auth: simplify auth/login UX — drop PATs, context-aware status & logout

[toothbrush]

https://entire.io/gh/entireio/cli/trails/495

Simplifies the entire auth surface and fixes a logout/status bug, building on #1337.

User impact

• entire auth status shows who you are (Name (@handle) <email> + provider identity from /me), the active context, and the active sessions on that core (NAME / CREATED / LAST USED / EXPIRES) — so the effect of logout / logout --all is visible. It queries the active context's login server, so auth use <ctx> retargets it.
• entire logout revokes your session server-side via entire-core against the active context's core (--all = every session on it) — exactly the sessions status lists. Previously hit entire.io's PAT endpoint and 400'd.
• entire auth contexts gets a table with headers + active marker.
• Removed entire auth list and entire auth revoke (they managed ent_ PATs, which are sunset, and by now unused by the CLI).

What changed

• All ent_ PAT machinery ripped out; session list/revoke target entire-core /api/auth/tokens on the active context's core, never entire.io's /api/v1/auth/tokens.
• api.Token → api.Session; added coreapi.NewWithBearer; newSessionsClient(coreURL, token).
• Hardened "token invalid → re-login" detection (incl. non-JSON 401s).

Screenshots

Not in this PR (follow-ups)

• The COR-389 core: silent JWT refresh on control-plane calls (contextTokenStore + RefreshPath into defaultManager) — untouched.
• Multi-core retargeting for the other control-plane commands (org/repo/project/grant via coreapi.New()) — still static AuthBaseURL. auth status + logout are retargeted here; the rest aren't.
• Minor: resolveAuthHostToken is now prod-unused (kept alive only by its tests) — prune candidate.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes authentication, session revocation, and multi-context core targeting for status/logout; mistakes could leave stale sessions or hit the wrong login server, though behavior is heavily tested.

Overview
This PR reframes CLI auth around entire-core login sessions instead of data-API PATs (ent_ tokens). It removes entire auth list / entire auth revoke and the api auth-token client; session list/revoke now goes through /api/auth/tokens on the active login server (api.Session, WithSessionsPath).

entire auth status resolves the active context’s CoreURL and session JWT (resolveStatusTarget), validates via GET /me (coreapi.NewWithBearer), prints profile + context, and shows an active sessions table aligned with logout behavior. Invalid-login detection is broadened (core 401, non-JSON 401 decode errors, STS failures).

entire logout revokes the current session (or all sessions on that core with --all) against the same target core, clears local credentials, then promoteNextLogin so repeated logout can drain saved contexts. RemoveAllContexts is dropped; entire auth contexts gets a styled table.

Provider AuthTokensPath routing is removed; OAuth provider config is unchanged aside from that.

^{Reviewed by Cursor Bugbot for commit f9b8c3e. Configure here.}

[Copilot]

Pull request overview

This PR simplifies the entire auth command surface by removing deprecated PAT management and shifting “status”/“logout” behavior to use entire-core session concepts, with better multi-context UX.

Changes:

• Removed auth list / auth revoke (PAT/token-management) and introduced core session management via /api/auth/tokens.
• Updated auth status to query GET /me on the active context’s core, printing user identity + active context details.
• Improved auth contexts output formatting and updated logout flow/tests (including --all server-side session revocation).

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
internal/coreapi/client.go	Adds NewWithBearer to query a specific core origin with a fixed bearer for context-aware status checks.
cmd/entire/cli/logout.go	Reworks logout messaging and server-side revocation to use sessions endpoints; adds context promotion behavior.
cmd/entire/cli/logout_test.go	Updates logout unit tests for new revoke paths and --all behavior.
cmd/entire/cli/auth/provider.go	Removes provider-level PAT endpoint configuration (AuthTokensPath).
cmd/entire/cli/auth/provider_test.go	Adjusts provider tests to match provider struct changes.
cmd/entire/cli/auth/contexts_test.go	Removes tests for deleted RemoveAllContexts behavior.
cmd/entire/cli/auth/context_store.go	Removes RemoveAllContexts; keeps context-preferring token read behavior and current-context deletion.
cmd/entire/cli/auth.go	Drops list/revoke subcommands; adds context-aware auth status via /me, introduces sessions client wiring + table helpers.
cmd/entire/cli/auth_test.go	Refactors auth tests to validate /me-based status behavior and broadened invalid-token detection.
cmd/entire/cli/auth_context.go	Renders auth contexts as a styled, aligned table with headers and active marker.
cmd/entire/cli/auth_context_test.go	Adds coverage for resolveStatusTarget preference + contexts table headers + logout promotion behavior.
cmd/entire/cli/api/sessions.go	Introduces Session API (list/revoke/current) against entire-core session endpoints.
cmd/entire/cli/api/sessions_test.go	Adds/updates tests for the new sessions API methods and paths.
cmd/entire/cli/api/client.go	Renames client path config from auth-tokens to sessions (WithSessionsPath).
cmd/entire/cli/api/auth_tokens.go	Removes the old PAT/auth-token management client implementation.

[toothbrush]

@cursor review

[Copilot]

Pull request overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 3 comments.

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit f9b8c3e. Configure here.}