Function attach_identity

atomic-cli/src/commands/auth.rs:314–386

Attach a Bearer JWT auth header to the remote config. `identity_override` — if provided, this identity name is used directly, bypassing URL-based inference. Set from `RemoteEntry.identity` or the `--identity` CLI flag. If the identity cannot be resolved (no override, no userinfo, no subdomain, or identity not found in the store) or login fails, the config is returned unmodified and a debug log i

(
    config: HttpRemoteConfig,
    remote_url: &str,
    identity_override: Option<&str>,
)

/// unmodified and a debug log is emitted. This keeps push/pull/clone working
/// against servers that don't require auth (e.g. public reads).
pub async fn attach_identity(
    config: HttpRemoteConfig,
    remote_url: &str,
    identity_override: Option<&str>,
) -> HttpRemoteConfig {
    if identity_override.is_some() {
        log::debug!("Using explicit identity override: {:?}", identity_override);
    }

    // Priority 1: explicit override (--identity); 2/3: URL userinfo or subdomain.
    let inferred = resolve_identity_name_with_override(remote_url, identity_override);
    let source = if identity_override.is_some() {
        format!("--identity {:?}", identity_override)
    } else {
        "URL/config inference".to_string()
    };

    let store = match IdentityStore::open_default() {
        Ok(s) => s,
        Err(e) => {
            log::debug!("Failed to open identity store: {}", e);
            return config;
        }
    };

    // Resolve a concrete identity, falling back to the default when the
    // inferred name doesn't match any local identity (e.g. the `aaron`
    // subdomain vs. a local identity named `aaron-claude`). An explicit
    // --identity that doesn't exist does NOT fall back (returns None → no
    // auth header, so the server rejects it with a clear 401).
    let explicit = identity_override.is_some();
    let identity = match resolve_identity_with_default_fallback(
        &store,
        inferred.as_deref(),
        explicit,
        &source,
    ) {
        Some(id) => id,
        None => {
            log::debug!(
                "No usable identity for {} (inferred={:?}) and no default set",
                remote_url,
                inferred
            );
            return config;
        }
    };

    // Tokens are keyed to the apex server (where the identity registered), not
    // the tenant subdomain — strip the leading subdomain label from the host.
    let server = match apex_server_url(remote_url) {
        Some(s) => s,
        None => {
            log::debug!("Could not derive apex server URL from: {}", remote_url);
            return config;
        }
    };