fix(app): don't auto SSO if no profiles

pkg/app/run.go

@@ -347,6 +347,13 @@ func processToken(cmds []cmd.Command, commandName string, data *global.Data) (to
 	// If there's no token available, and we need one for the invoked command,
 	// then we'll trigger the SSO authentication flow.
 	if tokenSource == lookup.SourceUndefined && commandRequiresToken(commandName) {
+		// FIXME: Remove this conditional when SSO is GA.
+		// Once put back, it means "no token" == "automatic SSO".
+		// For now, a brand new CLI user will have to manually create long-lived
+		// tokens via the UI in order to use the Fastly CLI.
+		if data.Env.UseSSO != "1" && !data.Flags.SSO {
+			return "", nil
+		}
 		token, tokenSource, err = ssoAuthentication(tokenSource, token, warningMessage, cmds, data)
 		if err != nil {
 			return token, fmt.Errorf("failed to check profile token: %w", err)

pkg/commands/sso/root.go

@@ -39,7 +39,7 @@ type RootCommand struct {
 func NewRootCommand(parent cmd.Registerer, g *global.Data) *RootCommand {
 	var c RootCommand
 	c.Globals = g
-	// FIXME: Unhide this command once SSO authentication goes GA.
+	// FIXME: Unhide this command once SSO is GA.
 	c.CmdClause = parent.Command("sso", "Single Sign-On authentication").Hidden()
 	c.CmdClause.Arg("profile", "Profile to authenticate (i.e. create/update a token for)").Short('p').StringVar(&c.profile)
 	return &c