Function build_apex_client_as

atomic-cli/src/commands/client.rs:168–183

Build an apex-scoped [`StorageClient`] authenticating as a **named identity rather than whichever one the server profile resolves to. Agent enrollment is the reason this exists: the caller must be the human who signs the certificate, and that is not necessarily the identity bound to the profile — nor, once agents are in play, the default. Making the identity explicit keeps "who is enrolling" a de

(
    identity: &atomic_identity::Identity,
    server_override: Option<&str>,
)

/// explicit keeps "who is enrolling" a decision at the call site instead of a
/// side effect of configuration.
pub async fn build_apex_client_as(
    identity: &atomic_identity::Identity,
    server_override: Option<&str>,
) -> CliResult<(StorageClient, String)> {
    let apex_url = apex_server_url(server_override)?;
    let bearer_token = crate::commands::token::get_token(&apex_url, identity).await?;
    let delegation = delegation_for(identity, &apex_url);

    let client =
        StorageClient::with_delegation(&apex_url, "", &bearer_token, delegation.as_deref())
            .map_err(|e| {
                CliError::Internal(anyhow::anyhow!("Failed to create storage client: {}", e))
            })?;

    Ok((client, apex_url))
}

/// Build a [`StorageClient`] and return the resolved org slug alongside it.
///