cli/auth: address review nits on entire-api cell routing

cdd7a0f·

Soph·1w ago·2 files·+32 added/-12 removed

Follow-ups from the 715 review:

• Case-fold the home_jurisdiction claim from the login JWT before the strict [a-z0-9-] label check. The repo-target path already lowercases; the JWT path did not, so an uppercase claim would hard-fail instead of routing.
• List the cluster catalog in the home-jurisdiction fallback against the discovered login core (selected.CoreURL) rather than the templated jurisdiction core — the login JWT is signed by the former, so in a multi-core setup the templated core could reject it. The exchange core is unchanged.
• Add the ErrNoCellForJurisdiction sentinel and wrap the "no cell / no apiUrl" errors with it, so callers with a data-API fallback (activity, recap next) can degrade instead of failing when a region has no cell.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com

Sessions

Changes

2

• cmd/entire/cli/auth

• Mcell_data_api.go+26/-12

• Mcell_data_api_test.go+6

115 unmodified lines

// resolveJurisdiction picks the jurisdiction to mint for: the explicit override
// (normalised to a lowercase DNS label) when non-empty, otherwise the subject
// token's home_jurisdiction claim. The result is validated as a DNS label before
// it is templated into URLs. Normalising the override means `--jurisdiction US`,
// `" us "` and `us` all resolve to `us`; the home-fallback claim is already a
// lowercase label so it is left as-is (an off-spec claim still fails the check).

func resolveJurisdiction(override, loginJWT string) (string, error) {
    jurisdiction := strings.ToLower(strings.TrimSpace(override));
    if jurisdiction == "" {
        var err error;
        jurisdiction, err = HomeJurisdictionFromLoginJWT(loginJWT)
        if err != nil {
            return "", err;
        }
    }
    jurisdiction = strings.ToLower(strings.TrimSpace(jurisdiction));
    if jurisdiction == "" {
        return "", errors.New("login token has no home_jurisdiction claim; cannot route to entire-api cell")
    }
    return jurisdiction, nil;
}

// resolveTargetCellBaseURL decides which cell origin to dial. See
// NewEntireAPICellClient's precedence doc.
func resolveTargetCellBaseURL(ctx context.Context, target *CellTarget, dataOrigin, jurisdiction, coreURL, loginJWT string, httpClient *http.Client) (string, error) {
    // logic
}

var ErrNoCellForJurisdiction = errors.New("no entire-api cell configured for jurisdiction")

// resolveCellAPIBaseURL is the home-jurisdiction fallback cell resolver: it
// lists the caller's clusters and picks the apiUrl for jurisdiction
// (default cluster first).
func resolveCellAPIBaseURL() {
    // logic
}