fix: extend offline secret caching to token-based auth and fix connection check

packages/util/common.go

@@ -41,8 +41,12 @@ func WriteToFile(fileName string, dataToWrite []byte, filePerm os.FileMode) erro
 }
 
 func ValidateInfisicalAPIConnection() (ok bool) {
-	_, err := http.Get(fmt.Sprintf("%v/status", config.INFISICAL_URL))
-	return err == nil
+	resp, err := http.Get(fmt.Sprintf("%v/status", config.INFISICAL_URL))
+	if err != nil {
+		return false
+	}
+	defer resp.Body.Close()
+	return resp.StatusCode >= 200 && resp.StatusCode < 300
 }
 
 func GetRestyClientWithCustomHeaders() (*resty.Client, error) {

packages/util/secrets.go

@@ -374,6 +374,33 @@ func GetAllEnvironmentVariables(params models.GetAllSecretsParameters, projectCo
 			errorToReturn = err
 			secretsToReturn = res.Secrets
 		}
+
+		// cache secrets on success, fallback to cached secrets on connection/server failure
+		if errorToReturn == nil && params.WorkspaceId != "" {
+			if backupEncryptionKey, err := GetBackupEncryptionKey(); err == nil {
+				WriteBackupSecrets(params.WorkspaceId, params.Environment, params.SecretsPath, backupEncryptionKey, secretsToReturn)
+			}
+		} else if errorToReturn != nil && params.WorkspaceId != "" {
+			// Only fall back to cache for connection errors or server errors (5xx).
+			// Do not mask client errors (4xx) like 401/403 which indicate auth issues.
+			shouldFallback := true
+			var apiErr *api.APIError
+			if errors.As(errorToReturn, &apiErr) && apiErr.StatusCode >= 400 && apiErr.StatusCode < 500 {
+				shouldFallback = false
+			}
+
+			if shouldFallback {
+				backupEncryptionKey, _ := GetBackupEncryptionKey()
+				if backupEncryptionKey != nil {
+					backedUpSecrets, err := ReadBackupSecrets(params.WorkspaceId, params.Environment, params.SecretsPath, backupEncryptionKey)
+					if len(backedUpSecrets) > 0 {
+						PrintWarning("Unable to fetch the latest secret(s) due to connection error, serving secrets from last successful fetch. For more info, run with --debug")
+						secretsToReturn = backedUpSecrets
+						errorToReturn = err
+					}
+				}
+			}
+		}
 	}
 
 	return secretsToReturn, errorToReturn