Describe the bug
--realm cannot target a realm other than the one the session was opened on. ferris-ctl client list --realm zukquote answers no credentials available, while the same token administers that realm without trouble when the API is called directly.
Root cause
resolve_bearer_token requires creds.realm == realm (libs/ferriskey-cli-core/src/session.rs:57). A session opened on master is therefore refused for every other realm — the CLI rejects locally what the server accepts.
Expected behaviour
--realm should select the realm the request targets, not the realm the credentials must have been issued by. A master session holding the right permissions should administer any realm, and authorization should be left to the server, which is the only side that can decide it.
If a warning is wanted when the token's realm differs from the target, it should be a warning, not a refusal.
Environment
ferris-ctl 0.2.3, FerrisKey server 0.7.0
Describe the bug
--realmcannot target a realm other than the one the session was opened on.ferris-ctl client list --realm zukquoteanswersno credentials available, while the same token administers that realm without trouble when the API is called directly.Root cause
resolve_bearer_tokenrequirescreds.realm == realm(libs/ferriskey-cli-core/src/session.rs:57). A session opened onmasteris therefore refused for every other realm — the CLI rejects locally what the server accepts.Expected behaviour
--realmshould select the realm the request targets, not the realm the credentials must have been issued by. Amastersession holding the right permissions should administer any realm, and authorization should be left to the server, which is the only side that can decide it.If a warning is wanted when the token's realm differs from the target, it should be a warning, not a refusal.
Environment
ferris-ctl 0.2.3, FerrisKey server 0.7.0