]byte(serviceTokenParts[3]), decodedSymmetricEncryptionDetails.Cipher, decodedSymmetricEncryptionDetails.Tag, decodedSymmetricEncryptionDetails.IV)
 	if err != nil {
-		return nil, fmt.Errorf("unable to decrypt the required workspace key")
+		return nil, api.GetServiceTokenDetailsResponse{}, fmt.Errorf("unable to decrypt the required workspace key")
 	}
 
 	plainTextSecrets, err := GetPlainTextSecrets(plainTextWorkspaceKey, encryptedSecrets)
 	if err != nil {
-		return nil, fmt.Errorf("unable to decrypt your secrets [err=%v]", err)
+		return nil, api.GetServiceTokenDetailsResponse{}, fmt.Errorf("unable to decrypt your secrets [err=%v]", err)
 	}
 
-	return plainTextSecrets, nil
+	return plainTextSecrets, serviceTokenDetails, nil
 }
 
 func GetPlainTextSecretsViaJTW(JTWToken string, receiversPrivateKey string, workspaceId string, environmentName string, tagSlugs string) ([]models.SingleEnvironmentVariable, error) {
@@ -131,6 +131,7 @@ func GetAllEnvironmentVariables(params models.GetAllSecretsParameters) ([]models
 
 	isConnected := CheckIsConnectedToInternet()
 	var secretsToReturn []models.SingleEnvironmentVariable
+	var serviceTokenDetails api.GetServiceTokenDetailsResponse
 	var errorToReturn error
 
 	if infisicalToken == "" {
@@ -182,7 +183,11 @@ func GetAllEnvironmentVariables(params models.GetAllSecretsParameters) ([]models
 
 	} else {
 		log.Debug("Trying to fetch secrets using service token")
-		secretsToReturn, errorToReturn = GetPlainTextSecretsViaServiceToken(infisicalToken)
+		secretsToReturn, serviceTokenDetails, errorToReturn = GetPlainTextSecretsViaServiceToken(infisicalToken)
+
+		if serviceTokenDetails.Environment != params.Environment {
+			PrintErrorMessageAndExit(fmt.Sprintf("Fetch secrets failed: token allows [%s] environment access, not [%s]. Service tokens are environment-specific; no need for --env flag.", params.Environment, serviceTokenDetails.Environment))
+		}
 	}
 
 	return secretsToReturn, errorToReturn

docs/cli/commands/login.mdx

@@ -9,4 +9,7 @@ infisical login
 
 ## Description
 The CLI uses authentication to verify your identity. When you enter the correct email and password for your account, a token is generated and saved in your system Keyring to allow you to make future interactions with the CLI. 
-If you want to change where the login credentials are stored, visit the [vaults command](./vault)
+
+To change where the login credentials are stored, visit the [vaults command](./vault).
+
+If you have added multiple users, you can switch between the users by using the [user command](./user).

docs/cli/commands/user.mdx

@@ -0,0 +1,29 @@
+---
+title: "infisical user"
+description: "Manage logged in users"
+---
+
+```bash
+infisical user
+```
+
+## Description
+This command allows you to manage the current logged in users on the CLI
+
+### Sub-commands 
+<Accordion title="infisical user switch" defaultOpen="true">
+  Use this command to switch between profiles that are currently logged into the CLI 
+
+  ```bash
+  infisical user switch
+  ```
+</Accordion>
+
+<Accordion title="infisical user update domain">
+  With this command, you can modify the backend API that is utilized for all requests associated with a specific profile. 
+  For instance, you have the option to point the profile to use either the Infisical Cloud or your own self-hosted Infisical instance.
+
+  ```bash 
+  infisical user update domain
+  ```
+</Accordion>

docs/cli/overview.mdx

@@ -109,7 +109,10 @@ infisical login
 <Accordion title="Optional: point CLI to self-hosted">
 The CLI is set to connect to Infisical Cloud by default, but if you're running your own instance of Infisical, you can direct the CLI to it using one of the methods provided below.
 
-#### Method 1: Export environment variable 
+#### Method 1: Use the updated CLI
+Beginning with CLI version V0.4.0, it is now possible to choose between logging in through the Infisical cloud or your own self-hosted instance. Simply execute the `infisical login` command and follow the on-screen instructions.
+
+#### Method 2: Export environment variable 
 You can point the CLI to the self hosted Infisical instance by exporting the environment variable `INFISICAL_API_URL` in your terminal.
 
 <Tabs>
@@ -135,7 +138,7 @@ You can point the CLI to the self hosted Infisical instance by exporting the env
   </Tab>
 </Tabs>
 
-#### Method 2: Set manually on every command
+#### Method 3: Set manually on every command
 Another option to point the CLI to your self hosted Infisical instance is to set it via a flag on every command you run.
 
 ```bash 

docs/mint.json

@@ -118,6 +118,7 @@
             "cli/commands/secrets",
             "cli/commands/export",
             "cli/commands/vault",
+            "cli/commands/user",
             "cli/commands/reset"
           ]
         },