feat: project specific config

[richard-hajek]

Addresses #239

Fair warning, this work is vibe coded. However I tested it and It Works On My Machine ™️

[richard-hajek]

I already noticed few issues

• random crashes on profile selection with unknown profile
• what in this scenario is restish edit supposed to do?

I do not recommend to merge this at this stage

[richard-hajek]

I believe i fixed most of the issues in this PR

[jaynis]

Hi. I was looking for this feature and tried out your PR and have a few remarks:

• Reading a API configuration from a specified config file seems to work fine
• Updating a API which is present in a specified config file seems to work as well
• Adding new APIs when a config file is specified does not work reliably. APIs are still added to the default file and in addition to that the entire content of the specified config file is merged into the central file - something I would definitely not expect.
• When the specified config file does not exist, restish silently falls back to the default configuration file. In this case I would either create the specified config file or at least throw an error.
• When there is a API in the default config file with a certain URL and the specified config file contains a API with a different name, but the same URL (something which can very well happen), restish panics with panic: multiple APIs configured with the same base URL: <url>

Generally, I would advise against doing any merging of config files. If a custom config file is specified with --rsh-config or RSH_CONFIG this should be the single source of truth, overriding the default config file entirely in every regard.

[richard-hajek]

Thanks for the review! I don't use restish as frequently right now, so it's not a high priority for me, but I'll try to get to it at some point

[danielgtaylor]

Thanks @richard-hajek for putting together the project-specific config prototype and for the follow-up feedback on the trust/permissions model. That helped shape the final version that just merged in #349.

#349 now provides trusted .restish.json discovery, TTY prompting / restish config trust, normal committed-file permissions, secret validation, read-only project APIs, and per-project cache/state namespacing. I’m going to close this as superseded by #349. Much appreciated.