feat: discover contexts on login, select with ctx use

[scotwells]

Summary

Logging in and picking a project should be one step, and datumctl should remember your choice so you don't have to repeat it on every command. This PR makes that the default. Switching to a different project — or to another account — takes one command, and drops you right where you left off.

First run: log in and pick a context

datumctl login handles authentication and context selection in one step. A browser opens, then the CLI fetches your orgs and projects and shows a picker:

✓ Authenticated as Jane Doe (jane@acme.com)

Discovering organizations and projects...

You have access to 2 organization(s):

  acme-corp (3 project(s))
  personal (1 project(s))

┃ Select a context to work in
┃ > acme-corp  (Acme Corp)
┃     infra
┃     web-app
┃     billing-api
┃   personal
┃     sandbox

✓ Context set to acme-corp/infra

If you only have one project, the picker is skipped. From there, resource commands (get, apply, create, etc.) automatically use the active context — datumctl get dnszones just works, no --project or --organization flags required. To list, inspect, or change your active context:

$ datumctl ctx
  DISPLAY NAME         NAME                       TYPE      CURRENT
  Acme Corp            acme-corp                  org
    Infrastructure     acme-corp/infra            project   *
    Web App            acme-corp/web-app          project
  Personal             personal                   org
    Sandbox            personal/sandbox           project

$ datumctl ctx use acme-corp/web-app
✓ Switched to acme-corp/web-app

$ datumctl whoami
User:         Jane Doe (jane@acme.com)
Context:      acme-corp/web-app
Organization: Acme Corp (acme-corp)
Project:      Web App (web-app)

Switching accounts without losing your place

Each login session remembers its last-used context, so switching users drops you right back where you left off:

$ datumctl auth list
  USER                 STATUS
  jane@acme.com        Active
  bob@acme.com

$ datumctl auth switch bob@acme.com
✓ Switched to Bob Smith (bob@acme.com)
  Context:  acme-corp/billing-api

Scripts, CI, and machine accounts

For non-interactive use, environment variables override the active context per-invocation:

DATUM_PROJECT=my-project datumctl get dnszones
DATUM_ORGANIZATION=my-org datumctl get projects

--project and --organization flags still work too. For machine-to-machine auth:

datumctl login --credentials ./my-key.json --hostname auth.datum.net

Tip

Run datumctl --help for the full command list.

Upgrading from earlier versions

datumctl auth login and datumctl auth logout have been removed — use datumctl login and datumctl logout instead. datumctl login supports all the same auth modes (PKCE, --no-browser for device flow, --credentials for machine accounts).

Pre-existing keyring credentials are bootstrapped into a v1beta1 session on first run, so previously authenticated users won't have to log in again. They will, however, want to run datumctl ctx use (or rely on DATUM_PROJECT/DATUM_ORGANIZATION) to pick a context.

Anyone with a kubeconfig generated by an earlier datumctl auth update-kubeconfig will need to re-run the command — the kubectl exec plugin args now reference session names rather than the legacy format.

🤖 Generated with Claude Code

[gianarb]

this looks good to me, do you want to get it out of draft so we can move it over and merge?

[gianarb]

Pretty nice!! It works with the various tests I made and ctx --refresh migrates my configuration as well 👍