Function attach_identity

atomic-cli/src/commands/auth.rs:165–226

Attach a Bearer JWT auth header to the remote config. `identity_override` — if provided, this identity name is used directly, bypassing URL-based inference. Set from `RemoteEntry.identity` or the `--identity` CLI flag. If the identity cannot be resolved (no override, no userinfo, no subdomain, or identity not found in the store) or login fails, the config is returned unmodified and a debug log i

(
    config: HttpRemoteConfig,
    remote_url: &str,
    identity_override: Option<&str>,
)

/// unmodified and a debug log is emitted. This keeps push/pull/clone working
/// against servers that don't require auth (e.g. public reads).
pub async fn attach_identity(
    config: HttpRemoteConfig,
    remote_url: &str,
    identity_override: Option<&str>,
) -> HttpRemoteConfig {
    if identity_override.is_some() {
        log::debug!("Using explicit identity override: {:?}", identity_override);
    }

    // Priority 1: explicit override (--identity); 2/3: URL userinfo or subdomain.
    let identity_name = match resolve_identity_name_with_override(remote_url, identity_override) {
        Some(name) => name,
        None => {
            log::debug!("No identity resolvable from URL: {}", remote_url);
            return config;
        }
    };

    log::debug!("Resolved identity name: {}", identity_name);

    let store = match IdentityStore::open_default() {
        Ok(s) => s,
        Err(e) => {
            log::debug!("Failed to open identity store: {}", e);
            return config;
        }
    };

    // Match by name, tolerating tenant-slug/identity-name case differences
    // (e.g. the `aaron` subdomain selecting the local `Aaron` identity).
    let identity = match load_identity_lenient(&store, &identity_name) {
        Some(id) => id,
        None => {
            log::debug!("Identity '{}' not found in store", identity_name);
            return config;
        }
    };

    // Tokens are keyed to the apex server (where the identity registered), not
    // the tenant subdomain — strip the leading subdomain label from the host.
    let server = match apex_server_url(remote_url) {
        Some(s) => s,
        None => {
            log::debug!("Could not derive apex server URL from: {}", remote_url);
            return config;
        }
    };

    match crate::commands::token::get_token(&server, &identity).await {
        Ok(jwt) => {
            log::debug!("Attaching Bearer JWT for identity '{}'", identity_name);
            config.with_header("Authorization", format!("Bearer {}", jwt))
        }
        Err(e) => {
            // Non-fatal: a server that doesn't require auth still works for
            // public reads. Auth-required operations will then fail with a
            // clear 401 from the server.
            log::debug!("Could not obtain JWT for '{}': {}", identity_name, e);