Function delegation_for

atomic-cli/src/commands/client.rs:118–127

The encoded certificate this identity presents, if it is an agent. Management calls are normally made by a human and this returns `None`. It exists so the few paths an agent legitimately drives — reading its own project list, say — carry the certificate too, rather than failing with a puzzling 401 that says the request was delegated but presented nothing.

(identity: &atomic_identity::Identity, server: &str)

/// project list, say — carry the certificate too, rather than failing with a
/// puzzling 401 that says the request was delegated but presented nothing.
fn delegation_for(identity: &atomic_identity::Identity, server: &str) -> Option<String> {
    if !identity.identity_type.is_delegated() {
        return None;
    }
    let store = IdentityStore::open_default().ok()?;
    let resolved = crate::commands::delegation::active_for(&store, identity, Some(server)).ok()?;
    Some(atomic_canonical::delegation::encode_for_transport(
        &resolved.document,
    ))
}

/// Resolve just the apex server URL for a server override.
///