fix(machine-identity): fall back to .infisical.json for project ID

[akramcodez]

Description 📣

Fixes #365

When authenticating with machine identity (via INFISICAL_UNIVERSAL_AUTH_ACCESS_TOKEN or a universal-auth access token) without passing --projectId, the CLI was unconditionally exiting with:

Project ID is required when using machine identity

This was wrong. The human-login path already falls back to .infisical.json when --projectId is missing - the machine identity path was the only one that didn't, forcing every machine-identity user to always pass --projectId even after running infisical init.

Changes:

• Added ResolveWorkspaceIdForMachineIdentity(projectConfigFilePath, explicitWorkspaceId string) helper in config.go - returns the explicit value if set, otherwise reads workspaceId from .infisical.json (walking up from cwd), and errors if neither resolves
• Applied the fallback in the UniversalAuthAccessToken branch of GetAllEnvironmentVariables (secrets.go)
• Applied the same fallback in GetAllFolders (folders.go)
• Added ProjectConfigFilePath field to GetAllFoldersParameters for parity with the secrets path

Type ✨

• Bug fix

Tests 🛠️

Unit tests - packages/util/config_test.go (TestResolveWorkspaceIdForMachineIdentity, 8 subtests):

• explicit --projectId wins over file
• falls back to .infisical.json in cwd
• walks up to parent directories to find .infisical.json
• uses explicit projectConfigFilePath when provided
• explicit path takes precedence over cwd file
• errors when no file and no explicit value
• errors when explicit path file is missing
• errors when workspaceId field is empty in file

Integration tests - packages/util/machine_identity_test.go (3 tests using httptest.NewServer to assert what the API actually receives on the wire):

• TestGetAllEnvironmentVariables_MachineIdentityFallsBackToConfig - no --projectId, workspace id is read from .infisical.json and forwarded to API
• TestGetAllEnvironmentVariables_MachineIdentityFlagWins - explicit --projectId overrides the file
• TestGetAllFolders_MachineIdentityFallsBackToConfig - same fallback verified for the folders endpoint

go test ./packages/util/ -run "TestResolveWorkspaceIdForMachineIdentity|TestGetAllEnvironmentVariables_MachineIdentity|TestGetAllFolders_MachineIdentity" -v
# ok  github.com/Infisical/infisical-merge/packages/util  0.033s

Also verified:

go build ./...   # clean
go vet ./packages/util/   # clean

---

• I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

[infisical-cla-app]

📝 Contributor License Agreement required

Before this PR can merge, every contributor must sign the Infisical CLA.
Signing is quick: sign in with GitHub, review the CLA, and accept.

👉 Sign the CLA

Still needs to sign:

• @akramcodez

Once everyone has signed, the check updates automatically — no need to close and reopen the PR.

[greptile-apps]

Greptile Summary

The PR lets universal-auth machine identities resolve a missing project ID from the nearest .infisical.json, while preserving an explicitly supplied project ID.

• Adds a shared machine-identity workspace resolver supporting explicit config directories and ancestor discovery.
• Applies fallback resolution to secret and folder retrieval.
• Extends folder request parameters and adds unit and HTTP-level integration coverage.

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness or security issues identified.

The new resolver preserves explicit project IDs, uses established .infisical.json lookup semantics when they are absent, and is reached by the intended universal-auth branches with integration coverage confirming the resulting API parameters.

Important Files Changed

Filename	Overview
packages/util/config.go	Adds explicit-ID-first workspace resolution with existing directory-based and ancestor-search config readers; no actionable defect found.
packages/util/secrets.go	Uses the shared fallback before universal-auth secret retrieval while leaving service-token and interactive-login behavior unchanged.
packages/util/folders.go	Adds equivalent workspace fallback for universal-auth folder retrieval; the current command path correctly uses cwd/ancestor discovery.
packages/models/cli.go	Adds an optional project-config directory field to folder retrieval parameters without changing serialized contracts.
packages/util/config_test.go	Covers explicit precedence, local and parent discovery, custom directories, and missing or empty configuration.
packages/util/machine_identity_test.go	Verifies the resolved project identifier sent by secret and folder requests and confirms explicit IDs take precedence.

_{Reviews (1): Last reviewed commit: "fix(machine-identity): fall back to .inf..." | Re-trigger Greptile}

[akramcodez]

[akramcodez]

PTAL @saifsmailbox98 thanks :)