docs: align README, comments, and host-resolution doc with no-fallback auth · Entire

docs: align README, comments, and host-resolution doc with no-fallback auth

087f5a4→main · toothbrush · 1mo ago · 6 files · +26 added/-42 removed

Local-dev instructions switch from exporting ENTIRE_AUTH_BASE_URL to entire login --server; upstream-host-resolution.md drops the fallback steps that no longer exist; stray comment references to the deleted TokenForResource path and env var are reworded.

Co-Authored-By: Claude Fable 5 noreply@anthropic.com

Sessions

829766ddb442View transcript

Changes

6

211 unmodified lines

cd ../entire.io-1
mise run dev

# In this repo, point data-API commands at the local API.
# (ENTIRE_AUTH_BASE_URL is retired — commands refuse to run while it's
# exported. The login server is chosen at login time via --server, and
# every other command follows the login context.)
# In this repo, point the CLI at the local API. The login flow targets
# the local server via --server (the default is the production
# us.auth.entire.io).
cd ../cli
export ENTIRE_API_BASE_URL=http://localhost:8787
entire login --server http://localhost:8787 --insecure-http-auth

# Run the smoke test
./scripts/local-device-auth-smoke.sh

# Run the login flow against a local server (prompts to press Enter before opening the browser)
go run ./cmd/entire login --server http://localhost:8787 --insecure-http-auth
go run ./cmd/entire login --insecure-http-auth

# Run the focused integration coverage for login
go test -tags=integration ./cmd/entire/cli/integration_test -run TestLogin

// NewClientWithBaseURL creates a new authenticated API client targeting an
// explicit base URL. Use this for endpoints that live on the auth host (e.g.
// auth-token management), which is split from the data API origin by
// default. func NewClientWithBaseURL(token, baseURL string) *Client {
return &Client{ httpClient: &http.Client{

// reauthError carries a friendly, context-named re-login message while still
// unwrapping to the underlying tokenmanager sentinel. Callers that branch on
// errors.Is(err, ErrNotLoggedIn) (NewAuthenticatedAPIClient, search, dispatch)
// keep matching — without this, the discovery path turned a missing keyring
// token into an opaque string and those callers fell through to their generic
// error, a regression vs the pre-discovery TokenForResource path. Error()
// returns only msg so the sentinel's terse text ("not logged in") doesn't leak
// into the rendered message.

// unwrapping to the underlying tokenmanager sentinel, so callers that branch
// on errors.Is(err, ErrNotLoggedIn) (NewAuthenticatedAPIClient, search,
// dispatch) keep matching. Error() returns only msg so the sentinel's terse
// text ("not logged in") doesn't leak into the rendered message.
type reauthError struct {
msg string
sentinel error
}

The default auth origin is the fallback host, not an override: a token minted by the active context's core can't authenticate against a different host, so the active context always wins when present. (At login time entire login --server chooses where to authenticate, and the resulting context's CoreURL is that host — so local-dev / split-host setups keep working. ENTIRE_AUTH_BASE_URL is retired and rejected when set.) 2. else (no active context) → an error wrapping ErrNotLoggedIn with the entire login hint. There is no fallback host: a control-plane command without a login has no identity to act as. (At login time entire login --server chooses where to authenticate, and the resulting context's CoreURL is that host — so local-dev setups keep working.)

Web/data API (done)

Key files: cmd/entire/cli/auth/data_api.go (ResolveDataAPIToken + fallback), Key files: cmd/entire/cli/auth/data_api.go (ResolveDataAPIToken), cmd/entire/cli/auth/refresh.go (NewRefreshingResourceProvider), internal/entireclient/clusterdiscovery/api_discovery.go (DiscoverAPI, ResolveContextForAPI, sharing selectContext and the cores cache with the