Auto-pick v2 auth when split-host is configured

[Soph]

https://entire.io/gh/entireio/cli/trails/447

Summary

Follow-up to #1258. Removes the need to set both ENTIRE_AUTH_BASE_URL and ENTIRE_AUTH_PROVIDER_VERSION=v2 when targeting a split-host deployment (e.g. partial.to + us.auth.partial.to). When ENTIRE_AUTH_BASE_URL is set to a different origin than the data API, the CLI auto-picks v2.

Why not flip the default outright

Probed entire.io directly before deciding:

POST https://entire.io/device_authorization       → HTTP 405 Method Not Allowed
GET  https://entire.io/.well-known/openid-configuration → HTTP 200 returning the SPA HTML (no discovery doc)
POST https://entire.io/oauth/device/code          → HTTP 200, valid device code (v1 works)

So v2 isn't live on entire.io yet. An unconditional default flip would break login for every existing CLI user. The auto-detect approach makes "split-host config = v2" the actual UX (without requiring a second env var) while leaving the entire.io path on v1 until the backend ships the v2 OIDC surface.

Resolution order

1. ENTIRE_AUTH_PROVIDER_VERSION explicit value wins (v1 / v2 / passthrough to resolveProvider's default for unrecognised values — typos don't silently auto-upgrade).
2. AuthBaseURL() != BaseURL() → v2. Canonicalisation in those helpers means a redundant ENTIRE_AUTH_BASE_URL=https://entire.io/ (trailing slash, same host) doesn't trigger v2.
3. Otherwise → v1.

Users on a v2-capable single-host server can still opt in with ENTIRE_AUTH_PROVIDER_VERSION=v2. Users mid-migration who want to suppress the auto-upgrade can force v1 the same way.

Test plan

• TestEffectiveProviderVersion_ExplicitEnvWins — env var beats auto-detect for v1, v2, and unrecognised values
• TestEffectiveProviderVersion_SplitHostPicksV2 — the user-facing change
• TestEffectiveProviderVersion_SameHostPicksV1 — redundant env value doesn't trigger v2
• TestEffectiveProviderVersion_UnsetDefaultsToV1 — entire.io path (most existing users) doesn't regress
• mise run fmt && mise run lint && go test ./... clean

Follow-up (out of scope)

• Bring v2 OIDC surface to entire.io, then a tiny PR can flip the default outright and the env-var dance disappears.
• Optionally add OIDC discovery (/.well-known/openid-configuration) so split-host can be discovered from the data API alone, eliminating ENTIRE_AUTH_BASE_URL as a manual config step.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes login routing for auth provider selection; mitigated by defaulting unchanged single-host users to v1 and letting the env var override auto-detect.

Overview
When ENTIRE_AUTH_PROVIDER_VERSION is unset, the CLI now infers the OAuth provider version from deployment shape instead of defaulting only via that env var.

Split-host setups—ENTIRE_AUTH_BASE_URL on a different origin than the data API (api.AuthBaseURL() != api.BaseURL())—automatically select v2, so operators no longer need both split-host URLs and ENTIRE_AUTH_PROVIDER_VERSION=v2. Same-origin configs (including redundant auth URL with trailing slash) still resolve to v1, preserving existing entire.io single-host behavior where v2 is not live yet.

Explicit ENTIRE_AUTH_PROVIDER_VERSION still wins (including forcing v1 during migration). Unrecognized env values are passed through to resolveProvider without triggering auto-detect, so typos do not silently upgrade.

Docs on Client / CurrentProvider and new unit tests document and lock in this resolution order.

^{Reviewed by Cursor Bugbot for commit 7789d17. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 7789d17. Configure here.}

[Copilot]

Pull request overview

Updates auth provider selection so split-host deployments automatically use the v2 OAuth/OIDC surface when ENTIRE_AUTH_BASE_URL is configured to a different origin than the data API, while keeping the default v1 behavior for single-host (including entire.io) unless explicitly overridden.

Changes:

• Add effectiveProviderVersion to infer provider version from env + split-host shape, and route CurrentProvider through it.
• Expand inline docs to describe the resolution order and split-host rationale.
• Add unit tests covering explicit env override, split-host auto-pick, same-host no-op, and unset defaults.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
cmd/entire/cli/auth/provider.go	Adds effectiveProviderVersion and updates provider resolution/docs to auto-pick v2 for split-host.
cmd/entire/cli/auth/provider_test.go	Adds unit tests to lock in provider-version resolution behavior.
cmd/entire/cli/auth/client.go	Updates Client comment to reference the new resolution rules.