Pin AuthBaseURL default to https://us.auth.entire.io

[Soph]

https://entire.io/gh/entireio/cli/trails/453

Closes ENT-733.

Summary

• AuthBaseURL() now defaults to https://us.auth.entire.io when ENTIRE_AUTH_BASE_URL is unset, instead of inheriting from BaseURL().
• This implicitly flips effectiveProviderVersion() to v2 for fresh installs — the OIDC surface us.auth.entire.io serves and the existing split-host auto-detect already maps to.
• Inheriting from BaseURL() was only meaningful in the v1 world where a single host served both data and auth. With v1 going away, the fallback would have pointed auth at a URL that doesn't speak OAuth.

Behaviour change

Setup	Before	After
No env vars	Single-host on entire.io (v1)	Split-host: data entire.io, auth us.auth.entire.io (v2)
ENTIRE_API_BASE_URL=http://localhost:8787 only	Single-host on localhost	Split-host: data localhost, auth us.auth.entire.io ⚠️
Both env vars set	Works	Works

Local-dev and explicit single-host deployments must now set both ENTIRE_API_BASE_URL and ENTIRE_AUTH_BASE_URL.

Test plan

• go test ./... passes
• mise run lint passes
• Verify a fresh entire login against production talks to us.auth.entire.io
• Verify local-dev with both env vars set still works end-to-end

🤖 Generated with Claude Code

---

Note

High Risk
Changes default login/OAuth endpoints and provider version for all installs without env overrides; local-dev setups that only set ENTIRE_API_BASE_URL will point auth at production until both vars are set.

Overview
Default auth host is now https://us.auth.entire.io when ENTIRE_AUTH_BASE_URL is unset, instead of reusing the data API base from BaseURL(). Production defaults are split-host: data on entire.io, auth on us.auth.entire.io.

That makes unset-env installs split-host (IsSplitHost() true) and effectiveProviderVersion() → v2 (OIDC paths on the auth host). v1 remains only when both origins are explicitly the same host. Local dev or single-host setups must set both ENTIRE_API_BASE_URL and ENTIRE_AUTH_BASE_URL (setting only the data URL no longer collapses auth onto that host).

Tests and comments were updated for the new fallback, split-host defaults, and keyring lookup keyed by AuthBaseURL().

^{Reviewed by Cursor Bugbot for commit 54d7515. Configure here.}

[Copilot]

Pull request overview

Pins the default AuthBaseURL() to https://us.auth.entire.io instead of inheriting from BaseURL(), making fresh installs split-host and provider-v2 by default. Tests and surrounding comments are updated to reflect the new fallback semantics.

Changes:

• AuthBaseURL() falls back to a new DefaultAuthBaseURL constant instead of BaseURL().
• Provider auto-detect now resolves to v2 for unset env vars (split-host default); related tests/comments updated.
• Tests for IsSplitHost, AuthBaseURL, and LookupCurrentToken updated to set both URLs explicitly where needed.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
cmd/entire/cli/api/base_url.go	Adds DefaultAuthBaseURL and changes AuthBaseURL() fallback to it
cmd/entire/cli/api/base_url_test.go	Updates fallback and split-host expectations to new defaults
cmd/entire/cli/auth/provider.go	Updates comment explaining v2 as the new default
cmd/entire/cli/auth/provider_test.go	Renames and inverts default-version test from v1 to v2
cmd/entire/cli/auth/store.go	Updates doc comment for LookupCurrentToken
cmd/entire/cli/auth/store_test.go	Sets both API and auth base URLs in TestLookupCurrentToken
cmd/entire/cli/auth.go	Updates comment on requireSecureBaseURL