# auth: rename api.Token -> api.Session (and methods) to reflect reality

`ed57e73`→[main](/content/gh/entireio/cli/commits/main/index.html)·!
    
toothbrush·1mo ago·6 files·+94 added/-91 removed

These rows are OAuth refresh-token families (login sessions), not personal access tokens — the CLI never mints them. Rename so the types are self-documenting and drop the "Despite the api.Token name…" caveat:

api.Token -> api.Session
api.TokensResponse -> api.SessionsResponse (wire key stays "tokens")
(*Client).ListTokens -> ListSessions
(*Client).RevokeToken -> RevokeSession
(*Client).RevokeCurrentToken -> RevokeCurrentSession

cli: authTokenLister -> sessionLister
defaultListTokens -> defaultListSessions
defaultRevokeCurrentToken -> defaultRevokeCurrentSession
newAPITokensClient -> newSessionsClient

Pure rename: wire paths and JSON field names are unchanged, so the server contract is untouched.

## Sessions

0e17fccbbe86View transcript

## Changes

6

- cmd/entire/cli

- api
    - Mauth_tokens.go+31/-26
    - Mauth_tokens_test.go+15/-15
    - Mclient.go+2/-2
  - Mauth.go+26/-28
  - Mauth_test.go+13/-13
  - Mlogout.go+7/-7

```go
6 unmodified lines
7
8
9
10
11
12
10
11
12
13
14
15
16
17
18
3 unmodified lines
22
23
24
22
23
24
25
26
27
28
29
30
27
28
31
32
33
34
35
6 unmodified lines
42
43
44
41
42
45
46
47
48
45
49
50
51
52
49
53
54
55
56
57
54
58
59
60
57
61
62
59
63
64
61
65
66
67
64
65
68
69
70
71
72
68
73
74
75
76
72
77
78
79
80
81
77
82
83
84
85
86
82
83
87
88
89
90
86
91
92
93
94
90
95
96
97
98
99
95
100
101
102
103
```

// Token is a single API token row returned by the auth-tokens endpoint.
// Plaintext token values are never returned by the server — only metadata.
type Token struct {
// Session is a single active login session — an OAuth refresh-token family —
// returned by the auth-tokens endpoint. One is created per `entire login`,
// across all of a user's devices. Plaintext token values are never returned by the
// server, only metadata. (The wire endpoint is historically named
// "tokens"; these rows are sessions, not personal access tokens.)
type Session struct {
	ID         string  `json:"id"`
	UserID     string  `json:"user_id"`
	Name       string  `json:"name"`
	
	CreatedAt  string  `json:"created_at"`
}

// TokensResponse is the envelope returned by the list endpoint.
type TokensResponse struct {
	Tokens []Token `json:"tokens"`
// SessionsResponse is the envelope returned by the list endpoint. The wire key
// stays "tokens" — that is the server's contract.
type SessionsResponse struct {
	Sessions []Session `json:"tokens"`
}

// errAuthTokensPathUnset surfaces when an auth-tokens method is called
// on a Client that wasn't given a base path. Construct via
// errAuthTokensPathUnset surfaces when a session method is called on a
// Client that wasn't given a base path. Construct via
// NewClientWithBaseURL(...).WithAuthTokensPath(...) — the active path
// lives in cmd/entire/cli/auth.CurrentProvider().AuthTokensPath, the
// single source of truth for provider-version routing.
6 unmodified lines

return c.authTokensPath, nil
}

// ListTokens returns the authenticated user's non-expired API tokens.
func (c *Client) ListTokens(ctx context.Context) ([]Token, error) {
// ListSessions returns the authenticated user's active login sessions.
func (c *Client) ListSessions(ctx context.Context) ([]Session, error) {
	base, err := c.authTokensBasePath()
	if err != nil {
		return nil, fmt.Errorf("list tokens: %w", err)
		return nil, fmt.Errorf("list sessions: %w", err)
	}
	resp, err := c.Get(ctx, base)
	if err != nil {
		return nil, fmt.Errorf("list tokens: %w", err)
		return nil, fmt.Errorf("list sessions: %w", err)
	}
	defer resp.Body.Close()

if err := CheckResponse(resp); err != nil {
		return nil, fmt.Errorf("list tokens: %w", err)
		return nil, fmt.Errorf("list sessions: %w", err)
	}
	
	var out TokensResponse
	var out SessionsResponse
	if err := DecodeJSON(resp, &out); err != nil {
		return nil, fmt.Errorf("list tokens: %w", err)
		return nil, fmt.Errorf("list sessions: %w", err)
	}
	return out.Tokens, nil
	return out.Sessions, nil
}

// RevokeCurrentToken revokes the bearer token used to authenticate this client.
func (c *Client) RevokeCurrentToken(ctx context.Context) error {
// RevokeCurrentSession revokes the login session this client is authenticating
// with (the family the current bearer belongs to).
func (c *Client) RevokeCurrentSession(ctx context.Context) error {
	base, err := c.authTokensBasePath()
	if err != nil {
		return fmt.Errorf("revoke current token: %w", err)
		return fmt.Errorf("revoke current session: %w", err)
	}
	resp, err := c.Delete(ctx, base+"/current")
	if err != nil {
		return fmt.Errorf("revoke current token: %w", err)
		return fmt.Errorf("revoke current session: %w", err)
	}
	defer resp.Body.Close()

if err := CheckResponse(resp); err != nil {
		return fmt.Errorf("revoke current token: %w", err)
		return fmt.Errorf("revoke current session: %w", err)
	}
	return nil
}

// RevokeToken revokes the API token with the given id.
func (c *Client) RevokeToken(ctx context.Context, id string) error {
// RevokeSession revokes the login session with the given id.
func (c *Client) RevokeSession(ctx context.Context, id string) error {
	base, err := c.authTokensBasePath()
	if err != nil {
		return fmt.Errorf("revoke token %s: %w", id, err)
		return fmt.Errorf("revoke session %s: %w", id, err)
	}
	resp, err := c.Delete(ctx, base+"/"+url.PathEscape(id))
	if err != nil {
		return fmt.Errorf("revoke token %s: %w", id, err)
		return fmt.Errorf("revoke session %s: %w", id, err)
	}
	defer resp.Body.Close()

if err := CheckResponse(resp); err != nil {
		return fmt.Errorf("revoke token %s: %w", id, err)
		return fmt.Errorf("revoke session %s: %w", id, err)
	}
	return nil
}