feat: multi-profile authentication

[Zious11]

Summary

Lets jr target multiple Atlassian Cloud sites from one install, with jr auth switch <profile> to flip between them. Shared classic API token across profiles (account-level credential authenticates the same user against any Atlassian site), per-profile OAuth tokens (cloudId-scoped, not transferable). Auto-migration of legacy single-instance configs; lazy keyring migration for OAuth tokens.

Highlights:

• New CLI surface: jr auth login --profile <N> --url <U>, jr auth switch <N>, jr auth list, jr auth logout [--profile N], jr auth remove <N>, jr auth status [--profile N], jr auth refresh [--profile N]. New global --profile <N> flag.
• Config schema: [profiles.<name>] table-of-tables + default_profile field. Legacy [instance]/[fields] blocks read for migration only and no longer serialized.
• Keyring layout: shared email/api-token/oauth_client_* keys + per-profile <profile>:oauth-access-token/<profile>:oauth-refresh-token. Lazy migration of pre-existing flat OAuth keys to default:* on first read.
• Cache layout: ~/.cache/jr/v1/<profile>/ per-profile subdirectory; legacy flat files orphan via path versioning (no migration code, matches pip/cargo/npm convention).
• Profile name validation: [A-Za-z0-9_-]{1,64}, plus rejects Windows reserved names (CON, NUL, AUX, PRN, COM1-9, LPT1-9) cross-platform for portable configs.

Backward Compatibility

For typical CLI users: effectively non-breaking. Existing commands (jr auth login, auth status, auth refresh, all flags) continue to work unchanged. The first run after upgrading auto-migrates the config (one stderr notice, idempotent). API tokens are preserved as-is; OAuth tokens lazy-migrate on first read.

Structurally breaking for direct consumers of jr's internal state:

• ~/.config/jr/config.toml shape changes from [instance] to [profiles.default] after first migration
• OS keychain entry names change from oauth-access-token to default:oauth-access-token after lazy migration
• Cache directory layout changes from ~/.cache/jr/*.json to ~/.cache/jr/v1/<profile>/*.json (old files orphan harmlessly)

Squash-merge guidance: add a BREAKING CHANGE: footer to the merge commit so the change is captured in conventional-commits-aware tooling and changelog generation:

BREAKING CHANGE: config.toml schema, OS keychain key names, and cache
directory layout have all changed shape. Existing users are migrated
automatically on first `jr` invocation after upgrading; scripts that
parse jr's internal state directly (config TOML, keychain entries,
cache files) need updating to the new shapes.

We're at 0.5.0-dev.3 (pre-1.0), so semver allows the change in a 0.6.0 minor bump.

Implementation

Spec: docs/specs/multi-profile-auth.md
Plan: docs/superpowers/plans/2026-04-24-multi-profile-auth.md

16 TDD tasks landed as 18 commits (foundation → keyring → cache → client → CLI surface → migration → cleanup → docs). Each commit is green and bisectable. Dual-shape transition kept legacy fields readable until Task 16 stopped serializing them.

Design decisions validated via Perplexity at every step: kubectl-style shared users + per-host caches, gh-style consolidated auth subcommand surface, pip/cargo-style versioned cache root for migration, AWS-style per-profile field duplication, lazy/opportunistic keyring migration vs upfront TOML migration.

Test Plan

• cargo fmt --all -- --check passes
• cargo clippy --all-targets -- -D warnings passes
• cargo test — 957 tests pass (was 918 before this branch; 39 new)
• JR_RUN_KEYRING_TESTS=1 cargo test --lib api::auth -- --ignored opt-in keyring round-trip + lazy migration tests gated for CI portability
• Spec + plan committed before implementation
• Each task implemented TDD (red → green → commit)
• README + CLAUDE.md updated to reflect new CLI surface, config schema, cache path, and agent-relevant env vars

Out of Scope (tracked as follow-ups)

• jr profile subcommand tree (consolidated under jr auth per gh precedent)
• Profile renaming (login + remove workaround)
• Per-repo .jr.toml profile pinning (use direnv with JR_PROFILE)
• KeyringProvider trait abstraction for testability/CI portability
• Atomic Config::save_global (tempfile + rename)
• Bulk-clear command for shared credentials
• tests/migration_legacy.rs mutates process-global XDG_CONFIG_HOME; passes individually but flakes under parallel test execution. Worth either gating with serial_test or scoping the env-var contract more tightly in a follow-up.

[Copilot]

Pull request overview

Adds multi-profile authentication to jr, enabling multiple Atlassian Cloud sites per install with profile-aware config, keyring entries, and caches.

Changes:

• Introduces new config schema (default_profile + [profiles.<name>]) with legacy [instance]/[fields] migration.
• Namespaces OAuth tokens and caches per profile (<profile>:oauth-* in keyring, ~/.cache/jr/v1/<profile>/ on disk).
• Expands jr auth CLI surface (switch/list/logout/remove/status/refresh) and adds a global --profile flag.

Reviewed changes

Copilot reviewed 28 out of 28 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
src/config.rs	Adds profile schema/types, migration, active-profile resolution, and validation helpers.
src/api/auth.rs	Namespaces OAuth tokens by profile; adds clear helpers and lazy legacy-key migration.
src/cache.rs	Moves caches to per-profile v1/<profile> directories; updates cache APIs.
src/api/client.rs	JiraClient now consumes the active profile for URL/auth decisions.
src/cli/mod.rs	Adds global --profile and expands auth subcommands/flags.
src/main.rs	Wires --profile into config loading via JR_PROFILE_OVERRIDE.
src/cli/auth.rs	Implements multi-profile auth workflows (login/list/switch/logout/remove/status/refresh).
src/cli/init.rs	Attempts to make jr init multi-profile aware and update cache warming.
src/cli/team.rs	Threads active profile into team cache and org-id persistence.
src/cli/issue/* + src/api/assets/* + src/api/jsm/servicedesks.rs	Updates some cache calls, but several still hard-code "default".
tests/auth_profiles.rs	New integration tests for profile workflows and precedence.
tests/migration_legacy.rs	New integration tests for legacy config migration.
docs/specs/multi-profile-auth.md / docs/superpowers/plans/...	Spec + implementation plan for the feature.
src/output.rs	Adds print_warning() helper.
src/cli/snapshots/*.snap	Snapshot for jr auth list table rendering.

Comments suppressed due to low confidence (1)

src/cli/init.rs:87

• When jr init is adding a new profile, it sets JR_PROFILE_OVERRIDE but still calls login_oauth("default", ...) / login_token("default", ...). Since the login flows now namespace OAuth tokens and persist auth_method by the passed profile name, this will authenticate/update the wrong profile. Use the resolved active/override profile name (or thread profile_name through) instead of the hard-coded "default".

    if auth_choice == 0 {
        crate::cli::auth::login_oauth("default", None, None, false).await?;
    } else {
        crate::cli::auth::login_token("default", None, None, false).await?;
        let mut config = Config::load()?;
        config.global.instance.auth_method = Some("api_token".into());
        config.save_global()?;
    }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 28 out of 28 changed files in this pull request and generated 7 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 28 out of 28 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 28 out of 28 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 29 out of 29 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 29 out of 29 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 29 out of 29 changed files in this pull request and generated 4 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 29 out of 29 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

src/cache.rs:27

• Cache corruption warnings emitted by read_cache only mention the filename (e.g., teams.json) but not the profile namespace. With per-profile caches, this can be ambiguous when the user has multiple profiles (it's not obvious which ~/.cache/jr/v1/<profile>/... is affected). Consider including the profile (or full path) in the warning message so users can locate and delete the right cache directory.

fn read_cache<T: DeserializeOwned + Expiring>(profile: &str, filename: &str) -> Result<Option<T>> {
    let path = cache_dir(profile).join(filename);
    let content = match std::fs::read_to_string(&path) {
        Ok(c) => c,
        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(None),
        Err(e) => return Err(e.into()),
    };
    let cache: T = match serde_json::from_str(&content) {
        Ok(c) => c,
        Err(e) => {
            eprintln!("warning: cache file {filename} unreadable ({e}); will refetch");
            return Ok(None);

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 29 out of 29 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 29 out of 29 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.