fix(project): resolve -e/--env for all Admin-API commands

Only the executor-based commands resolved the -e/--env flag. Every
Admin-API command (extension list/install/uninstall/activate/
deactivate/update/delete/outdated/upload, admin-api, clear-cache,
upgrade-check) built its client straight from the base config, so
-e staging silently targeted the default shop and an unknown
environment name was not rejected. A mutating command could act on
the wrong (possibly production) shop.

Add Config.WithEnvironment, which applies the selected environment's
URL and admin_api over the base config, and a readConfigWithEnvironment
helper that every Admin-API command now uses. Unknown environment
names fail with the same error the executor path already returns.

Author: moshimorschi

cmd/project/executor.go

@@ -7,6 +7,24 @@ import (
 	"github.com/shopware/shopware-cli/internal/shop"
 )
 
+// readConfigWithEnvironment loads the project config with the -e/--env
+// environment applied, so Admin API commands target the selected environment.
+// Without -e the config is returned as-is: Admin API commands historically
+// used the base url/admin_api, and an existing environments.local entry must
+// not silently retarget them.
+func readConfigWithEnvironment(cmd *cobra.Command, allowFallback bool) (*shop.Config, error) {
+	cfg, err := shop.ReadConfig(cmd.Context(), projectConfigPath, allowFallback)
+	if err != nil {
+		return nil, err
+	}
+
+	if environmentName == "" {
+		return cfg, nil
+	}
+
+	return cfg.WithEnvironment(environmentName)
+}
+
 // resolveExecutor returns the Executor for the current environment.
 func resolveExecutor(cmd *cobra.Command, projectRoot string) (executor.Executor, error) {
 	cfg, err := shop.ReadConfig(cmd.Context(), projectConfigPath, true)

cmd/project/project_admin_api.go

@@ -21,7 +21,7 @@ var projectAdminApiCmd = &cobra.Command{
 		var cfg *shop.Config
 		var err error
 
-		if cfg, err = shop.ReadConfig(cobraCmd.Context(), projectConfigPath, false); err != nil {
+		if cfg, err = readConfigWithEnvironment(cobraCmd, false); err != nil {
 			return err
 		}
 

cmd/project/project_clear_cache.go

@@ -18,7 +18,7 @@ var projectClearCacheCmd = &cobra.Command{
 		var cfg *shop.Config
 		var err error
 
-		if cfg, err = shop.ReadConfig(cmd.Context(), projectConfigPath, false); err != nil {
+		if cfg, err = readConfigWithEnvironment(cmd, false); err != nil {
 			return err
 		}
 

cmd/project/project_env_resolution_test.go

@@ -0,0 +1,145 @@
+package project
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// writeMinimalPlugin creates a minimal platform plugin the upload command can
+// load, so its RunE reaches the environment-resolution step.
+func writeMinimalPlugin(t *testing.T) string {
+	t.Helper()
+
+	dir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "composer.json"), []byte(`{
+		"name": "frosh/frosh-test",
+		"type": "shopware-platform-plugin",
+		"license": "MIT",
+		"version": "1.0.0",
+		"require": { "shopware/core": "~6.6.0" },
+		"autoload": { "psr-4": { "FroshTest\\": "src/" } },
+		"extra": {
+			"shopware-plugin-class": "FroshTest\\FroshTest",
+			"label": { "de-DE": "Test", "en-GB": "Test" }
+		}
+	}`), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, ".shopware-extension.yml"), []byte(
+		"build:\n  zip:\n    composer:\n      enabled: false\n    assets:\n      enabled: false\n",
+	), 0o644))
+	require.NoError(t, os.MkdirAll(filepath.Join(dir, "src"), 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "src", "FroshTest.php"),
+		[]byte("<?php\nnamespace FroshTest;\nuse Shopware\\Core\\Framework\\Plugin;\nclass FroshTest extends Plugin {}\n"), 0o644))
+
+	return dir
+}
+
+// TestReadConfigWithEnvironmentPropagatesConfigError ensures a config-read
+// failure is surfaced rather than swallowed by the environment resolution.
+func TestReadConfigWithEnvironmentPropagatesConfigError(t *testing.T) {
+	previousConfigPath := projectConfigPath
+	previousEnvironmentName := environmentName
+	t.Cleanup(func() {
+		projectConfigPath = previousConfigPath
+		environmentName = previousEnvironmentName
+	})
+
+	projectConfigPath = filepath.Join(t.TempDir(), "does-not-exist.yml")
+	environmentName = "staging"
+
+	cmd := &cobra.Command{}
+	cmd.SetContext(t.Context())
+
+	_, err := readConfigWithEnvironment(cmd, false)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "cannot find project configuration file")
+}
+
+// TestNoEnvFlagKeepsBaseConfig ensures that without -e the base url and
+// credentials are used even when an environments.local entry exists, so the
+// fix does not silently retarget existing setups.
+func TestNoEnvFlagKeepsBaseConfig(t *testing.T) {
+	configPath := filepath.Join(t.TempDir(), ".shopware-project.yml")
+	require.NoError(t, os.WriteFile(configPath, []byte(`
+url: http://127.0.0.1:9
+compatibility_date: "2026-01-01"
+admin_api:
+  client_id: base-id
+  client_secret: base-secret
+environments:
+  local:
+    url: http://127.0.0.1:7
+`), 0o644))
+
+	previousConfigPath := projectConfigPath
+	previousEnvironmentName := environmentName
+	projectConfigPath = configPath
+	environmentName = ""
+	t.Cleanup(func() {
+		projectConfigPath = previousConfigPath
+		environmentName = previousEnvironmentName
+	})
+
+	projectExtensionListCmd.SetContext(t.Context())
+
+	err := projectExtensionListCmd.RunE(projectExtensionListCmd, []string{})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "127.0.0.1:9", "without -e the base URL must be used")
+	assert.NotContains(t, err.Error(), "127.0.0.1:7", "environments.local must not silently retarget commands")
+}
+
+// TestAdminAPICommandsResolveEnvironment verifies every project command that
+// talks to a shop honors the -e/--env flag: an unknown environment is rejected,
+// and a known environment's URL is the one contacted.
+func TestAdminAPICommandsResolveEnvironment(t *testing.T) {
+	pluginDir := writeMinimalPlugin(t)
+
+	cases := []struct {
+		name string
+		cmd  *cobra.Command
+		args []string
+	}{
+		{"admin-api", projectAdminApiCmd, []string{"GET", "/_info/config"}},
+		{"clear-cache", projectClearCacheCmd, nil},
+		{"extension activate", projectExtensionActivateCmd, []string{"Foo"}},
+		{"extension deactivate", projectExtensionDeactivateCmd, []string{"Foo"}},
+		{"extension delete", projectExtensionDeleteCmd, []string{"Foo"}},
+		{"extension install", projectExtensionInstallCmd, []string{"Foo"}},
+		{"extension list", projectExtensionListCmd, nil},
+		{"extension outdated", projectExtensionOutdatedCmd, nil},
+		{"extension uninstall", projectExtensionUninstallCmd, []string{"Foo"}},
+		{"extension update", projectExtensionUpdateCmd, []string{"Foo"}},
+		{"extension upload", projectExtensionUploadCmd, []string{pluginDir}},
+		{"upgrade-check", projectUpgradeCheckCmd, nil},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name+"/rejects unknown environment", func(t *testing.T) {
+			setupEnvironmentConfig(t)
+			environmentName = "nonexistent"
+			tc.cmd.SetContext(t.Context())
+
+			err := tc.cmd.RunE(tc.cmd, tc.args)
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), `environment "nonexistent" not found`,
+				"command must reject an unknown environment instead of silently using the base config")
+		})
+
+		t.Run(tc.name+"/targets selected environment", func(t *testing.T) {
+			setupEnvironmentConfig(t)
+			environmentName = "staging"
+			tc.cmd.SetContext(t.Context())
+
+			err := tc.cmd.RunE(tc.cmd, tc.args)
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), "127.0.0.1:29",
+				"command must contact the staging environment URL")
+			assert.NotContains(t, err.Error(), "127.0.0.1:9/",
+				"command must not contact the base URL when -e staging is given")
+		})
+	}
+}

cmd/project/project_extension_activate.go

@@ -18,7 +18,7 @@ var projectExtensionActivateCmd = &cobra.Command{
 		var cfg *shop.Config
 		var err error
 
-		if cfg, err = shop.ReadConfig(cmd.Context(), projectConfigPath, false); err != nil {
+		if cfg, err = readConfigWithEnvironment(cmd, false); err != nil {
 			return err
 		}
 

cmd/project/project_extension_deactivate.go

@@ -18,7 +18,7 @@ var projectExtensionDeactivateCmd = &cobra.Command{
 		var cfg *shop.Config
 		var err error
 
-		if cfg, err = shop.ReadConfig(cmd.Context(), projectConfigPath, true); err != nil {
+		if cfg, err = readConfigWithEnvironment(cmd, true); err != nil {
 			return err
 		}
 

cmd/project/project_extension_delete.go

@@ -18,7 +18,7 @@ var projectExtensionDeleteCmd = &cobra.Command{
 		var cfg *shop.Config
 		var err error
 
-		if cfg, err = shop.ReadConfig(cmd.Context(), projectConfigPath, true); err != nil {
+		if cfg, err = readConfigWithEnvironment(cmd, true); err != nil {
 			return err
 		}
 

cmd/project/project_extension_install.go

@@ -18,7 +18,7 @@ var projectExtensionInstallCmd = &cobra.Command{
 		var cfg *shop.Config
 		var err error
 
-		if cfg, err = shop.ReadConfig(cmd.Context(), projectConfigPath, true); err != nil {
+		if cfg, err = readConfigWithEnvironment(cmd, true); err != nil {
 			return err
 		}
 

cmd/project/project_extension_list.go

@@ -22,7 +22,7 @@ var projectExtensionListCmd = &cobra.Command{
 
 		outputAsJson, _ := cmd.PersistentFlags().GetBool("json")
 
-		if cfg, err = shop.ReadConfig(cmd.Context(), projectConfigPath, true); err != nil {
+		if cfg, err = readConfigWithEnvironment(cmd, true); err != nil {
 			return err
 		}
 

cmd/project/project_extension_list_test.go

@@ -0,0 +1,60 @@
+package project
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func setupEnvironmentConfig(t *testing.T) {
+	t.Helper()
+
+	configPath := filepath.Join(t.TempDir(), ".shopware-project.yml")
+	require.NoError(t, os.WriteFile(configPath, []byte(`
+url: http://127.0.0.1:9
+compatibility_date: "2026-01-01"
+admin_api:
+  client_id: base-id
+  client_secret: base-secret
+environments:
+  staging:
+    url: http://127.0.0.1:29
+    admin_api:
+      client_id: staging-id
+      client_secret: staging-secret
+`), 0o644))
+
+	previousConfigPath := projectConfigPath
+	previousEnvironmentName := environmentName
+	projectConfigPath = configPath
+	t.Cleanup(func() {
+		projectConfigPath = previousConfigPath
+		environmentName = previousEnvironmentName
+	})
+}
+
+func TestExtensionListTargetsSelectedEnvironment(t *testing.T) {
+	setupEnvironmentConfig(t)
+
+	environmentName = "staging"
+	projectExtensionListCmd.SetContext(t.Context())
+
+	err := projectExtensionListCmd.RunE(projectExtensionListCmd, []string{})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "127.0.0.1:29", "command must dial the staging environment URL")
+	assert.NotContains(t, err.Error(), "127.0.0.1:9/", "command must not dial the base URL")
+}
+
+func TestExtensionListRejectsUnknownEnvironment(t *testing.T) {
+	setupEnvironmentConfig(t)
+
+	environmentName = "nonexistent"
+	projectExtensionListCmd.SetContext(t.Context())
+
+	err := projectExtensionListCmd.RunE(projectExtensionListCmd, []string{})
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), `environment "nonexistent" not found`)
+}