From 20e6e08a42240aef0b36ecf627cbcde921912071 Mon Sep 17 00:00:00 2001
From: t <t@tjp.lol>
Date: Sat, 13 Jun 2026 14:24:31 -0600
Subject: auth: flatten [auth.<name>] config + ${...} substitution
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Collapse the auth schema: infer `type` from keys, replace key/key_env_var with
a single `key` (resolved via substitution), flatten the exchange to flat
`exchange_*` keys, and drop the auth-level headers tables in favor of reusing
the provider's `extra_headers` on the auth HTTP calls. Add `${sibling}` and
`${env:VAR}` substitution over auth values (GitHub Enterprise = set `domain`).
Restore api_key-empty → provider-drop. Update default config, docs, and tests.
---
 src/subcommand.zig | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

(limited to 'src/subcommand.zig')

diff --git a/src/subcommand.zig b/src/subcommand.zig
index b145d4b..bb46941 100644
--- a/src/subcommand.zig
+++ b/src/subcommand.zig
@@ -491,12 +491,22 @@ fn authLogin(
     defer panto.deinit();
     const client = panto.httpClient();
 
+    // The auth HTTP calls carry the identity headers of a provider that uses
+    // this session (e.g. Copilot's editor headers). 1:1 in practice; if no
+    // provider references it yet, send none.
+    const headers: []const panto.Header = blk: {
+        for (cfg.providers) |p| {
+            if (std.mem.eql(u8, p.auth_name, name)) break :blk p.extra_headers;
+        }
+        break :blk &.{};
+    };
+
     var arena = std.heap.ArenaAllocator.init(allocator);
     defer arena.deinit();
     const aa = arena.allocator();
 
     var presenter = CliPresenter{ .io = io };
-    const toks = panto.oauthLogin(aa, io, client, oauth, presenter.presenter()) catch |err| {
+    const toks = panto.oauthLogin(aa, io, client, oauth, presenter.presenter(), headers) catch |err| {
         try out.print("login failed: {t}\n", .{err});
         return;
     };
@@ -508,7 +518,7 @@ fn authLogin(
     // immediately usable and we surface any exchange error during login.
     if (oauth.exchange) |exchange| {
         if (ts.access_token) |access| {
-            ts.exchange = panto.runExchange(aa, client, exchange, access) catch |err| blk: {
+            ts.exchange = panto.runExchange(aa, client, exchange, access, headers) catch |err| blk: {
                 try out.print("note: token exchange failed ({t}); will retry on first use\n", .{err});
                 break :blk null;
             };
-- 
cgit v1.3