Integrate auth-go: split-host config + RFC 8693 token exchange

[Soph]

https://entire.io/gh/entireio/cli/trails/403

Summary

• Migrates the CLI's inline OAuth implementation to the shared github.com/entireio/auth-go library, picking up its hardened OAuth client (origin-URL validation, alg:none JWT rejection, HTTPS-only with loopback exception, verification_uri validation, centralised error parsing).
• Adds split-host config: ENTIRE_AUTH_BASE_URL for the auth issuer, falling back to ENTIRE_API_BASE_URL so single-host deployments are unchanged. Split-host setups (e.g. us.auth.partial.to mints tokens, partial.to consumes them) get RFC 8693 token exchange transparently — the data-API bearer is minted on demand from the core token via the auth host's STS endpoint.
• Introduces a provider routing table (v1/v2 via ENTIRE_AUTH_PROVIDER_VERSION) so endpoint paths and the auth-tokens management URL are configured in one place instead of duplicated between auth/ and api/.

What changed under the hood

Library integration

• Pinned github.com/entireio/auth-go v0.1.1-0.20260520123811-da94c52ef430 (PR use strings.Contains #5 head of that repo).
• auth/client.go is now a thin shim over deviceflow.Client. auth/store.go implements tokenstore.Store. auth/exchange.go wires a package-level tokenmanager.Manager and exposes TokenForResource(ctx, url) / Token(ctx, req).
• All eight data-API callers (activity, dispatch_wizard, recap, search completion, trail ×4, watch) now thread cmd.Context() and obtain bearers via auth.TokenForResource. Dispatch's cloud mode and recap join the same path.

Security hardening

• Login validates the received token before persisting: rejects alg:none JWTs (tokens.ErrUnsignedJWT), enforces iss matches the configured issuer, refuses pre-expired tokens. Opaque (non-JWT) tokens are accepted unconditionally — every parse failure other than ErrUnsignedJWT is treated as opaque per the doc-comment promise.
• api.AuthBaseURL() canonicalises to match tokenmanager's internal normalisation (lowercase scheme/host, strip default port, drop path/query/fragment), so the keyring key login wrote matches the one the manager later reads byte-for-byte.
• bearerTransport omits the Authorization header when the bearer is empty rather than sending a malformed "Authorization: Bearer ". This preserves recap's "let the server return a typed 401" UX without exposing a malformed header.
• --insecure-http-auth is threaded through both the deviceflow client (auth.NewClient(httpClient, allowInsecureHTTP)) and the tokenmanager (auth.EnableInsecureHTTP() setter), so split-host local-dev on plain HTTP works end-to-end. Loopback hosts remain permitted unconditionally either way.

Code quality

• New api.OriginOnly / api.NormalizeOriginURL helpers replace what would have been three copy-paste sites for stripping URLs to their origin (in search_cmd.go's search-host resolution, login.go's iss comparison, and api.AuthBaseURL).
• newAuthHostAPIClient(token) deduplicates the auth-token management endpoint construction across status/list/revoke/logout.

Test plan

• mise run fmt && mise run lint → 0 issues.
• mise run test — 5294 unit tests pass, 3 skipped.
• mise run test:integration — 348 integration tests pass.
• mise run test:ci — full CI (unit + integration + Vogon canary) exit 0.
• Manual: verify split-host deployment against the partial.to staging environment (ENTIRE_AUTH_BASE_URL=https://us.auth.partial.to, ENTIRE_API_BASE_URL=https://partial.to) — entire login, entire trail list, entire dispatch should all exchange through the STS endpoint.
• Manual: verify entire login --insecure-http-auth against a non-loopback http auth host (e.g. ENTIRE_AUTH_BASE_URL=http://devbox.internal:8787) — previously failed with ErrInsecureBaseURL; should now complete.
• Manual: verify entire recap when logged out — the request should reach the server (no Authorization header) and recap should render its "sign in" message rather than a transport error.
• Manual: verify entire login with a non-canonical issuer (ENTIRE_AUTH_BASE_URL=https://AUTH.example.com:443/) — the saved keyring entry should be readable by subsequent entire trail list / entire status etc. (no spurious "not logged in").

Related work

• Reference: this is a fresh implementation of #1153's integration on top of auth-go PR #5's hardening. Once auth-go PR use strings.Contains #5 ships as v0.2.0, the go.mod pseudo-version should bump to the released tag.

🤖 Generated with Claude Code

---

Note

High Risk
Touches authentication, token storage, STS exchange, and every data-API command; misconfiguration or exchange bugs would cause widespread login/API failures.

Overview
Replaces the CLI’s inline OAuth stack with github.com/entireio/auth-go, adding split-host support via ENTIRE_AUTH_BASE_URL (auth issuer / keyring key) separate from ENTIRE_API_BASE_URL (data API). Data-plane commands now resolve bearers through auth.TokenForResource (RFC 8693 exchange when the stored token’s audience doesn’t match the resource); ENTIRE_AUTH_PROVIDER_VERSION (v1/v2) centralizes device-flow, STS, and auth-token paths.

Login & storage: device flow is a shim over deviceflow.Client; tokens are keyed by canonical api.AuthBaseURL(); login validates JWTs (reject alg:none, iss match, not pre-expired) and prefers verification_uri_complete for the browser URL.

API clients: NewAuthenticatedAPIClient takes context.Context and uses exchange; auth token list/revoke hit api.BaseURL() with WithAuthTokensPath from the provider table; empty bearer omits Authorization (recap logged-out path).

Commands: activity, search (+ --insecure-http-auth), dispatch cloud mode, recap, trail/watch, and dispatch wizard thread context and the new token path; recap no longer mislabels exchange/keyring failures as keyring-only errors.

^{Reviewed by Cursor Bugbot for commit d1f0497. Configure here.}

[Copilot]

Pull request overview

This pull request migrates the CLI’s authentication flow to the shared github.com/entireio/auth-go library, adds split-host auth configuration (ENTIRE_AUTH_BASE_URL), and enables RFC 8693 token exchange so data-API calls can transparently obtain resource-scoped bearer tokens in split-host deployments.

Changes:

• Integrate auth-go (device flow + token manager) and route data-API callers through auth.TokenForResource(ctx, resource).
• Add split-host configuration via api.AuthBaseURL() (with canonicalization) and provider routing (ENTIRE_AUTH_PROVIDER_VERSION).
• Harden request behavior and UX (omit empty Authorization header; validate received JWTs and reject alg:none; centralize auth-tokens endpoint routing).

Reviewed changes

Copilot reviewed 30 out of 32 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
go.mod	Bumps Go version and adds github.com/entireio/auth-go dependency.
go.sum	Adds checksums for auth-go.
cmd/entire/cli/api_client.go	Updates authenticated client construction to use token exchange via TokenForResource.
cmd/entire/cli/api/base_url.go	Adds ENTIRE_AUTH_BASE_URL + origin canonicalization helpers.
cmd/entire/cli/api/base_url_test.go	Adds tests for auth base URL fallback and canonicalization.
cmd/entire/cli/api/client.go	Adds auth-tokens base-path support; omits Authorization header when token is empty.
cmd/entire/cli/api/client_test.go	Tests omission of Authorization header for empty bearer.
cmd/entire/cli/api/auth_tokens.go	Routes auth-token management endpoints via configurable base path.
cmd/entire/cli/api/auth_tokens_test.go	Updates tests to set auth-tokens base path.
cmd/entire/cli/auth.go	Checks both data/auth origins for HTTPS; centralizes auth-host API client construction.
cmd/entire/cli/auth/client.go	Replaces inline device-flow logic with auth-go/deviceflow shim and OAuth error parsing.
cmd/entire/cli/auth/client_test.go	Adds tests for OAuth error parsing, expiry computation, and insecure HTTP allowances.
cmd/entire/cli/auth/exchange.go	Adds tokenmanager singleton wiring + TokenForResource/Token shims and insecure HTTP override.
cmd/entire/cli/auth/exchange_test.go	Tests insecure HTTP override flag behavior.
cmd/entire/cli/auth/provider.go	Adds provider routing table and one-time provider selection.
cmd/entire/cli/auth/provider_test.go	Tests provider resolution and test override hook.
cmd/entire/cli/auth/store.go	Implements tokenstore.Store and keys tokens by api.AuthBaseURL().
cmd/entire/cli/login.go	Threads insecure HTTP into auth client; validates received tokens; surfaces error_description.
cmd/entire/cli/login_validate_test.go	Adds unit tests for received-token validation behavior.
cmd/entire/cli/logout.go	Routes revocation/logout to auth host (AuthBaseURL) and provider-routed auth-tokens path.
cmd/entire/cli/recap.go	Resolves resource-scoped bearer via token exchange; preserves logged-out “send request without auth header” path.
cmd/entire/cli/search_cmd.go	Uses token exchange for search bearer; defaults service host to api.BaseURL().
cmd/entire/cli/activity_cmd.go	Threads ctx into authenticated client creation.
cmd/entire/cli/dispatch_wizard.go	Threads ctx into authenticated client creation.
cmd/entire/cli/dispatch/mode_local.go	Switches dispatch auth wiring to resource-scoped token lookup.
cmd/entire/cli/dispatch/mode_cloud.go	Uses token exchange for dispatch bearer; wires insecure HTTP override.
cmd/entire/cli/dispatch/mode_cloud_test.go	Updates cloud mode tests to stub resource token lookup.
cmd/entire/cli/dispatch/dispatch_test.go	Updates tests for new “not logged in” sentinel behavior.
cmd/entire/cli/trail_cmd.go	Threads ctx into authenticated client creation.
cmd/entire/cli/trail_watch_cmd.go	Threads ctx into authenticated client creation.

Comments suppressed due to low confidence (1)

cmd/entire/cli/recap.go:200

• auth.TokenForResource is called with api.BaseURL(). If ENTIRE_API_BASE_URL is set to a URL with a path component, token resolution may fail because the token manager expects an origin-only resource URL. Consider passing api.OriginOnly(api.BaseURL()) here (and using the same origin-only value for the later RequireSecureURL check) to make recap robust to path-bearing base URLs.

func newRecapClient(ctx context.Context, insecureHTTP bool) (*api.Client, error) {
	if insecureHTTP {
		auth.EnableInsecureHTTP()
	}
	token, err := auth.TokenForResource(ctx, api.BaseURL())
	if errors.Is(err, auth.ErrNotLoggedIn) {
		token = ""
		err = nil
	}
	if err != nil {
		return nil, &keyringReadError{Cause: err}
	}
	if token != "" && !insecureHTTP {
		if err := api.RequireSecureURL(api.BaseURL()); err != nil {
			return nil, fmt.Errorf("base URL check: %w", err)

[khaong]

Pushed 61671af19: merged origin/main into the branch and bumped auth-go from the pre-release v0.1.1-0.20260520123811-da94c52ef430 to the v0.3.3 release tag.

The intermediate v0.3.x releases deliver three fixes the entire CLI's split-host (us.auth.entire.io issuer, entire.io data API) deployment depends on:

• v0.3.1 (auth-go #6) — HTTP Basic Auth for the token-exchange grant. zitadel-oidc reads client credentials only from Authorization: Basic on this grant, not the form body, so the prior form-only request shape was rejected with invalid_client.
• v0.3.2 (auth-go #7) — default SubjectTokenType to :access_token. zitadel-oidc's STS validator only handles :access_token / :refresh_token / :id_token; :jwt silently falls through and surfaces as subject_token is invalid even when the underlying token is a perfectly valid signed JWS access token.
• v0.3.3 (auth-go #8) — default Audience to Resource when caller didn't set it. zitadel-OIDC-backed servers (entire-core) reject token-exchange requests without an explicit audience form field with invalid_target: audience is required.

End-to-end verified against us.auth.entire.io: entire login, entire search, entire activity all succeed.

Note on scope: entire auth status / auth list / auth revoke / logout (server-side revoke) on v2 split-host still need a separate audience-correctness fix — they currently send the raw keyring token (auth-host audience) to the data host, which 401s. That refactor is on a follow-up PR: soph/auth-status-followup (PR coming). v1 single-host is unaffected since there's no audience mismatch possible.

🤖 Generated with Claude Code

[khaong]

bugbot run

[khaong]

bugbot run

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit d1f0497. Configure here.}