auth: drop stale cross-core warning from auth use

e15919d→main·
toothbrush·1mo ago·2 files·+11 added/-75 removed

warnIfCrossCoreContext warned that switching context didn't retarget the control plane — no longer true now that org/project/repo/grant and auth status all follow the active context. Remove it and update the auth use help to say so, while noting the data-API commands (activity/search/trail/dispatch) don't follow the context yet.

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

Sessions

4005bcae81eeView transcript

[?
Context-Aware Control-Plane Target ResolutionClaude Code·1 step](/content/gh/entireio/cli/session/d6b8ae84-4338-458e-ae8a-594eb414b667#timeline-4005bcae81ee/index.html)

Changes

2

• cmd/entire/cli

• Mauth_context.go+11/-43

• Mauth_context_test.go-32

3 unmodified lines
4
5
6
7
7
8
9
1 unmodified line
11
12
13
15
16
17
18
19
20
21
22
14
15
16
17
18
19
20
21
22
23
24
28
29
30
31
32
33
25
26
27
28
29
30
31
32
1 unmodified line
34
35
36
41
37
38
39
27 unmodified lines

67
68
69
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
70
71
72

3 unmodified lines

"fmt"
    "io"

"github.com/entireio/cli/cmd/entire/cli/api"
    "github.com/entireio/cli/cmd/entire/cli/auth"
    "github.com/entireio/cli/internal/entireclient/contexts"
    "github.com/spf13/cobra"
1 unmodified line

// newAuthUseCmd switches the active login context.
//
// For `git clone entire://…` the active context is the preferred identity:
// it authenticates any cluster fronted by its login server, and switching
// here takes effect on the next operation (resolution recomputes the account
// every time). Control-plane commands (auth status/list/revoke, org/project/
// repo/grant) currently target the configured auth host (ENTIRE_AUTH_BASE_URL
// / the default) regardless of the active context's login server, so
// switching to a context on a *different* login server does not yet retarget
// them — auth use warns when that's the case.
// The active context is the preferred identity for both `git clone entire://…`
// (it authenticates any cluster fronted by its login server) and the
// control-plane commands (auth status, org/project/repo/grant), which dial the
// context's core. Switching takes effect on the next operation; resolution
// recomputes every time. Data-API commands (activity/search/trail/dispatch)
// still target ENTIRE_API_BASE_URL and do not follow the active context yet.
func newAuthUseCmd() *cobra.Command {
    return &cobra.Command{
        Use:   "use <context>",
        Short: "Switch the active login context",
        Long: "Switch the active login context.\n\n" +
            "For `git clone entire://…` the active context is the preferred identity: it\n" +
            "authenticates any cluster fronted by its login server, and the switch takes\n" +
            "effect on the next operation.\n\n" +
            "Control-plane commands (auth status/list/revoke, org/project/repo/grant) still\n" +
            "target the configured auth host (ENTIRE_AUTH_BASE_URL / the default), so\n" +
            "switching to a context on a different login server does not retarget them yet.\n" +
            "The active context is the preferred identity for `git clone entire://…` and\n" +
            "the control-plane commands (auth status, org/project/repo/grant), which dial\n" +
            "the context's core. The switch takes effect on the next operation.\n\n" +
            "Data-API commands (activity/search/trail/dispatch) still target\n" +
            "ENTIRE_API_BASE_URL and do not follow the active context yet.",
        Args:              cobra.ExactArgs(1),
        ValidArgsFunction: completeContextNames,
        RunE: func(cmd *cobra.Command, args []string) error {

return err //nolint:wrapcheck // already a user-facing message
        }
    }
}
27 unmodified lines

return out, cobra.ShellCompDirectiveNoFileComp
}

// warnIfCrossCoreContext warns when the now-active context authenticates
// against a different core than the control plane targets. Clone resolves
// per-cluster and is unaffected, but auth status/list/revoke and the
// org/project/repo/grant commands still hit the configured auth host —
// switching cores there isn't wired up yet, so flag it rather than
// silently authenticate against the wrong host.
func warnIfCrossCoreContext(errW io.Writer, name string) {
    all, _, err := auth.Contexts()
    if err != nil {
        return
    }
    authHost := api.AuthBaseURL()
    for _, c := range all {
        if c.Name != name {
            continue
        }
        if c.CoreURL == "" || api.OriginOnly(c.CoreURL) == api.OriginOnly(authHost) {
            return
        }
        fmt.Fprintf(errW,
            "Note: %q authenticates against %s, but control-plane commands still target %s — switching the active context doesn't retarget control-plane commands yet.\n"+
            "For `git clone entire://…`, this context now authenticates any cluster fronted by %s.\n",
            name, c.CoreURL, authHost, c.CoreURL)
        return
    }
}

// newAuthContextsCmd lists the stored login contexts and marks the active
// one. Purely local — it reads contexts.json, no network.
func newAuthContextsCmd() *cobra.Command {