Function build_apex_client

atomic-cli/src/commands/client.rs:82–111

Build a [`StorageClient`] targeting the server **apex** (no org subdomain). Apex-scoped endpoints — notably `GET /orgs` ("list my orgs") and `POST /orgs` ("create org") — span orgs, so they must be hit on the bare server host rather than an ` . ` subdomain. This helper resolves the active server profile, mints a self-signed EdDSA JWT against the apex URL, and constructs a `StorageClient`

(server_override: Option<&str>)

/// - Identity store cannot be opened or no default identity set.
/// - HTTP client construction failure.
pub async fn build_apex_client(server_override: Option<&str>) -> CliResult<StorageClient> {
    let config = GlobalConfig::load()
        .map_err(|e| CliError::Internal(anyhow::anyhow!("Failed to load global config: {}", e)))?;

    let server = config
        .resolve_server(server_override)
        .map_err(|e| CliError::Internal(anyhow::anyhow!("{}", e)))?
        .0;

    let apex_url = server.url.clone().ok_or_else(|| {
        let hint = if let Some(name) = server_override {
            format!("Server profile '{}' has no URL configured.", name)
        } else {
            "Server not configured. Run 'atomic identity register <server-url>' first.".to_string()
        };
        CliError::Internal(anyhow::anyhow!("{}", hint))
    })?;

    let identity = resolve_identity_for_server(server)?;

    // Self-signed EdDSA JWT keyed by the identity's own public key; minted
    // against the apex URL (the token is portable across the deployment).
    let bearer_token = crate::commands::token::get_token(&apex_url, &identity).await?;

    let client = StorageClient::new(&apex_url, "", &bearer_token).map_err(|e| {
        CliError::Internal(anyhow::anyhow!("Failed to create storage client: {}", e))
    })?;

    Ok(client)
}

/// Build a [`StorageClient`] and return the resolved org slug alongside it.
///