feat(auth): upgrade legacy CLI tokens automatically (#143)

* feat(auth): upgrade legacy CLI tokens automatically

Detect the API's cli_token_upgrade_required 422 response, call the CLI token upgrade endpoint, persist the returned token/expires_at while preserving legacy local metadata, and retry the original authenticated operation once.

Apply the flow to org lookup, session publication create/confirm, and backfill completion sync. Login exchange now tolerates the provider-neutral response without a GitHub login, and tests cover upgrade success, failure, non-upgrade 422s, retry capping, and config persistence.

* chore: bump version to 2.6.2

Author: codesoda

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "2.6.1"
+  ".": "2.6.2"
 }

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "cadence-cli"
-version = "2.6.1"
+version = "2.6.2"
 edition = "2024"
 default-run = "cadence"
 

Cargo.toml

@@ -16,10 +16,12 @@ use crate::transport;
 // ---------------------------------------------------------------------------
 
 const AUTH_EXCHANGE_PATH: &str = "/api/auth/exchange";
+const AUTH_TOKEN_UPGRADE_PATH: &str = "/api/auth/token/upgrade";
 const AUTH_REVOKE_PATH: &str = "/api/auth";
 const BACKFILL_COMPLETE_PATH: &str = "/api/onboarding/backfill-complete";
 const USER_ORGS_PATH: &str = "/api/user/orgs";
 const SESSION_PUBLICATION_CREATE_PATH: &str = "/api/v2/session-publications";
+const TOKEN_UPGRADE_REQUIRED_ERROR: &str = "cli_token_upgrade_required";
 
 // ---------------------------------------------------------------------------
 // Response DTOs
@@ -36,8 +38,9 @@ struct ExchangeRequest<'a> {
 pub struct CliTokenExchangeResult {
     /// Bearer token used by the CLI for authenticated API calls.
     pub token: String,
-    /// GitHub login associated with the authenticated user.
-    pub login: String,
+    /// Legacy GitHub login, returned by older API versions.
+    #[serde(default)]
+    pub login: Option<String>,
     /// RFC 3339 expiration timestamp for the token.
     pub expires_at: String,
 }
@@ -73,10 +76,15 @@ pub struct BackfillCompleteResponse {
 /// Minimal org info from `GET /api/user/orgs`.
 #[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
 pub struct UserOrgInfo {
-    /// GitHub organization id for the account.
-    pub github_org_id: i64,
-    /// GitHub login for the org or personal account.
-    pub github_org_login: String,
+    /// Legacy GitHub organization id for the account, returned by older API versions.
+    #[serde(default)]
+    pub github_org_id: Option<i64>,
+    /// Provider-specific slug for the org or personal account.
+    #[serde(default, alias = "org_slug")]
+    pub github_org_login: Option<String>,
+    /// Provider that owns this org slug. Missing means legacy GitHub-shaped API response.
+    #[serde(default)]
+    pub provider: Option<String>,
     /// Display name shown to the user, when available.
     pub display_name: Option<String>,
     /// Whether this record represents the user's personal account.
@@ -164,6 +172,8 @@ struct ApiResponseEnvelope<T> {
 pub enum AuthenticatedRequestError {
     /// Authentication failed or the token has expired.
     Unauthorized,
+    /// The API requires this CLI token to be upgraded before retrying.
+    TokenUpgradeRequired(String),
     /// The request conflicted with current server state.
     Conflict(String),
     /// The target resource could not be found.
@@ -186,6 +196,7 @@ impl std::fmt::Display for AuthenticatedRequestError {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         match self {
             Self::Unauthorized => write!(f, "unauthorized"),
+            Self::TokenUpgradeRequired(msg) => write!(f, "token_upgrade_required: {msg}"),
             Self::Conflict(msg) => write!(f, "conflict: {msg}"),
             Self::NotFound => write!(f, "not_found"),
             Self::Unprocessable(msg) => write!(f, "unprocessable: {msg}"),
@@ -271,6 +282,34 @@ impl ApiClient {
         Ok(envelope.data)
     }
 
+    /// Upgrade an existing CLI token to the current API JWT shape.
+    pub async fn upgrade_cli_token(
+        &self,
+        token: &str,
+        timeout: Duration,
+    ) -> std::result::Result<CliTokenExchangeResult, AuthenticatedRequestError> {
+        let url = self.url(AUTH_TOKEN_UPGRADE_PATH);
+        let resp = self
+            .client
+            .post(&url)
+            .bearer_auth(token)
+            .timeout(timeout)
+            .send()
+            .await
+            .map_err(map_network_error)?;
+
+        if !resp.status().is_success() {
+            let status = resp.status().as_u16();
+            let body = resp.text().await.unwrap_or_default();
+            return Err(map_authenticated_http_error(status, &body));
+        }
+
+        let body = resp.text().await.map_err(map_network_error)?;
+        let envelope: ApiResponseEnvelope<CliTokenExchangeResult> = serde_json::from_str(&body)
+            .map_err(|e| AuthenticatedRequestError::Parse(e.to_string()))?;
+        Ok(envelope.data)
+    }
+
     /// Revoke a bearer token via `DELETE /api/auth`.
     pub async fn revoke_token(
         &self,
@@ -505,6 +544,9 @@ fn map_authenticated_http_error(status: u16, body: &str) -> AuthenticatedRequest
         400 => AuthenticatedRequestError::BadRequest(detail),
         404 => AuthenticatedRequestError::NotFound,
         409 => AuthenticatedRequestError::Conflict(detail),
+        422 if extract_error_code(body).as_deref() == Some(TOKEN_UPGRADE_REQUIRED_ERROR) => {
+            AuthenticatedRequestError::TokenUpgradeRequired(detail)
+        }
         422 => AuthenticatedRequestError::Unprocessable(detail),
         500..=599 => AuthenticatedRequestError::Server(detail),
         _ => AuthenticatedRequestError::Unexpected(format!("HTTP {status}: {detail}")),
@@ -565,6 +607,12 @@ fn extract_error_message(body: &str) -> String {
     }
 }
 
+fn extract_error_code(body: &str) -> Option<String> {
+    serde_json::from_str::<serde_json::Value>(body)
+        .ok()
+        .and_then(|value| value.get("error")?.as_str().map(ToString::to_string))
+}
+
 // ---------------------------------------------------------------------------
 // Tests
 // ---------------------------------------------------------------------------
@@ -596,6 +644,13 @@ mod tests {
             map_authenticated_http_error(422, ""),
             AuthenticatedRequestError::Unprocessable(_)
         ));
+        assert!(matches!(
+            map_authenticated_http_error(
+                422,
+                r#"{"error":"cli_token_upgrade_required","message":"upgrade me"}"#
+            ),
+            AuthenticatedRequestError::TokenUpgradeRequired(_)
+        ));
         assert!(matches!(
             map_authenticated_http_error(404, ""),
             AuthenticatedRequestError::NotFound
@@ -606,6 +661,44 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn cli_token_exchange_result_allows_missing_legacy_login() {
+        let envelope: ApiResponseEnvelope<CliTokenExchangeResult> = serde_json::from_str(
+            r#"{"data":{"token":"token","expires_at":"2099-01-01T00:00:00Z"}}"#,
+        )
+        .expect("parse token exchange envelope");
+
+        assert_eq!(envelope.data.token, "token");
+        assert_eq!(envelope.data.login, None);
+        assert_eq!(envelope.data.expires_at, "2099-01-01T00:00:00Z");
+    }
+
+    #[test]
+    fn user_orgs_response_allows_current_api_org_slug_shape() {
+        let envelope: ApiResponseEnvelope<UserOrgsResponse> = serde_json::from_str(
+            r#"{"data":{"orgs":[{
+                "org_slug":"cadence-org",
+                "provider":"github",
+                "display_name":"Cadence Org",
+                "avatar_url":"https://example.test/avatar.png",
+                "is_personal":false,
+                "is_onboarded":true,
+                "has_active_installation":true,
+                "org_id":"org-1",
+                "role":"manager",
+                "onboarding_hint":"ready"
+            }]}}"#,
+        )
+        .expect("parse current user orgs envelope");
+
+        let org = &envelope.data.orgs[0];
+        assert_eq!(org.github_org_id, None);
+        assert_eq!(org.github_org_login.as_deref(), Some("cadence-org"));
+        assert_eq!(org.provider.as_deref(), Some("github"));
+        assert_eq!(org.org_id.as_deref(), Some("org-1"));
+        assert!(org.has_active_installation);
+    }
+
     #[test]
     fn session_upload_request_serializes_upload_sha256_field() {
         let request = CreateSessionPublicationRequest {

src/api_client.rs

@@ -143,6 +143,22 @@ impl CliConfig {
         self.save().await
     }
 
+    /// Replace the auth token lifecycle fields and save.
+    ///
+    /// Preserves `api_url`, legacy `github_login`, and non-auth settings. The
+    /// login field is retained only as legacy local display metadata because
+    /// current API tokens are tied to Cadence user IDs, not provider logins.
+    pub async fn replace_auth_token(&mut self, token: String, expires_at: String) -> Result<()> {
+        self.replace_auth_token_fields(token, expires_at);
+        self.save().await
+    }
+
+    /// Replace in-memory token lifecycle fields without saving.
+    pub(crate) fn replace_auth_token_fields(&mut self, token: String, expires_at: String) {
+        self.token = Some(token);
+        self.expires_at = Some(expires_at);
+    }
+
     /// Returns the persisted auth token when present and non-empty.
     pub fn auth_token(&self) -> Option<String> {
         non_empty_trimmed(self.token.clone())
@@ -462,6 +478,17 @@ impl CliConfig {
         self.expires_at = None;
         self.save_to(path).await
     }
+
+    /// Replace token lifecycle fields and save to a specific path.
+    async fn replace_auth_token_to(
+        &mut self,
+        path: &Path,
+        token: String,
+        expires_at: String,
+    ) -> Result<()> {
+        self.replace_auth_token_fields(token, expires_at);
+        self.save_to(path).await
+    }
 }
 
 // ---------------------------------------------------------------------------
@@ -744,6 +771,36 @@ mod tests {
         assert_eq!(cfg.token, None);
     }
 
+    #[tokio::test]
+    async fn test_replace_auth_token_preserves_api_url_and_legacy_login() {
+        let tmp = TempDir::new().unwrap();
+        let path = config_path_in(tmp.path());
+
+        let mut cfg = CliConfig {
+            api_url: Some("https://api.example.com".to_string()),
+            token: Some("old-token".to_string()),
+            github_login: Some("legacy-login".to_string()),
+            expires_at: Some("2025-01-01T00:00:00Z".to_string()),
+            update_check_interval: Some("8h".to_string()),
+            ..Default::default()
+        };
+
+        cfg.replace_auth_token_to(
+            &path,
+            "new-token".to_string(),
+            "2026-01-01T00:00:00Z".to_string(),
+        )
+        .await
+        .unwrap();
+
+        let loaded = CliConfig::load_from(&path).await.unwrap();
+        assert_eq!(loaded.api_url, Some("https://api.example.com".to_string()));
+        assert_eq!(loaded.token, Some("new-token".to_string()));
+        assert_eq!(loaded.github_login, Some("legacy-login".to_string()));
+        assert_eq!(loaded.expires_at, Some("2026-01-01T00:00:00Z".to_string()));
+        assert_eq!(loaded.update_check_interval, Some("8h".to_string()));
+    }
+
     #[tokio::test]
     async fn test_auth_token_trims_value() {
         let cfg = CliConfig {