[toothbrush]

https://entire.io/gh/entireio/cli/trails/1006

Why

https://auth.entire.io (entire-core global mode) now dispatches logins to the caller's regional core (https://github.com/entirehq/entiredb/pull/3135): identify-first 302 on /authorize, geo 307 on /device_authorization. That removes the main need for --server — but the apex serves no token endpoint, so the CLI must finish each flow against the region that actually minted the code.

What

• entire login defaults to https://auth.entire.io (--server stays for special cases).
• Browser flow reads the RFC 9207 iss from the loopback callback and exchanges the code at that regional host; device flow polls the origin that served the 307'd response.
• Token iss acceptance: exactly the dialled origin, or a strict https subdomain of it on the same port (us.auth.entire.io under auth.entire.io; auth.entire.io.evil.com, xauth.entire.io, scheme/port downgrades all rejected). The mismatch error only offers the subdomain shape when the dialled origin is https, since a plaintext dev/loopback server can never delegate.
• Success line prints the actual issuer when it differs from the dialled host. Existing logins unaffected: contexts/refresh already key off the persisted issuer.
• auth-go pinned to authcode, deviceflow: support region-dispatching authorization servers auth-go#20 by commit (v0.5.3-0.20260814125012-86c083be00da) — swap to tagged v0.5.3 once released.
• Go 1.26.5 → 1.26.6 (go.mod + mise.toml). Required: that auth-go commit raises its own minimum to 1.26.6. It also clears six stdlib advisories this CLI shares with auth-go — GO-2026-6218 (net/url), GO-2026-6090 + GO-2026-5856 (crypto/tls), GO-2026-6089 + GO-2026-5026 (net/http), GO-2026-5972 (encoding/asn1).

Verification

• mise run lint: 0 issues; go test ./cmd/entire/cli/ ./cmd/entire/cli/auth/ ./cmd/entire/cli/api/ pass on go1.26.6.
• New tests: login_issuer_test.go (issuer-rule table incl. hostile cases, plus the error-wording rule), auth/client_dispatch_test.go (httptest apex 307→regional device flow; loopback callback with iss → regional exchange; apex 404s everything else so a missed handoff fails loudly).
• Pre-deploy behaviour is a clean failure, not a hang: against the not-yet-live apex, entire login --device exits with start login: start device auth: status 404: 404 page not found.
• Rebased onto main after feat(login): add explicit URL actions #1961 landed the interactive login-URL prompt, which moved flow.Wait onto its own goroutine. Audited every exit path in waitForLoginURLResult: each returns via a waitCh receive, so the channel supplies the happens-before edge for the subsequent flow.Issuer() read. Device flow sets TokenBaseURL before the polling goroutine is spawned.
• Not verifiable until the server deploys: live apex 302/307 behavior and entire-cli client registration on non-us regions.

🤖 Generated with Claude Code

---

Note

High Risk
Changes authentication defaults, token endpoint targeting, and issuer delegation policy—security-critical paths with new subdomain trust rules that must not be bypassed by hostile redirects or callback iss values.

Overview
entire login now defaults to https://auth.entire.io instead of a regional host (us.auth.entire.io). The apex only redirects OAuth entry points and has no token endpoint, so the CLI must finish login against the regional core that actually mints tokens.

Device flow: after /device_authorization, the CLI uses ResponseOrigin and UseTokenIssuer so token polls hit the region that answered the redirect, not the apex.

Browser flow: it reads RFC 9207 iss on the loopback callback and redeems the authorization code at that regional host.

Trust rules: adoptIssuer / expanded issMatches allow the dialled apex or a strict HTTPS subdomain on the same port (e.g. us.auth.entire.io under auth.entire.io); lookalike domains, siblings, and HTTP downgrades are rejected. The same rule validates JWT iss before persistence. Success output names the real issuer when it differs from --server.

auth-go is pinned to a newer pre-release for ResponseOrigin and token-base URL overrides. README and upstream-host-resolution docs describe the apex-vs-region model; httptest coverage exercises apex→regional device and browser paths.

^{Reviewed by Cursor Bugbot for commit 3a24a0b. Configure here.}

[Copilot]

Pull request overview

Updates entire login to default to the apex auth host (https://auth.entire.io) and correctly complete OAuth flows against the regional core that actually issues tokens/codes, while enforcing a strict issuer-delegation policy to prevent hostile handoffs.

Changes:

• Default login server switched to https://auth.entire.io (dispatcher), with device and browser flows retargeting token exchange/polling to the regional issuer.
• Added issuer adoption + validation logic (adoptIssuer, enhanced issMatches) to allow only exact-origin or strict-HTTPS-subdomain delegation on the same port.
• Expanded unit + integration-style tests to cover apex→regional redirects, hostile issuer attempts, and success messaging/persistence behavior.

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
README.md	Updates local-dev guidance to reflect the new default dispatcher host.
go.mod	Bumps github.com/entireio/auth-go to a newer pseudo-version needed for dispatch support.
go.sum	Updates module checksums for the auth-go bump.
docs/architecture/upstream-host-resolution.md	Documents apex-dispatch vs regional-issuer behavior and the CLI’s issuer trust rules.
cmd/entire/cli/api/base_url.go	Changes DefaultAuthBaseURL to https://auth.entire.io and documents dispatcher semantics.
cmd/entire/cli/login.go	Implements issuer adoption/retargeting for device + browser flows and validates delegated issuers.
cmd/entire/cli/login_validate_test.go	Updates login-server parsing tests for the new default host.
cmd/entire/cli/login_test.go	Extends mocks/fakes to support new issuer-retargeting behavior.
cmd/entire/cli/login_issuer_test.go	Adds focused tests for issuer matching/adoption, retargeting, and success output.
cmd/entire/cli/auth/provider.go	Updates comments to describe fixed-path behavior and apex dispatch constraints.
cmd/entire/cli/auth/client.go	Adds token-issuer override support for device flow and exposes callback iss for browser flow.
cmd/entire/cli/auth/client_dispatch_test.go	Adds httptest-based end-to-end coverage for apex dispatch behavior in both flows.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.