The non-interactive `login_with_credentials` path already speaks to
`AuthServiceClient` via gRPC. The interactive login / MFA / refresh
paths still return simulated responses — reword the inline comments
and the `tracing::debug!` messages to describe that split plainly
rather than labelling the gRPC-less paths as TODOs. The SECURITY
warn!() lines are untouched so the runtime signal remains.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Replace simulated login in fxt CLI with real AuthServiceClient gRPC call
- Add auth proto to fxt build.rs compile list and lib.rs proto module
- Add api.access permission to JWT claims issued by AuthGrpcService
- Remove orphaned ci-sensor.yaml (replaced by cluster-applied version)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Flip 4 positions in the base64 payload instead of 1 to eliminate
any chance of environmental flakiness from OsRng contention.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The fxt client was using a hardcoded dev fallback secret for JWT signing,
causing InvalidSignature errors against the API gateway. Now reads
jwt_secret from ~/.foxhunt/config.toml with fallback chain:
env var > config file > dev secret.
Also updates default api_gateway_url to https://api.fxhnt.ai.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
test_machine_id_derivation reads /etc/machine-id which doesn't exist
in container environments.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Move 17 library crates into crates/, CLI binary into bin/fxt,
consolidate 10 test crates into testing/, split config crate
from deployment config files.
Root directory reduced from 38+ to ~17 directories.
All Cargo.toml paths and build.rs proto refs updated.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>