Function resolve_identity_for_server

atomic-cli/src/commands/client.rs:247–294

Resolve the identity to authenticate as for a given server profile. Resolution order: 1. `server.identity` — a per-server identity override (set when `atomic identity register --identity ` is used). 2. Global default identity from the identity store. Shared by [`build_client_with_org`] and [`build_apex_client`] so the org-scoped and apex-scoped code paths pick the same identity. # Errors

(
    server: &atomic_config::ServerConfig,
)

/// - Per-server identity name not found in the store.
/// - No default identity set.
pub fn resolve_identity_for_server(
    server: &atomic_config::ServerConfig,
) -> CliResult<atomic_identity::Identity> {
    let store = IdentityStore::open_default()
        .map_err(|e| CliError::Internal(anyhow::anyhow!("Failed to open identity store: {}", e)))?;

    if let Some(ref identity_name) = server.identity {
        // Server profile specifies an identity — use it.
        log::debug!(
            "Authenticating as '{}' (bound to server profile {})",
            identity_name,
            server.url.as_deref().unwrap_or("<no url>")
        );
        store.load_by_name(identity_name).map_err(|e| {
            CliError::Internal(anyhow::anyhow!(
                "Identity '{}' specified by server profile not found: {}",
                identity_name,
                e
            ))
        })
    } else {
        // Fall back to global default identity.
        //
        // Worth logging loudly: the fallback is silent on the wire, so when
        // the default identity is not the one registered with this server the
        // only symptom is a 401 from the far end that names no identity at
        // all. Saying which identity was chosen, and that it was a fallback,
        // is the difference between a one-line fix and a blind hunt.
        let identity = store
            .get_default()
            .map_err(|e| {
                CliError::Internal(anyhow::anyhow!("Failed to load default identity: {}", e))
            })?
            .ok_or_else(|| {
                CliError::Internal(anyhow::anyhow!(
                    "No default identity set. Create one first:\n  \
                     atomic identity new <name> --email <email> --set-default"
                ))
            })?;
        log::debug!(
            "Server profile {} declares no identity; falling back to the default identity '{}'. \
             Bind one with 'atomic server set-identity <profile> <identity>'.",
            server.url.as_deref().unwrap_or("<no url>"),
            identity.name
        );
        Ok(identity)
    }
}

/// Convenience: map a [`atomic_remote::RemoteError`] to a [`CliError`].
pub fn remote_err(e: atomic_remote::RemoteError) -> CliError {