fix: add apigee support back in.

Author: sarahcpage

README.md

@@ -10,8 +10,7 @@ software order.
 You can use this CLI both as a tool and as an example of how to use Golang to
 call the
 [SAS Viya Orders API](https://developer.sas.com/rest-apis/mysas).
-You can also import the _assetreqs_ and _authn_ packages and use them in your own
-Golang project.
+You can also import the _assetreqs_ package and use it in your own Golang project.
 
 ```
 Usage:
@@ -48,6 +47,8 @@ Use "viya4-orders-cli [command] --help" for more information about a command.
 - API credentials for the
   [SAS Viya Orders API](https://developer.sas.com/rest-apis/mysas)
   are required. You can obtain them [here](https://developer.sas.com/rest-apis/mysas/applications).
+  > [!IMPORTANT]
+  > Above is a new developer portal that generates keys used with the new APIM proxy for Viya Orders API. If you have keys generated in the [SAS Apigee Developer Portal] (https://api.apiportal.sas.com), they will work until April 20, 2026.
 - [Go](https://golang.org/) 1.25.6 (or later) or [Docker](https://www.docker.com/) is required if you intend to build your own image.
 - [git](https://git-scm.com/) version 2 or later is required if you intend to clone the repository.
 
@@ -118,9 +119,11 @@ Take the following steps to start using SAS Viya Orders CLI:
    [SAS Viya Orders API](https://developer.sas.com/rest-apis/mysas), obtain them [here](https://developer.sas.com/rest-apis/mysas/applications) - instructions can be found on the _Authentication_ tab in the same UI [here](https://developer.sas.com/rest-apis/mysas/docs/getting-started/authentication#obtain-client-credentials).
 
 1. Save off the `Client ID` and the `Client Secret` values, which will serve as your API credentials.
-   > **NOTE:** You only need one of the `Client Secret` values - either will work.
+   > [!NOTE] 
+   > You only need one of the `Client Secret` values - either will work.
 1. Base64 encode each value.
-   > **NOTE:** When base64 encoding the credentials, take care not to encode
+   > [!NOTE] 
+   > When base64 encoding the credentials, take care not to encode
    > end-of-line characters into the result. <br/> Here is an example of the
    > correct way to encode from a Linux command prompt:<br/>
    > `echo -n {secret} | base64`<br/><br/> Here is an example of the
@@ -129,10 +132,13 @@ Take the following steps to start using SAS Viya Orders CLI:
 1. Add both credentials to your configuration file, or define them as
    environment variables:
 
-   - Assign the encoded value of `Client ID` to `clientCredentialsId` (if using environment variables, use
-    `CLIENTCREDENTIALSID`).
-   - Assign the encoded value of `Client Secret` to `clientCredentialsSecret` (if using environment variables, use
-    `CLIENTCREDENTIALSSECRET`).
+   - Assign the encoded value of `Client ID` to `apimClientCredentialsId` (if using environment variables, use
+    `APIMCLIENTCREDENTIALSID`).
+   - Assign the encoded value of `Client Secret` to `apimClientCredentialsSecret` (if using environment variables, use
+    `APIMCLIENTCREDENTIALSSECRET`).
+  > [!IMPORTANT]
+  > If you are using keys generated in the [SAS Apigee Developer Portal] (https://api.apiportal.sas.com), the property names to convey those in are `clientCredentialsId` / `CLIENTCREDENTIALSID` and `clientCredentialsSecret` / `CLIENTCREDENTIALSSECRET`. These keys will cease to work on April 20, 2026.
+
 
 1. Select CLI options. You can then specify them on the command line, pass them
    in as environment variables, or include them in a configuration file.
@@ -162,8 +168,8 @@ Take the following steps to start using SAS Viya Orders CLI:
 Here is a sample YAML configuration file that contains client credentials:
 
 ```
-clientCredentialsId: 1a2B3c4D5e6F7h8I9j10K=
-clientCredentialsSecret: 4D5e6F7g8H9i==
+apimClientCredentialsId: 1a2B3c4D5e6F7h8I9j10K=
+apimClientCredentialsSecret: 4D5e6F7g8H9i==
 ```
 
 ### Running
@@ -213,7 +219,7 @@ using SAS Viya Orders CLI:
   2020/10/02 19:16:30 Using config file: /sasstuff/.viya4-orders-cli.yaml
   OrderNumber: 923456
   AssetName: deploymentAssets
-  AssetReqURL: https://api.sas.com/mysas/orders/923456/cadenceNames/lts/deploymentAssets
+  AssetReqURL: https://api.apiproxy.sas.com/mysas/orders/923456/cadenceNames/lts/deploymentAssets
   AssetLocation: /sasstuff/sasfiles/923456_lts_depassets.tgz
   Cadence: Long Term Support 2020.0
   CadenceRelease: 20200808.1596943588306
@@ -232,7 +238,7 @@ using SAS Viya Orders CLI:
   ```text
   OrderNumber: 923456
   AssetName: license
-  AssetReqURL: https://api.sas.com/mysas/orders/923456/cadenceNames/lts/cadenceVersions/2020.0/license
+  AssetReqURL: https://api.apiproxy.sas.com/mysas/orders/923456/cadenceNames/lts/cadenceVersions/2020.0/license
   AssetLocation: /auser/vocli/sasfiles/923456_lts_2020.0_license_ren1.jwt
   Cadence: Long Term Support 2020.0
   CadenceRelease:
@@ -252,7 +258,7 @@ using SAS Viya Orders CLI:
   {
       "orderNumber": "923457",
       "assetName": "certificates",
-      "assetReqURL": "https://api.sas.com/mysas/orders/923457/certificates",
+      "assetReqURL": "https://api.apiproxy.sas.com/mysas/orders/923457/certificates",
       "assetLocation": "C:\Users\auser\vocli\sasfiles\923457_certs.zip",
       "cadence": "",
       "cadenceRelease": ""
@@ -270,7 +276,7 @@ using SAS Viya Orders CLI:
   ```text
   OrderNumber: 923457
   AssetName: deploymentAssets
-  AssetReqURL: https://api.sas.com/mysas/orders/923457/cadenceNames/stable/cadenceVersions/2026.01/cadenceReleases/20260127.1769510312235/deploymentAssets
+  AssetReqURL: https://api.apiproxy.sas.com/mysas/orders/923457/cadenceNames/stable/cadenceVersions/2026.01/cadenceReleases/20260127.1769510312235/deploymentAssets
   AssetLocation: /path/to/cwd/SASViyaV4_923457_0_stable_2026.01_20260127.1769510312235_deploymentAssets_1769555752230.tgz
   Cadence: Stable 2026.01
   CadenceRelease: 20260127.1769510312235

cmd/assethistory.go

@@ -20,7 +20,7 @@ var assetHistoryCmd = &cobra.Command{
 	Aliases: []string{"ah"},
 	Args:    cobra.RangeArgs(1, 1),
 	Run: func(cmd *cobra.Command, args []string) {
-		ar := assetreqs.New(clientID, clientSecret, "assetHistory", args[0], "", "", "", assetFilePath, assetFileName, outFormat, allowUnsuppd)
+		ar := assetreqs.New(clientCredsType, token, clientID, clientSecret, "assetHistory", args[0], "", "", "", assetFilePath, assetFileName, outFormat, allowUnsuppd)
 		err := ar.GetAsset()
 		if err != nil {
 			log.Fatalln(err)

cmd/certificates.go

@@ -20,7 +20,7 @@ var certificatesCmd = &cobra.Command{
 	Args:    cobra.ExactArgs(1),
 	Run: func(cmd *cobra.Command, args []string) {
 		// Cadence is not a factor in certs, so we hard-code allowUnsuppd to false for the last argument.
-		ar := assetreqs.New(clientID, clientSecret, "certificates", args[0], "", "", "",
+		ar := assetreqs.New(clientCredsType, token, clientID, clientSecret, "certificates", args[0], "", "", "",
 			assetFilePath, assetFileName, outFormat, false)
 		err := ar.GetAsset()
 		if err != nil {

cmd/deploymentassets.go

@@ -29,7 +29,7 @@ var deploymentAssetsCmd = &cobra.Command{
 			cver = args[2]
 			crel = args[3]
 		}
-		ar := assetreqs.New(clientID, clientSecret, "deploymentAssets", args[0], args[1], cver, crel, assetFilePath, assetFileName, outFormat, allowUnsuppd)
+		ar := assetreqs.New(clientCredsType, token, clientID, clientSecret, "deploymentAssets", args[0], args[1], cver, crel, assetFilePath, assetFileName, outFormat, allowUnsuppd)
 		err := ar.GetAsset()
 		if err != nil {
 			log.Fatalln(err)

cmd/license.go

@@ -19,7 +19,7 @@ var licenseCmd = &cobra.Command{
 	Aliases: []string{"lic"},
 	Args:    cobra.ExactArgs(3),
 	Run: func(cmd *cobra.Command, args []string) {
-		ar := assetreqs.New(clientID, clientSecret, "license", args[0], args[1], args[2], "", assetFilePath, assetFileName, outFormat, allowUnsuppd)
+		ar := assetreqs.New(clientCredsType, token, clientID, clientSecret, "license", args[0], args[1], args[2], "", assetFilePath, assetFileName, outFormat, allowUnsuppd)
 		err := ar.GetAsset()
 		if err != nil {
 			log.Fatalln(err)

cmd/root.go

@@ -12,18 +12,21 @@ import (
 	"unicode"
 
 	homedir "github.com/mitchellh/go-homedir"
+	"github.com/sassoftware/viya4-orders-cli/lib/authn"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 )
 
 var (
-	assetFileName string
-	assetFilePath string
-	cfgFile       string
-	outFormat     string
-	clientID      string
-	clientSecret  string
-	allowUnsuppd  bool
+	assetFileName   string
+	assetFilePath   string
+	cfgFile         string
+	outFormat       string
+	clientID        string
+	clientSecret    string
+	clientCredsType string // apigee or apim
+	token           string // only applies to Apigee creds
+	allowUnsuppd    bool
 )
 
 // Version is set by the build.
@@ -157,15 +160,45 @@ func usageError(message string) {
 }
 
 func setCreds() {
-	cID, err := base64.StdEncoding.DecodeString(viper.GetString("clientCredentialsId"))
+	apimCIDProp := "apimClientCredentialsId"
+	apimCSecProp := "apimClientCredentialsSecret"
+	// Prefer APIM creds over Apigee.
+	if viper.IsSet(apimCIDProp) && viper.GetString(apimCIDProp) != "" && viper.IsSet(apimCSecProp) && viper.GetString(apimCSecProp) != "" {
+		clientCredsType = "apim"
+	} else {
+		clientCredsType = "apigee"
+	}
+
+	var cIDProp, cSecProp string
+	if strings.EqualFold(clientCredsType, "apim") {
+		cIDProp = apimCIDProp
+		cSecProp = apimCSecProp
+	} else {
+		cIDProp = "clientCredentialsId"
+		cSecProp = "clientCredentialsSecret"
+	}
+
+	cID, err := base64.StdEncoding.DecodeString(viper.GetString(cIDProp))
 	if err != nil {
-		log.Fatalln("ERROR: attempt to decode clientCredentialsId failed: " + err.Error())
+		log.Fatalln("ERROR: attempt to decode " + cIDProp + " failed: " + err.Error())
 	}
-	cSecret, err := base64.StdEncoding.DecodeString(viper.GetString("clientCredentialsSecret"))
+	cSecret, err := base64.StdEncoding.DecodeString(viper.GetString(cSecProp))
 	if err != nil {
-		log.Fatalln("ERROR: attempt to decode clientCredentialsSecret failed: " + err.Error())
+		log.Fatalln("ERROR: attempt to decode " + cSecProp + " failed: " + err.Error())
 	}
 
 	clientID = strings.TrimRightFunc(string(cID), unicode.IsControl)
 	clientSecret = strings.TrimRightFunc(string(cSecret), unicode.IsControl)
+
+	if clientCredsType == "apigee" {
+		apigeeAuth()
+	}
+}
+
+func apigeeAuth() {
+	var err error
+	token, err = authn.GetBearerToken(clientID, clientSecret)
+	if err != nil {
+		log.Fatalln(err.Error())
+	}
 }

go.mod

@@ -6,6 +6,7 @@ require (
 	github.com/mitchellh/go-homedir v1.1.0
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/viper v1.21.0
+	golang.org/x/oauth2 v0.36.0
 )
 
 require (

go.sum

@@ -43,6 +43,8 @@ github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8
 github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
+golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
 golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=

lib/assetreqs/assetreqs.go

@@ -25,41 +25,46 @@ import (
 const checksumsFile string = "sas-bases/checksums.txt"
 
 const (
-	viyaOrdersAPIHost       string = "https://api.apiproxy.sas.com"
+	viyaOrdersAPIHost       string = "https://api.sas.com"
+	viyaOrdersAPIAPIMHost   string = "https://api.apiproxy.sas.com"
 	viyaOrdersAPIBasePath   string = "/mysas"
 	viyaOrdersAPIOrdersPath string = "/orders"
 )
 
 // AssetReq provides fields that define the parameters of an order asset request.
 type AssetReq struct {
-	clientID     string
-	clientSecret string
-	aName        string
-	oNum         string
-	cName        string
-	cVer         string
-	cRel         string
-	fPath        string
-	fName        string
-	oFmt         string
-	allowUnsuppd bool
+	clientCredsType string
+	token           string
+	clientID        string
+	clientSecret    string
+	aName           string
+	oNum            string
+	cName           string
+	cVer            string
+	cRel            string
+	fPath           string
+	fName           string
+	oFmt            string
+	allowUnsuppd    bool
 }
 
 // New initializes an AssetReq struct.
-func New(cID, cSec, assetName, orderNum, cadenceName, cadenceVer, cadenceRel, filePath,
+func New(credsType, token, cID, cSec, assetName, orderNum, cadenceName, cadenceVer, cadenceRel, filePath,
 	fileName, outputFormat string, allowUnsuppd bool) (ar AssetReq) {
 	return AssetReq{
-		clientID:     cID,
-		clientSecret: cSec,
-		aName:        assetName,
-		oNum:         orderNum,
-		cName:        cadenceName,
-		cVer:         cadenceVer,
-		cRel:         cadenceRel,
-		fPath:        filePath,
-		fName:        fileName,
-		oFmt:         outputFormat,
-		allowUnsuppd: allowUnsuppd,
+		clientCredsType: credsType,
+		token:           token,
+		clientID:        cID,
+		clientSecret:    cSec,
+		aName:           assetName,
+		oNum:            orderNum,
+		cName:           cadenceName,
+		cVer:            cadenceVer,
+		cRel:            cadenceRel,
+		fPath:           filePath,
+		fName:           fileName,
+		oFmt:            outputFormat,
+		allowUnsuppd:    allowUnsuppd,
 	}
 }
 
@@ -177,9 +182,15 @@ func (ar AssetReq) buildReq() (req *http.Request, err error) {
 		return req, errors.New("ERROR: setup of asset request failed: " + err.Error())
 	}
 
-	// Use direct assignment to preserve exact header casing (bypasses canonicalization)
-	req.Header["ClientId"] = []string{ar.clientID}
-	req.Header["ClientSecret"] = []string{ar.clientSecret}
+	// Set the appropriate authentication headers depending on the type of client credentials being used.
+	if ar.clientCredsType == "apim" {
+		// Use direct assignment to preserve exact header casing (bypasses canonicalization)
+		req.Header["ClientId"] = []string{ar.clientID}
+		req.Header["ClientSecret"] = []string{ar.clientSecret}
+	} else {
+		bearer := "Bearer " + ar.token
+		req.Header.Set("Authorization", bearer)
+	}
 
 	// If the allowUnsupported option was used, pass along allowUnsupported=true as a query param on the API call.
 	if ar.allowUnsuppd {
@@ -194,7 +205,13 @@ func (ar AssetReq) buildReq() (req *http.Request, err error) {
 
 // buildURL builds the request URL.
 func (ar AssetReq) buildURL() (urlStr string, err error) {
-	u, err := url.ParseRequestURI(viyaOrdersAPIHost)
+	var host string
+	if ar.clientCredsType == "apim" {
+		host = viyaOrdersAPIAPIMHost
+	} else {
+		host = viyaOrdersAPIHost
+	}
+	u, err := url.ParseRequestURI(host)
 	if err != nil {
 		return urlStr, errors.New("ERROR: attempt to parse asset request URI failed: " + err.Error())
 	}

lib/authn/authn.go

@@ -0,0 +1,64 @@
+// Copyright © 2020-2023, SAS Institute Inc., Cary, NC, USA.  All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+// Package authn provides a func that will exchange OAuth client credentials for a Bearer token that will expire after
+// 30 minutes.
+package authn
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/url"
+	"strings"
+
+	"golang.org/x/oauth2"
+	"golang.org/x/oauth2/clientcredentials"
+)
+
+const (
+	viyaOrdersAPIHost      string = "https://api.sas.com"
+	viyaOrdersAPIBasePath  string = "/mysas"
+	viyaOrdersAPITokenPath string = "/token"
+)
+
+// GetBearerToken calls the /token SAS Viya Orders API endpoint to exchange client credentials for a Bearer token.
+// The client credentials are obtained from the SAS API Portal (https://apiportal.sas.com), and should be defined in
+// Viper (https://github.com/spf13/viper) as clientCredentialsId (key) and clientCredentialsSecret (secret).
+func GetBearerToken(cID, cSec string) (token string, err error) {
+	// id, err := base64.StdEncoding.DecodeString(viper.GetString("clientCredentialsId"))
+	// if err != nil {
+	// 	return token, errors.New("ERROR: attempt to decode clientCredentialsId failed: " + err.Error())
+	// }
+	// sec, err := base64.StdEncoding.DecodeString(viper.GetString("clientCredentialsSecret"))
+	// if err != nil {
+	// 	return token, errors.New("ERROR: attempt to decode clientCredentialsSecret failed: " + err.Error())
+	// }
+
+	// Build the request URL.
+	u, err := url.ParseRequestURI(viyaOrdersAPIHost)
+	if err != nil {
+		return token, errors.New("ERROR: attempt to parse Bearer token request URI failed: " + err.Error())
+	}
+
+	var b strings.Builder
+	fmt.Fprintf(&b, "%s", viyaOrdersAPIBasePath)
+	fmt.Fprintf(&b, "%s", viyaOrdersAPITokenPath)
+	u.Path = b.String()
+	urlStr := u.String()
+
+	oauthCfg := &clientcredentials.Config{
+		ClientID:     cID,
+		ClientSecret: cSec,
+		TokenURL:     urlStr,
+		AuthStyle:    oauth2.AuthStyleAutoDetect,
+	}
+
+	oaToken, err := oauthCfg.Token(context.Background())
+	if err != nil {
+		return token, errors.New("ERROR: Bearer token request failed: " + err.Error())
+	}
+	token = oaToken.AccessToken
+
+	return token, nil
+}