auth: demolish static fallbacks, legacy store, and v1 provider (COR-393, part 2)

[toothbrush]

https://entire.io/gh/entireio/cli/trails/554

Part 2 of COR-393, stacked on #1404. Closes COR-393.

Auth resolution is now contexts + discovery, full stop: every bearer comes from a per-context token manager keyed on that context's core. Net −1,600 lines.

What changes

• No login → control-plane commands (org/repo/project/grant, mirror) error with "run entire login"; auth status prints an informational "Not logged in." (exit 0); logout no-ops. Previously these silently targeted the default core with a legacy keyring token.
• Data-API commands require the host to advertise /.well-known/entire-api.json; no static fallback remains (entire.io#2277 shipped, so only pre-well-known deployments would notice).
• Pre-contexts logins are no longer bridged: stranded users see the login hint and re-login once. The legacy entire-cli/<host> keyring slot is neither read nor written anymore.
• v1 (single-host, non-OIDC) provider support is gone, along with ENTIRE_AUTH_PROVIDER_VERSION and the split-host auto-detect.

Deleted machinery: TokenForResource + the process-wide singleton manager, MigrateLegacyLoginContext, LookupCurrentToken, ContextStore, the legacy keyring store with its keyring-timeout shim, api.AuthBaseURL()/IsSplitHost, and the authfilestore build tag (test keychain-protection now rides the tag-free ENTIRE_TOKEN_STORE=file).

Review note: the integration login tests were silently coupled to v1 — same-host env pinning made the old heuristic pick the v1 provider, so the fixtures served /oauth/device/code and an opaque token. They now serve /device_authorization and a JWT with iss/handle claims, which the contexts-only model genuinely requires.

🤖 Generated with Claude Code

---

Note

High Risk
Breaking auth for users without migrated contexts or APIs without well-known discovery; login and all authenticated commands depend on the new model exclusively.

Overview
Auth is contexts + discovery only — the legacy keyring store (entire-cli/<host>), TokenForResource / singleton token manager, MigrateLegacyLoginContext, ContextStore, and v1 OAuth provider routing are removed (~1,600 lines). Logins persist only via RecordLoginContext in contexts.json + per-context keyring slots.

Operator-facing behavior

• ENTIRE_AUTH_BASE_URL is retired: if set (even empty), every built-in command fails with a pointer to entire login --server. Local dev docs use --server + ENTIRE_API_BASE_URL instead.
• No active login context → control-plane commands return ErrNotLoggedIn / entire login hint; auth status prints informational “Not logged in.”; logout no-ops. No fallback to a default auth host or legacy token.
• Data API (activity, search, etc.) requires /.well-known/entire-api.json; missing discovery is a hard error (no static TokenForResource fallback).
• Device login always uses the v2/OIDC surface (/device_authorization, fixed oauthClientID); ENTIRE_AUTH_PROVIDER_VERSION and split-host auto-detect are gone.
• logout drops legacy keyring reads/deletes; revocation uses the resolved context token only.

Tests / build — integration login tests use JWT iss/handle and /device_authorization; authfilestore build tag removed in favor of ENTIRE_TOKEN_STORE=file for e2e/integration.

^{Reviewed by Cursor Bugbot for commit 613b91a. Configure here.}

[Copilot]

Pull request overview

This PR completes COR-393 by removing legacy authentication fallbacks and enforcing a single auth model across the CLI: contexts.json + per-context token managers + host discovery (no static fallbacks, no legacy keyring slot reads/writes, and no v1 provider routing). This materially changes login/logout/status and data-API authentication behavior, and deletes a large amount of transitional machinery.

Changes:

• Removes legacy auth store/migration/singleton-token-manager plumbing and hardcodes the OIDC/v2 OAuth endpoint wiring.
• Makes control-plane commands require an active context (no default-core fallback); data API now requires /.well-known/entire-api.json discovery (no static fallback).
• Updates integration/E2E wiring to use ENTIRE_TOKEN_STORE=file (no authfilestore build tag) and adjusts login fixtures to the OIDC device authorization endpoint.

Reviewed changes

Copilot reviewed 41 out of 41 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
README.md	Updates local device-auth dev instructions to use login --server instead of retired env override.
mise.toml	Removes authfilestore build tags; documents ENTIRE_TOKEN_STORE=file for e2e/integration.
internal/entireclient/clusterdiscovery/api_discovery_test.go	Updates comment to reflect removal of operator-side auth override.
internal/coreapi/client.go	Updates Core API client docs to reflect contexts-only auth targeting/erroring when logged out.
internal/coreapi/client_test.go	Updates expected “not logged in” guidance to entire login --server ….
e2e/tests/main_test.go	Switches e2e token isolation to ENTIRE_TOKEN_STORE=file only.
docs/architecture/upstream-host-resolution.md	Updates architecture doc to remove static fallback and default-host behavior.
cmd/git-remote-entire/main.go	Removes legacy login migration bridge on git-remote cold start.
cmd/entire/cli/logout.go	Reworks logout to operate purely on contexts/tokenstore; no legacy token delete.
cmd/entire/cli/logout_test.go	Updates logout unit tests to match new contexts-only behavior.
cmd/entire/cli/login.go	Makes login persist only via contexts/tokenstore (RecordLoginContext) and fail on save error.
cmd/entire/cli/integration_test/setup_test.go	Builds integration-test subprocess without authfilestore tag.
cmd/entire/cli/integration_test/login_test.go	Updates integration login fixture to /device_authorization + JWT-shaped token; uses tokenstore file backend.
cmd/entire/cli/auth/store.go	Deletes legacy keyring/file-backed store implementation.
cmd/entire/cli/auth/store_test.go	Deletes tests for removed legacy store.
cmd/entire/cli/auth/store_invariants_test.go	Deletes build-tag invariant tests tied to removed store backend.
cmd/entire/cli/auth/store_filebackend.go	Deletes authfilestore-tagged file backend.
cmd/entire/cli/auth/store_filebackend_test.go	Deletes tests for removed file backend.
cmd/entire/cli/auth/repo_token.go	Removes legacy login migration from repo-token source.
cmd/entire/cli/auth/refresh.go	Hardcodes OAuth wiring constants; keeps per-context token manager behavior.
cmd/entire/cli/auth/provider.go	Replaces provider/version routing with fixed OIDC endpoint constants.
cmd/entire/cli/auth/provider_test.go	Deletes tests for removed provider/version routing logic.
cmd/entire/cli/auth/keyring_timeout.go	Deletes legacy keyring timeout shim.
cmd/entire/cli/auth/keyring_timeout_test.go	Deletes tests for removed timeout shim.
cmd/entire/cli/auth/exchange.go	Removes singleton token manager + TokenForResource; keeps insecure-http opt-in flag.
cmd/entire/cli/auth/data_api.go	Removes static fallback; discovery is mandatory and failures are hard errors.
cmd/entire/cli/auth/data_api_test.go	Updates tests for “no fallback” discovery error behavior.
cmd/entire/cli/auth/control_plane.go	Removes default-host fallback; no active context now returns ErrNotLoggedIn-wrapping error.
cmd/entire/cli/auth/control_plane_test.go	Updates tests to expect not-logged-in error instead of fallback target selection.
cmd/entire/cli/auth/contexts.go	Removes legacy login migration function and related env/legacy-store coupling.
cmd/entire/cli/auth/contexts_test.go	Deletes tests for legacy migration and legacy-fallback context store behavior; adjusts current-context assertions.
cmd/entire/cli/auth/context_store.go	Removes legacy “prefer context then legacy store” wrapper types/helpers.
cmd/entire/cli/auth/client.go	Uses fixed OIDC device/token endpoint constants instead of provider routing.
cmd/entire/cli/auth.go	Changes status/logout to target active context only; refactors insecure-http handling.
cmd/entire/cli/auth_test.go	Removes helper scaffolding for singleton token manager fallback testing.
cmd/entire/cli/auth_context_test.go	Updates status target resolution tests for contexts-only model.
cmd/entire/cli/api/client.go	Updates docs to describe login-server targeting without split-host env override.
cmd/entire/cli/api/base_url.go	Removes AuthBaseURL()/IsSplitHost(); keeps “reject retired env” gate and updates comments.
cmd/entire/cli/api/base_url_test.go	Deletes tests for removed AuthBaseURL()/IsSplitHost().
cmd/entire/cli/api_client.go	Updates data API client auth commentary to contexts+discovery-only exchange flow.
cmd/entire/cli/activity_cmd_test.go	Reworks tests to stub discovery/cancellation paths without relying on removed singleton-manager fallback.

[Copilot]

Pull request overview

Copilot reviewed 43 out of 43 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (2)

cmd/entire/cli/auth.go:142

• --insecure-http-auth is applied after resolveStatusTarget, but resolveStatusTarget may call auth.RefreshedLoginToken, which consults auth.insecureHTTPEnabled() to decide whether a non-loopback http:// core is allowed. This means entire auth status --insecure-http-auth can still fail to refresh/resolve tokens for an insecure-core context because auth.EnableInsecureHTTP() hasn’t been called yet.

Also, the TLS check currently runs whenever target.coreURL != "", even when target.token == "" (no request will be made and status just prints "Not logged in").

		RunE: func(cmd *cobra.Command, _ []string) error {
			target, err := resolveStatusTarget(cmd.Context(), auth.Contexts, auth.RefreshedLoginToken)
			if err != nil {
				return err
			}
			// We send the session token to target.coreURL; enforce TLS on it.
			if !applyInsecureHTTPAuth(insecureHTTPAuth) && target.coreURL != "" {
				if err := api.RequireSecureURL(target.coreURL); err != nil {
					return fmt.Errorf("context login server URL check: %w", err)
				}
			}

cmd/entire/cli/logout.go:80

• --insecure-http-auth is applied after resolveStatusTarget, but resolveStatusTarget may call auth.RefreshedLoginToken, which consults auth.insecureHTTPEnabled() to allow a non-loopback http:// core. This makes entire logout --insecure-http-auth fail to refresh/resolve tokens against an insecure core because the opt-in isn’t enabled yet.

Additionally, the TLS check currently runs even when target.token is empty (no revocation request will be sent), which can unnecessarily block logout of a context on http:// when the keyring read failed and we’re only trying to clear local state.