feat: Auto-configure customer context for DoiT employees on first login

New DoiT employees hit a 403 on `dci login` because the validate endpoint
requires a customerContext that hasn't been set yet. After OAuth succeeds
(token is always cached), inspect the JWT for the DoitEmployee claim and:
- Set default customerContext to doit.com automatically
- Show customer-context command in help for Doers
- Print a styled hint on 401/403 when a Doer has no context configured

Author: apgiorgi

main.go

@@ -2,8 +2,10 @@ package main
 
 import (
 	"embed"
+	"encoding/base64"
 	"encoding/json"
 	"fmt"
+	"io"
 	"io/fs"
 	"os"
 	"path/filepath"
@@ -169,9 +171,18 @@ func run() (exitCode int) {
 	brandRootCommand()
 	brandDCIRootCommand()
 	registerStatusCommands(configDir)
-	registerAuthCommands()
+	registerAuthCommands(configDir)
 	registerCustomerContextCommands(configDir)
 	registerSkillCommands()
+	// Unhide the customer-context command for DoiT employees so it appears in help.
+	if cachedTokenIsDoer() {
+		for _, c := range cli.Root.Commands() {
+			if c.Use == "customer-context" {
+				c.Hidden = false
+				break
+			}
+		}
+	}
 	addOutputFlag()
 	hideGlobalFlags()
 	customizeDCIUsage()
@@ -182,9 +193,12 @@ func run() (exitCode int) {
 
 	if err := cli.Run(); err != nil {
 		fmt.Fprintf(os.Stderr, "%v\n", err)
+		maybeHintDoerContext(1, configDir)
 		return 1
 	}
-	return cli.GetExitCode()
+	code := cli.GetExitCode()
+	maybeHintDoerContext(code, configDir)
+	return code
 }
 
 func rejectProfileFlags(args []string) error {
@@ -779,7 +793,86 @@ func authSource() string {
 	return "OAuth (DoiT Console)"
 }
 
-func registerAuthCommands() {
+// maybeHintDoerContext prints a targeted hint when a @doit.com user hits a 403
+// without a customer context set — covering both interactive and CI/CD usage.
+func maybeHintDoerContext(exitCode int, configDir string) {
+	status := cli.GetLastStatus()
+	if exitCode == 0 || (status != 401 && status != 403) {
+		return
+	}
+	if !cachedTokenIsDoer() {
+		return
+	}
+	if readCustomerContext(configDir) != "" {
+		return
+	}
+	if term.IsTerminal(int(os.Stderr.Fd())) {
+		fmt.Fprintln(os.Stderr, "")
+		fmt.Fprintf(os.Stderr, "\033[1;33m!\033[0m DoiT employees need a customer context for API calls.\n")
+		fmt.Fprintf(os.Stderr, "  Interactive:  \033[1mdci customer-context set doit.com\033[0m\n")
+		fmt.Fprintf(os.Stderr, "  CI/scripts:   \033[1mexport DCI_CUSTOMER_CONTEXT=doit.com\033[0m\n")
+		fmt.Fprintln(os.Stderr, "")
+	} else {
+		fmt.Fprintln(os.Stderr, "")
+		fmt.Fprintln(os.Stderr, "! DoiT employees need a customer context for API calls.")
+		fmt.Fprintln(os.Stderr, "  Interactive:  dci customer-context set doit.com")
+		fmt.Fprintln(os.Stderr, "  CI/scripts:   export DCI_CUSTOMER_CONTEXT=doit.com")
+		fmt.Fprintln(os.Stderr, "")
+	}
+}
+
+// applyDoerContext auto-configures the customer context to "doit.com" for
+// @doit.com accounts that haven't set one yet. The validate endpoint requires
+// customerContext for DoiT employees; calling this after the OAuth token is
+// cached fixes the chicken-and-egg problem on first login. Returns true if the
+// context was written so the caller can clear a 403 error from validate.
+func applyDoerContext(configDir string) bool {
+	if !cachedTokenIsDoer() {
+		return false
+	}
+	if readCustomerContext(configDir) != "" {
+		return false // already configured, don't overwrite
+	}
+	err := os.WriteFile(customerContextPath(configDir), []byte("doit.com\n"), 0o600)
+	if err != nil {
+		return false
+	}
+	fmt.Fprintln(os.Stderr, "Detected DoiT account. Set default customer context to 'doit.com'.")
+	fmt.Fprintln(os.Stderr, "To use a different context: dci customer-context set <CONTEXT>")
+	return true
+}
+
+// cachedTokenIsDoer reports whether the cached OAuth JWT contains
+// DoitEmployee: true. This is more reliable than email-domain matching because
+// it is an explicit claim set by the DoiT auth server and is domain-independent.
+// Returns false if the cache is empty, the token is absent, or the JWT is malformed.
+func cachedTokenIsDoer() bool {
+	if cli.Cache == nil {
+		return false
+	}
+	token := cli.Cache.GetString("dci:default.token")
+	if token == "" {
+		return false
+	}
+	parts := strings.Split(token, ".")
+	if len(parts) != 3 {
+		return false
+	}
+	// JWT payload is base64url-encoded without padding.
+	b, err := base64.RawURLEncoding.DecodeString(parts[1])
+	if err != nil {
+		return false
+	}
+	var claims struct {
+		DoitEmployee bool `json:"DoitEmployee"`
+	}
+	if err := json.Unmarshal(b, &claims); err != nil {
+		return false
+	}
+	return claims.DoitEmployee
+}
+
+func registerAuthCommands(configDir string) {
 	cli.Root.AddCommand(&cobra.Command{
 		Use:     "login",
 		Aliases: []string{"auth", "init"},
@@ -791,8 +884,26 @@ func registerAuthCommands() {
 				return fmt.Errorf("login is not needed when DCI_API_KEY is set")
 			}
 			// Trigger the OAuth flow by calling a lightweight endpoint.
+			// Suppress the validate response body — login only needs the OAuth
+			// side effect (token cached), not the API output.
 			os.Args = []string{os.Args[0], "dci", "validate"}
-			if err := cli.Run(); err != nil {
+			oldOut := cli.Stdout
+			cli.Stdout = io.Discard
+			err := cli.Run()
+			cli.Stdout = oldOut
+
+			// Auto-configure DoiT employees who have no customer context set.
+			// The validate endpoint requires customerContext for @doit.com accounts,
+			// causing a 403 on first login before any context is configured. The OAuth
+			// token exchange succeeds (token is cached) even when validate returns 403,
+			// so we can inspect the token here and fix the chicken-and-egg problem.
+			if applyDoerContext(configDir) {
+				err = nil // the 403 was due to missing context; auth itself succeeded
+				// Reset the HTTP status so GetExitCode() returns 0 for this process.
+				viper.Set("rsh-ignore-status-code", true)
+			}
+
+			if err != nil {
 				return err
 			}
 			fmt.Fprintln(os.Stderr, "Authenticated successfully.")

main_test.go

@@ -2,6 +2,8 @@ package main
 
 import (
 	"context"
+	"encoding/base64"
+	"encoding/json"
 	"fmt"
 	"io/fs"
 	"os"
@@ -16,6 +18,7 @@ import (
 	"github.com/mattn/go-runewidth"
 	"github.com/rest-sh/restish/cli"
 	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
 )
 
 func TestNormalizeArgs(t *testing.T) {
@@ -1195,3 +1198,121 @@ func TestInstallSkillFileCount(t *testing.T) {
 		t.Errorf("expected %d files, got %d: %v", len(expectedSkillFiles), len(installedFiles), installedFiles)
 	}
 }
+
+const testTokenCacheKey = "dci:default.token"
+
+// makeTestJWT builds a minimal unsigned JWT (header.payload.) with the given claims.
+// claims is marshalled as-is so callers can pass any JSON-serialisable map.
+func makeTestJWT(claims map[string]interface{}) string {
+	header := base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"none"}`))
+	payload, _ := json.Marshal(claims)
+	return header + "." + base64.RawURLEncoding.EncodeToString(payload) + "."
+}
+
+// doerJWT returns a test JWT with DoitEmployee: true.
+func doerJWT() string {
+	return makeTestJWT(map[string]interface{}{"DoitEmployee": true, "sub": "jane@doit-intl.com"})
+}
+
+// nonDoerJWT returns a test JWT with DoitEmployee: false.
+func nonDoerJWT() string {
+	return makeTestJWT(map[string]interface{}{"DoitEmployee": false, "sub": "user@example.com"})
+}
+
+// writeContextFile writes ctx to the customer context file in dir, fataling on error.
+func writeContextFile(t *testing.T, dir, ctx string) {
+	t.Helper()
+	if err := os.WriteFile(customerContextPath(dir), []byte(ctx+"\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// setupTestCache replaces cli.Cache with a fresh in-memory viper instance and
+// restores the original on test cleanup.
+func setupTestCache(t *testing.T) {
+	t.Helper()
+	old := cli.Cache
+	cli.Cache = viper.New()
+	t.Cleanup(func() { cli.Cache = old })
+}
+
+func TestCachedTokenIsDoer(t *testing.T) {
+	setupTestCache(t)
+
+	tests := []struct {
+		name  string
+		token string
+		want  bool
+	}{
+		{name: "DoitEmployee true", token: doerJWT(), want: true},
+		{name: "DoitEmployee false", token: nonDoerJWT(), want: false},
+		{name: "JWT without DoitEmployee claim", token: makeTestJWT(map[string]interface{}{"sub": "user@example.com"}), want: false},
+		{name: "empty token", token: "", want: false},
+		{name: "not a JWT", token: "not-a-jwt", want: false},
+		{name: "invalid base64 in payload", token: "header.!!invalid!!.sig", want: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cli.Cache.Set(testTokenCacheKey, tt.token)
+			if got := cachedTokenIsDoer(); got != tt.want {
+				t.Errorf("cachedTokenIsDoer() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestApplyDoerContext(t *testing.T) {
+	setupTestCache(t)
+
+	tests := []struct {
+		name            string
+		token           string
+		existingContext string
+		wantResult      bool
+		wantContext     string
+	}{
+		{
+			name:        "sets doit.com for Doer with no context",
+			token:       doerJWT(),
+			wantResult:  true,
+			wantContext: "doit.com",
+		},
+		{
+			name:        "no-op for non-Doer account",
+			token:       nonDoerJWT(),
+			wantResult:  false,
+			wantContext: "",
+		},
+		{
+			name:            "no-op when context already set",
+			token:           doerJWT(),
+			existingContext: "other-customer",
+			wantResult:      false,
+			wantContext:     "other-customer",
+		},
+		{
+			name:        "no-op when no cached token",
+			token:       "",
+			wantResult:  false,
+			wantContext: "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dir := t.TempDir()
+			if tt.existingContext != "" {
+				writeContextFile(t, dir, tt.existingContext)
+			}
+			cli.Cache.Set(testTokenCacheKey, tt.token)
+
+			if got := applyDoerContext(dir); got != tt.wantResult {
+				t.Errorf("applyDoerContext() = %v, want %v", got, tt.wantResult)
+			}
+			if ctx := readCustomerContext(dir); ctx != tt.wantContext {
+				t.Errorf("customerContext = %q, want %q", ctx, tt.wantContext)
+			}
+		})
+	}
+}