fix(session): real getMyProfiles shape {myprofiles:[...]} + active-profile detection [#767]

https://projects.knownelement.com/issues/767#note-4191

internal/cli/cli_test.go

@@ -2,6 +2,7 @@ package cli
 
 import (
 	"encoding/json"
+	"net/http"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -341,6 +342,45 @@ func TestProfileSwitchAgentMode(t *testing.T) {
 	}
 }
 
+// Real GLPI exposes the active profile only via GET /getActiveProfile.
+// whoami must detect it there — and DEGRADE to all-inactive (not fail)
+// when that endpoint is missing or permission-blocked.
+func TestWhoamiActiveProfileDegradation(t *testing.T) {
+	tests := []struct {
+		name    string
+		brk     int
+		wantAct bool // [active] marker expected?
+	}{
+		{"working endpoint marks active", 0, true},
+		{"403 degrades to all-inactive", http.StatusForbidden, false},
+		{"404 degrades to all-inactive", http.StatusNotFound, false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			srv := boot(t)
+			srv.BreakActiveProfile = tt.brk
+			out, errb, code := run(t, "whoami")
+			if code != 0 {
+				t.Fatalf("code = %d, stderr = %q, want 0", code, errb)
+			}
+			if !strings.Contains(out, "Hotliner") || !strings.Contains(out, "Super-admin") {
+				t.Errorf("profiles missing from output: %q", out)
+			}
+			if got := strings.Contains(out, "[active]"); got != tt.wantAct {
+				t.Errorf("[active] marker = %v, want %v (out %q)", got, tt.wantAct, out)
+			}
+		})
+	}
+	t.Run("500 on getActiveProfile still errors", func(t *testing.T) {
+		srv := boot(t)
+		srv.BreakActiveProfile = http.StatusInternalServerError
+		_, _, code := run(t, "whoami")
+		if code != 2 {
+			t.Fatalf("code = %d, want 2 (unexpected server errors are surfaced)", code)
+		}
+	})
+}
+
 func TestAPIErrorIsExitTwo(t *testing.T) {
 	srv := boot(t)
 	srv.Fail = &fakeglpi.FailSpec{Status: 404, Body: `[{"ERROR_ITEM_NOT_FOUND":"gone %s"}]`}

internal/cli/commands.go

@@ -3,6 +3,7 @@ package cli
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -19,6 +20,10 @@ func marshalIndent(v any) ([]byte, error) { return json.MarshalIndent(v, "", "
 
 // cmdWhoami lists the session's profiles. It NEVER switches the active
 // profile (agent mode's MGLPI_PROFILE_ID is deliberately not applied).
+// Active-profile detection comes from GetActiveProfile; when that
+// endpoint is missing or permission-blocked (404/403), whoami degrades
+// gracefully to all-inactive rather than erroring — other failures
+// (5xx, unreachable) still surface as API errors.
 func cmdWhoami(args []string, stdout, stderr io.Writer) int {
 	fs, cfgPath, out := newFlags("whoami", stderr)
 	pos, err := parseArgs(fs, args)
@@ -33,6 +38,16 @@ func cmdWhoami(args []string, stdout, stderr io.Writer) int {
 	if err != nil {
 		return apiErr(stderr, err)
 	}
+	activeID, aerr := c.GetActiveProfile(context.Background())
+	degraded := aerr != nil && (errors.Is(aerr, glpi.ErrNotFound) || errors.Is(aerr, glpi.ErrAuth))
+	if aerr != nil && !degraded {
+		return apiErr(stderr, aerr)
+	}
+	if !degraded {
+		for i := range profs {
+			profs[i].IsActive = profs[i].ID == activeID
+		}
+	}
 	if *out == "json" {
 		emitJSON(stdout, map[string]any{"profiles": profs})
 		return 0