fix(session): real getMyProfiles shape {myprofiles:[...]} + active-profile detection [#767]

https://projects.knownelement.com/issues/767#note-4191

internal/cli/cli_test.go

@@ -2,6 +2,7 @@ package cli
 
 import (
 	"encoding/json"
+	"net/http"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -341,6 +342,45 @@ func TestProfileSwitchAgentMode(t *testing.T) {
 	}
 }
 
+// Real GLPI exposes the active profile only via GET /getActiveProfile.
+// whoami must detect it there — and DEGRADE to all-inactive (not fail)
+// when that endpoint is missing or permission-blocked.
+func TestWhoamiActiveProfileDegradation(t *testing.T) {
+	tests := []struct {
+		name    string
+		brk     int
+		wantAct bool // [active] marker expected?
+	}{
+		{"working endpoint marks active", 0, true},
+		{"403 degrades to all-inactive", http.StatusForbidden, false},
+		{"404 degrades to all-inactive", http.StatusNotFound, false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			srv := boot(t)
+			srv.BreakActiveProfile = tt.brk
+			out, errb, code := run(t, "whoami")
+			if code != 0 {
+				t.Fatalf("code = %d, stderr = %q, want 0", code, errb)
+			}
+			if !strings.Contains(out, "Hotliner") || !strings.Contains(out, "Super-admin") {
+				t.Errorf("profiles missing from output: %q", out)
+			}
+			if got := strings.Contains(out, "[active]"); got != tt.wantAct {
+				t.Errorf("[active] marker = %v, want %v (out %q)", got, tt.wantAct, out)
+			}
+		})
+	}
+	t.Run("500 on getActiveProfile still errors", func(t *testing.T) {
+		srv := boot(t)
+		srv.BreakActiveProfile = http.StatusInternalServerError
+		_, _, code := run(t, "whoami")
+		if code != 2 {
+			t.Fatalf("code = %d, want 2 (unexpected server errors are surfaced)", code)
+		}
+	})
+}
+
 func TestAPIErrorIsExitTwo(t *testing.T) {
 	srv := boot(t)
 	srv.Fail = &fakeglpi.FailSpec{Status: 404, Body: `[{"ERROR_ITEM_NOT_FOUND":"gone %s"}]`}