src/server/auth/cmds/cmds.go
func ActivateCmd(noMetrics, noPortForwarding *bool) *cobra.Command {
	var initialAdmin string
	activate := &cobra.Command{
		Short: "Activate Pachyderm's auth system",
		Long: `
Activate Pachyderm's auth system, and restrict access to existing data to the
user running the command (or the argument to --initial-admin), who will be the
first cluster admin`[1:],
		Run: cmdutil.Run(func(args []string) error {
			var token string
			var err error
			if !strings.HasPrefix(initialAdmin, auth.RobotPrefix) {
				token, err = githubLogin()
				if err != nil {
					return err
				}
			}
			fmt.Println("Retrieving Pachyderm token...")

			// Exchange GitHub token for Pachyderm token
			c, err := client.NewOnUserMachine(!*noMetrics, !*noPortForwarding, "user")
			if err != nil {
				return fmt.Errorf("could not connect: %v", err)
			}
			defer c.Close()
			resp, err := c.Activate(c.Ctx(),
				&auth.ActivateRequest{
					GitHubToken: token,
					Subject:     initialAdmin,
				})
			if err != nil {
				return fmt.Errorf("error activating Pachyderm auth: %v",
					grpcutil.ScrubGRPC(err))
			}
			if err := writePachTokenToCfg(resp.PachToken); err != nil {
				return err
			}
			if strings.HasPrefix(initialAdmin, auth.RobotPrefix) {
				fmt.Println("WARNING: DO NOT LOSE THE ROBOT TOKEN BELOW WITHOUT " +
					"ADDING OTHER ADMINS.\nIF YOU DO, YOU WILL BE PERMANENTLY LOCKED OUT " +
					"OF YOUR CLUSTER!")
				fmt.Printf("Pachyderm token for \"%s\":\n%s\n", initialAdmin, resp.PachToken)
			}
			return nil
		}),
	}
	activate.PersistentFlags().StringVar(&initialAdmin, "initial-admin", "", `
The subject (robot user or github user) who
will be the first cluster admin; the user running 'activate' will identify as
this user once auth is active.  If you set 'initial-admin' to a robot
user, pachctl will print that robot user's Pachyderm token; this token is
effectively a root token, and if it's lost you will be locked out of your
cluster`[1:])
	return cmdutil.CreateAlias(activate, "auth activate")
}
func ActivateCmd(noMetrics, noPortForwarding *bool) *cobra.Command {
	var initialAdmin string
	activate := &cobra.Command{
		Short: "Activate Pachyderm's auth system",
		Long: `
Activate Pachyderm's auth system, and restrict access to existing data to the
user running the command (or the argument to --initial-admin), who will be the
first cluster admin`[1:],
		Run: cmdutil.Run(func(args []string) error {
			var token string
			var err error
			if !strings.HasPrefix(initialAdmin, auth.RobotPrefix) {
				token, err = githubLogin()
				if err != nil {
					return err
				}
			}
			fmt.Println("Retrieving Pachyderm token...")

			// Exchange GitHub token for Pachyderm token
			c, err := client.NewOnUserMachine(!*noMetrics, !*noPortForwarding, "user")
			if err != nil {
				return fmt.Errorf("could not connect: %v", err)
			}
			defer c.Close()
			resp, err := c.Activate(c.Ctx(),
				&auth.ActivateRequest{
					GitHubToken: token,
					Subject:     initialAdmin,
				})
			if err != nil {
				return fmt.Errorf("error activating Pachyderm auth: %v",
					grpcutil.ScrubGRPC(err))
			}
			if err := writePachTokenToCfg(resp.PachToken); err != nil {
				return err
			}
			if strings.HasPrefix(initialAdmin, auth.RobotPrefix) {
				fmt.Println("WARNING: DO NOT LOSE THE ROBOT TOKEN BELOW WITHOUT " +
					"ADDING OTHER ADMINS.\nIF YOU DO, YOU WILL BE PERMANENTLY LOCKED OUT " +
					"OF YOUR CLUSTER!")
				fmt.Printf("Pachyderm token for \"%s\":\n%s\n", initialAdmin, resp.PachToken)
			}
			return nil
		}),
	}
	activate.PersistentFlags().StringVar(&initialAdmin, "initial-admin", "", `
The subject (robot user or github user) who
will be the first cluster admin; the user running 'activate' will identify as
this user once auth is active.  If you set 'initial-admin' to a robot
user, pachctl will print that robot user's Pachyderm token; this token is
effectively a root token, and if it's lost you will be locked out of your
cluster`[1:])
	return cmdutil.CreateAlias(activate, "auth activate")
}
// ActivateCmd returns a cobra.Command to activate Pachyderm's auth system