Function match_server_identity

atomic-cli/src/commands/auth.rs:198–212

Pick the identity bound to the configured server whose host is the longest dot-boundary suffix of `remote_host`. When several profiles' hosts match with the same length (e.g. the legacy `[server]` block and a named profile pointing at the same server), the **active** profile wins — the one `default_server` selects, else the legacy block. Longest-suffix still wins over active: a more specific serv

(remote_host: &str, servers: &[ServerBinding])

/// for hosts under both — e.g. `x.staging.atomic.storage` resolves to the
/// staging identity, not prod.
fn match_server_identity(remote_host: &str, servers: &[ServerBinding]) -> Option<String> {
    servers
        .iter()
        .filter(|b| host_is_under(remote_host, &b.host))
        .max_by_key(|b| (b.host.len(), b.active))
        // An agent bound to this profile is the one that should be signing
        // repository traffic: that is the whole reason it was created. The
        // human binding remains the fallback, so a profile with no agent
        // behaves exactly as before.
        .map(|b| {
            b.agent_identity
                .clone()
                .unwrap_or_else(|| b.identity.clone())
        })
}

/// Whether `remote_host` is the server host itself or a subdomain of it,
/// matching only on dot boundaries (so `notatomic.storage` does NOT match