feat(proto): report the tenant's agent-identity issuer in WhoAmI

[defangdevs]

Why

Part of the agent-identity work (#2166): every Defang tenant gets an OIDC issuer and JWKS, so an agent can hold its own keypair, register the public half, and federate into AWS / Azure / GCP with self-signed JWTs instead of long-lived cloud credentials.

The CLI has to know its tenant's issuer URL to register keys. The draft in #2167 builds it client-side as <tenant>.<issuer-host> using the tenant label from WhoAmI — which does not work: that label is Fabric's own DNS-safe label (utils.NewTenantLabel(), stored in Fabric's store), while the registry resolves the Portal tenant UUID. Deriving the URL client-side would also freeze its shape into every released binary.

So Fabric reports it.

What

One field: WhoAmIResponse.identity_issuer — the base URL of the tenant's agent-identity issuer, empty when the deployment serves none. Regenerated with protoc 32.1 and protoc-gen-go v1.36.11, matching the versions already recorded in fabric.pb.go; the diff is the new field and nothing else.

Companion changes

• Fabric fills the field — defang-mvp PR (needs this to merge first, since fabric/go.mod pins DefangLabs/defang/src).
• The CLI consumes it instead of constructing the URL — Add defang identity: agent public-key registration #2167.
• The registry itself — DefangLabs/portal#1011.

Testing

go build ./... and go test -short green (CGO_ENABLED=0).

🤖 Generated with Claude Code

https://claude.ai/code/session_01T3WmpdY3zc555sNdkY9dzQ

Summary by CodeRabbit

• New Features
  • Added the identity issuer URL to account identity information.
  • Clients can now use the server-provided issuer URL instead of deriving it from tenant details.
  • The field is returned empty when the issuer is unavailable.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 9fd4d8d1-edb4-4dee-889f-a377fd657c29

📥 Commits

Reviewing files that changed from the base of the PR and between 9bee83b and 643d57a.

⛔ Files ignored due to path filters (1)

• src/protos/io/defang/v1/fabric.pb.go is excluded by !**/*.pb.go

📒 Files selected for processing (1)

• src/protos/io/defang/v1/fabric.proto

---

📝 Walkthrough

Walkthrough

WhoAmIResponse now includes identity_issuer, a server-provided tenant agent-identity issuer base URL. The field is empty when no issuer is available. Clients must use this URL instead of deriving it from the tenant identifier.

Changes

Identity issuer response field

Layer / File(s)	Summary
WhoAmIResponse identity issuer contract src/protos/io/defang/v1/fabric.proto	Adds the identity_issuer field and documents its URL semantics, including empty values when unavailable and client use of the server-provided URL.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Mergeability Score: ⚪ Minimal · up to 643d5

This localized change adds the tenant identity-issuer field to WhoAmI without introducing an actionable merge-blocking risk; it is merge-ready after normal checks and review.

Suggested reviewers: lionello

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the addition of the tenant's agent-identity issuer to WhoAmIResponse.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}