feat: auth status

[alukach]

Stacked on #24 (feat/product-commands). Retarget to main once #24 merges.

Rebuilt on #24, under auth (#24 moved login to auth login). Replaces this PR's earlier top-level source-coop status.

What

source-coop auth status reports, for one environment and role, whether you're logged in, as whom, and when things expire:

Environment    production (https://data.source.coop)
Login          logged in
Account        Anthony Lukach (alukach)
Refresh token  yes
ID token       expires 2026-10-13T18:00:00Z
Access token   for https://source.coop, expires 2026-10-13T18:00:00Z
Credentials    _default: expire 2026-10-13T18:30:00Z

• Who's logged in: auth login now asks the API's /whoami who the new access token acts as (new --api-url / SOURCE_API_URL) and keeps the account in the session (Session.account, optional, so old sessions still load). auth status names it without going to the network. A failed lookup is noted at login, not an error. A session from before this says "unknown until your next auth login".

• Layout: one row per item, like product view. On a terminal (and without NO_COLOR) labels are dim, the login state is green or red, the account ID is gray, and a past expiry is yellow.

• Reads the cache only: nothing is refreshed and nothing goes over the network. It always exits 0.

• --proxy-url / SOURCE_PROXY_URL and --role-arn / SOURCE_ROLE_ARN pick the environment and role, as for creds. The keyring can't list its entries, so it reports on one of each.

• The report is a pure function (status_report), so it's unit-tested without the keyring.

• README has a "Checking login status" section. every_command_is_in_the_readme requires it.

Testing

• status_names_who_is_logged_in, status_says_when_the_account_is_unknown_or_nobody_is_logged_in, status_colours_labels_and_the_login_state, the_account_comes_from_whoami, and login_looks_up_the_account_only_with_an_access_token (wiremock).
• cargo fmt, cargo clippy --all-targets -- -D warnings, cargo test and cargo test --features staging: 93 passed.
• Ran auth status with HOME in a scratch folder, so the real keychain was never read: "not logged in" / "no cached credentials".

🤖 Generated with Claude Code

[claude]

Claude finished @alukach's task in 18s —— View job

---

✅ No blocking issues — safe to merge.

I read the diff against origin/feat/product-commands but didn't build or run the tests.

• Compatibility: The new session fields use #[serde(default)], so old stored sessions still load.
• Failure handling: A failed /whoami lookup is only noted at login and doesn't fail it. auth status makes no network calls and always exits 0.
• Docs: The README documents SOURCE_REFRESH_TOKEN_LIFETIME and --api-url / SOURCE_API_URL.
• Expiry estimate: The refresh-token expiry is a client-side estimate. After the estimated date the row turns yellow "expired" while Login still shows green "logged in". That is acceptable because the README says it is an estimate. Wording such as "estimated" in the row would avoid a false alarm.

Simplify (ponytail)

• src/main.rs, status_report: eight positional args plus #[allow(clippy::too_many_arguments)]. Pass &StatusArgs and the Option<Env> instead of separate proxy_url, env and role_arn.
• src/main.rs, refresh_lifetime(): returns (i64, String), and the String is never used (status_report ignores .1). Return just the i64. This also drops the tuple type on the refresh_lifetime parameter.
• src/main.rs, relative() / expiry(): the manual DateTime::from_timestamp round-trips can share one helper. expiry and rfc3339 both format the same timestamp.
• src/oidc.rs, refresh_expires_in and Session.refresh_token_expires_at: no code path here sets it from the current provider (Ory sends none). Cut both until a provider needs them, along with the test branch that covers them.

---

💰 Estimated review cost: $0.16 · 0m18s · 5 turns

[alukach]

Superseded by #46 (auth commands: login, status, logout, token), built on #45 instead of #24. The branch is kept.