fix(auth): preserve the session domain during automatic re-login

[BenyD]

Description 📣

EstablishUserLoginSession() re-execs the CLI as login --silent, forwarding only --silent. The child then resolves its domain from scratch, and because usePresetDomain() deliberately ignores default cloud URLs unless --domain was set on that specific invocation, an expired EU Cloud session falls through to the region prompt, opens https://app.infisical.com/login, and on completion rewrites LoggedInUserDomain to US. Every subsequent command then targets the wrong region.

This forwards the domain the parent has already resolved.

Why this is the only change needed. Because the child now sees an explicit --domain, cmd.Flags().Changed("domain") is true, so usePresetDomain() accepts the value even for EU/US cloud URLs. The exclusion at login.go:465 is never reached, which means no change to usePresetDomain() itself. That function is shared with the normal infisical login path, so leaving its semantics alone seemed preferable to widening them. This also fixes every caller of EstablishUserLoginSession() at once rather than per command.

Precedence. The stored LoggedInUserDomain wins, since it is the instance whose session just expired. Otherwise config.INFISICAL_URL is used, as already resolved by the root command from --domain, INFISICAL_DOMAIN, or .infisical.json.

One deliberate exception: the bare US default is not forwarded. config.INFISICAL_URL defaults to the US URL rather than empty, so forwarding it unconditionally would set an explicit --domain on every re-login and silently skip the region prompt for users who have never configured one. Returning "" in that case preserves today's behaviour exactly.

Scoped to one of the three fixes suggested in #312. Suggestion 2 is subsumed by the above. Suggestion 3, guarding askForDomain()/browserCliLogin() behind a TTY check, is a UX change for semi-interactive contexts and felt like a maintainer's call rather than something to fold into a bug fix. Happy to add it or open it separately if you want it.

Fixes #312

Type ✨

• Bug fix
• New feature
• Improvement
• Breaking change
• Documentation

Tests 🛠️

Split the decision into two pure functions, resolveReLoginDomain and buildReLoginArgs, so the logic is testable without spawning a process. This mirrors the existing GetUpdateInstructions() / getUpdateInstructions(goos, execPath) split in check-for-update.go.

New packages/util/auth_test.go covers stored EU domain, stored self-hosted domain, explicit non-default override with nothing stored, the bare US default, nothing known at all, and stored US Cloud.

go test ./packages/util/ -run 'TestResolveReLoginDomain|TestBuildReLoginArgs' -v

--- PASS: TestResolveReLoginDomain (0.00s)
    --- PASS: .../stored_EU_domain_wins_over_US_default
    --- PASS: .../stored_self-hosted_domain_is_forwarded
    --- PASS: .../explicit_non-default_resolved_URL_is_forwarded_when_nothing_is_stored
    --- PASS: .../bare_US_default_is_not_forwarded
    --- PASS: .../nothing_known_at_all
    --- PASS: .../stored_US_domain_is_still_forwarded
--- PASS: TestBuildReLoginArgs (0.00s)

Verified the tests are meaningful by forcing resolveReLoginDomain to always return "", reproducing the pre-fix behaviour: the EU, self-hosted, and explicit-override cases all fail. Full packages/util suite passes with no regressions, and go build ./... is clean.

What I could not test: I do not have an EU Cloud account, so this was diagnosed by reading the code paths rather than reproducing end to end. The unit tests cover the decision logic; a reviewer with EU access confirming the real flow would be worthwhile.

---

• I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

[greptile-apps]

Greptile Summary

Preserves the active session domain during automatic re-login.

• Resolves the re-login domain from the stored session domain or the current non-default URL.
• Passes the resolved domain to the child login --silent process as an explicit argument.
• Adds unit coverage for cloud, self-hosted, default, and empty-domain cases.

Confidence Score: 5/5

The PR appears safe to merge with no actionable regressions identified.

The forwarded domain is passed as a discrete process argument, normalized correctly by the existing login flow, and preserves the intended stored-session behavior without introducing a newly reachable security boundary violation.

Important Files Changed

Filename	Overview
packages/util/auth.go	Adds domain-preserving automatic re-login logic; argument handling is shell-safe, existing login normalization accepts API-form URLs, and no new actionable SSRF path was identified.
packages/util/auth_test.go	Adds focused table-driven tests for domain precedence and re-login argument construction.

_{Reviews (1): Last reviewed commit: "fix(auth): preserve the session domain d..." | Re-trigger Greptile}