From b834701bec26fedbd2db7f85c055f001de434961 Mon Sep 17 00:00:00 2001
From: Anthony Lukach <anthonylukach@gmail.com>
Date: Wed, 14 Oct 2026 09:29:40 -0700
Subject: [PATCH 1/5] feat: auth status, the cached login and a role's
 credentials at a glance

`source-coop auth status` reports, for one environment and role, whether
you're logged in (refresh token, ID and access token expiry) and when the
role's cached credentials expire. It reads the cache only: nothing is
refreshed and nothing goes over the network. --proxy-url and --role-arn
pick the environment and role, as for creds.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md      |  16 +++++
 src/main.rs    | 181 ++++++++++++++++++++++++++++++++++++++++++++++++-
 src/session.rs |   2 +-
 3 files changed, 197 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index f6dd87b..b5c8c88 100644
--- a/README.md
+++ b/README.md
@@ -93,6 +93,22 @@ Credentials are cached on the server (see [File fallback](#file-fallback)), and
 source-coop --version
 ```
 
+### Checking login status
+
+`auth status` shows whether you're logged in, and when the cached tokens and a role's credentials expire. It works from the cache: nothing is refreshed and nothing is sent over the network.
+
+```bash
+source-coop auth status
+```
+
+```
+Environment: production (https://data.source.coop)
+Login session: logged in (refresh token: yes; ID token expires 2026-10-13T18:00:00Z; access token for https://source.coop expires 2026-10-13T18:00:00Z)
+Role _default: credentials expire 2026-10-13T18:30:00Z
+```
+
+The keyring can't list its entries, so `auth status` reports on one environment and role. Pass `--proxy-url` and `--role-arn` (or set `SOURCE_PROXY_URL` and `SOURCE_ROLE_ARN`) to check others.
+
 ### Setting credentials on the environment
 
 After logging in, you can export cached credentials as environment variables:
diff --git a/src/main.rs b/src/main.rs
index 7d355fe..eeb7193 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -64,7 +64,7 @@ struct Cli {
 
 #[derive(Subcommand)]
 enum Commands {
-    /// Log in, and print tokens for the source.coop API
+    /// Log in, see whether you are, and print tokens for the source.coop API
     #[command(subcommand)]
     Auth(AuthCommand),
     /// Output cached credentials as credential_process JSON, shell env vars,
@@ -114,11 +114,25 @@ enum AuthCommand {
     /// Log in through the browser, keeping the session and a role's S3
     /// credentials for `creds` and the API
     Login(LoginArgs),
+    /// Show the cached login session and a role's credentials, without
+    /// refreshing either or going to the network
+    Status(StatusArgs),
     /// Print an access token for the source.coop API, refreshing it if expired
     /// (e.g. `curl -H "Authorization: Bearer $(source-coop auth token)" ...`)
     Token(TokenArgs),
 }
 
+#[derive(Parser)]
+struct StatusArgs {
+    /// S3 proxy URL: selects the environment to report on
+    #[arg(long, env = "SOURCE_PROXY_URL", default_value = defaults::PROXY_URL)]
+    proxy_url: String,
+
+    /// Role ARN whose cached credentials to report on
+    #[arg(long, env = "SOURCE_ROLE_ARN", default_value = defaults::ROLE_ARN)]
+    role_arn: String,
+}
+
 #[derive(Parser)]
 struct TokenArgs {
     /// S3 proxy URL of the environment whose login session to use
@@ -228,6 +242,11 @@ async fn main() {
                 fail(e);
             }
         }
+        Commands::Auth(AuthCommand::Status(args)) => {
+            if let Err(e) = run_status(args) {
+                fail(e);
+            }
+        }
         Commands::Auth(AuthCommand::Token(args)) => {
             if let Err(e) = run_auth_token(args, verbose).await {
                 fail(e);
@@ -263,6 +282,100 @@ async fn main() {
     }
 }
 
+fn run_status(args: StatusArgs) -> Result<(), String> {
+    let env = cache::env(&args.proxy_url)?;
+    let session = cache::read_session(env.as_deref())?;
+    let entry = cache::read_credentials(env.as_deref(), &args.role_arn)?;
+    print!(
+        "{}",
+        status_report(
+            &args.proxy_url,
+            env.as_deref(),
+            &args.role_arn,
+            session.as_ref(),
+            entry.as_ref().map(|e| &e.creds),
+            chrono::Utc::now().timestamp(),
+        )
+    );
+    Ok(())
+}
+
+/// `<expires> <time>` or `expired <time>` for a Unix timestamp, as of `now`.
+fn expiry(exp: Option<i64>, now: i64, expires: &str) -> String {
+    match exp.and_then(|t| chrono::DateTime::from_timestamp(t, 0)) {
+        None => "expiry unknown".into(),
+        Some(t) => {
+            let verb = if t.timestamp() > now {
+                expires
+            } else {
+                "expired"
+            };
+            format!(
+                "{verb} {}",
+                t.to_rfc3339_opts(chrono::SecondsFormat::Secs, true)
+            )
+        }
+    }
+}
+
+/// The `auth status` report for one environment and role, as of `now`.
+fn status_report(
+    proxy_url: &str,
+    env: Option<&str>,
+    role_arn: &str,
+    session: Option<&session::Session>,
+    creds: Option<&sts::Credentials>,
+    now: i64,
+) -> String {
+    let mut out = format!(
+        "Environment: {} ({proxy_url})\n",
+        env.unwrap_or("production")
+    );
+    let login = match session {
+        None => "not logged in".to_string(),
+        Some(s) => {
+            let id_exp = session::jwt_exp(&s.id_token);
+            // Without a refresh token, the session ends when its ID token does.
+            let state = match (&s.refresh_token, id_exp) {
+                (None, Some(exp)) if exp <= now => "expired",
+                _ => "logged in",
+            };
+            let access = match (&s.access_token, &s.audience) {
+                (None, _) => "no access token".to_string(),
+                (Some(_), aud) => format!(
+                    "access token{} {}",
+                    aud.as_deref()
+                        .map(|a| format!(" for {a}"))
+                        .unwrap_or_default(),
+                    expiry(s.access_token_expires_at, now, "expires")
+                ),
+            };
+            let refresh = if s.refresh_token.is_some() {
+                "yes"
+            } else {
+                "no"
+            };
+            format!(
+                "{state} (refresh token: {refresh}; ID token {}; {access})",
+                expiry(id_exp, now, "expires")
+            )
+        }
+    };
+    out += &format!("Login session: {login}\n");
+    let role = match creds {
+        None => "no cached credentials".to_string(),
+        Some(c) => {
+            let exp = chrono::DateTime::parse_from_rfc3339(&c.expiration).ok();
+            format!(
+                "credentials {}",
+                expiry(exp.map(|t| t.timestamp()), now, "expire")
+            )
+        }
+    };
+    out += &format!("Role {role_arn}: {role}\n");
+    out
+}
+
 async fn run_auth_token(args: TokenArgs, verbose: bool) -> Result<(), String> {
     let env = cache::env(&args.proxy_url)?;
     let token = session::token(env.as_deref(), session::Want::Access, verbose)
@@ -538,6 +651,72 @@ mod tests {
         assert!(problems.is_empty(), "{problems:#?}");
     }
 
+    fn creds(expiration: &str) -> sts::Credentials {
+        sts::Credentials {
+            access_key_id: "KEY".into(),
+            secret_access_key: "SECRET".into(),
+            session_token: "SESSION".into(),
+            expiration: expiration.into(),
+        }
+    }
+
+    /// An unsigned JWT that expires at `exp`; only its claims are ever read.
+    fn jwt(exp: i64) -> String {
+        use base64::Engine;
+        let claims = base64::engine::general_purpose::URL_SAFE_NO_PAD
+            .encode(serde_json::json!({ "exp": exp }).to_string());
+        format!("e30.{claims}.sig")
+    }
+
+    #[test]
+    fn status_reports_a_live_session_and_credentials() {
+        // 2026-10-13T17:00:00Z
+        let now = 1_791_910_800;
+        let session = session::Session {
+            proxy_url: Some("https://data.source.coop".into()),
+            client_id: "cid".into(),
+            token_endpoint: "https://auth.test/oauth2/token".into(),
+            audience: Some("https://source.coop".into()),
+            refresh_token: Some("rt".into()),
+            id_token: jwt(now + 3600),
+            access_token: Some("at".into()),
+            access_token_expires_at: Some(now - 60),
+        };
+        let report = status_report(
+            "https://data.source.coop",
+            None,
+            "_default",
+            Some(&session),
+            Some(&creds("2026-10-13T18:30:00Z")),
+            now,
+        );
+        assert_eq!(
+            report,
+            "Environment: production (https://data.source.coop)\n\
+             Login session: logged in (refresh token: yes; ID token expires 2026-10-13T18:00:00Z; \
+             access token for https://source.coop expired 2026-10-13T16:59:00Z)\n\
+             Role _default: credentials expire 2026-10-13T18:30:00Z\n"
+        );
+    }
+
+    #[test]
+    fn status_reports_nothing_cached() {
+        let report = status_report(
+            "https://data.staging.source.coop",
+            Some("data.staging.source.coop"),
+            "_default",
+            None,
+            None,
+            0,
+        );
+        assert_eq!(
+            report,
+            "Environment: data.staging.source.coop (https://data.staging.source.coop)\n\
+             Login session: not logged in\n\
+             Role _default: no cached credentials\n"
+        );
+    }
+
     /// `login` moved under `auth`; the old name still works, unlisted.
     #[test]
     fn login_still_works_by_its_old_name() {
diff --git a/src/session.rs b/src/session.rs
index 6a32dcb..b0f3877 100644
--- a/src/session.rs
+++ b/src/session.rs
@@ -110,7 +110,7 @@ impl Session {
 
 /// The `exp` claim of a JWT, read without verifying it: only to know when to
 /// refresh, never to trust the token.
-fn jwt_exp(token: &str) -> Option<i64> {
+pub(crate) fn jwt_exp(token: &str) -> Option<i64> {
     let payload = URL_SAFE_NO_PAD.decode(token.split('.').nth(1)?).ok()?;
     serde_json::from_slice::<serde_json::Value>(&payload)
         .ok()?

From f3ffb82460b9fafdd62bff8b4c019bb7d410d06e Mon Sep 17 00:00:00 2001
From: Anthony Lukach <anthonylukach@gmail.com>
Date: Wed, 14 Oct 2026 10:10:25 -0700
Subject: [PATCH 2/5] feat: auth status names who's logged in, in coloured
 label/value rows

auth login now asks the API's /whoami who the new access token acts as
(--api-url, SOURCE_API_URL) and keeps the account in the session, so
auth status can name it without going to the network. A failed lookup is
noted, not an error, and a session from before says it's unknown until
the next login.

auth status shows one row per item, laid out like product view: dim
labels, the login state green or red, the account ID gray, and a past
expiry yellow, on a terminal and without NO_COLOR.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md      |  13 ++-
 src/main.rs    | 283 ++++++++++++++++++++++++++++++++++++++-----------
 src/session.rs |  29 +++++
 3 files changed, 259 insertions(+), 66 deletions(-)

diff --git a/README.md b/README.md
index b5c8c88..36ee74c 100644
--- a/README.md
+++ b/README.md
@@ -95,16 +95,20 @@ source-coop --version
 
 ### Checking login status
 
-`auth status` shows whether you're logged in, and when the cached tokens and a role's credentials expire. It works from the cache: nothing is refreshed and nothing is sent over the network.
+`auth status` shows whether you're logged in and as whom, and when the cached tokens and a role's credentials expire. It works from the cache: nothing is refreshed and nothing is sent over the network. The account is the one `auth login` looked up (through the API at `--api-url`) when you logged in; for a login from before it did, `auth status` says so until you log in again. On a terminal, labels are dim and the login's state is green or red.
 
 ```bash
 source-coop auth status
 ```
 
 ```
-Environment: production (https://data.source.coop)
-Login session: logged in (refresh token: yes; ID token expires 2026-10-13T18:00:00Z; access token for https://source.coop expires 2026-10-13T18:00:00Z)
-Role _default: credentials expire 2026-10-13T18:30:00Z
+Environment    production (https://data.source.coop)
+Login          logged in
+Account        Anthony Lukach (alukach)
+Refresh token  yes
+ID token       expires 2026-10-13T18:00:00Z
+Access token   for https://source.coop, expires 2026-10-13T18:00:00Z
+Credentials    _default: expire 2026-10-13T18:30:00Z
 ```
 
 The keyring can't list its entries, so `auth status` reports on one environment and role. Pass `--proxy-url` and `--role-arn` (or set `SOURCE_PROXY_URL` and `SOURCE_ROLE_ARN`) to check others.
@@ -177,6 +181,7 @@ endpoint_url = https://data.staging.source.coop
 | `--duration` | | | Session duration, e.g. `3600`, `90s`, `5m`, `12h`, `1d` (bare number = seconds) |
 | `--scope` | | `openid offline_access` | OAuth2 scopes (`offline_access` enables automatic refresh in `creds`) |
 | `--audience` | `SOURCE_API_AUDIENCE` | `https://source.coop` | Audience of the access token for the source.coop API; empty to request none |
+| `--api-url` | `SOURCE_API_URL` | `https://source.coop` | source.coop site whose API names the account you logged in as, for `auth status` |
 | `--port` | | `0` (random) | Local callback port |
 | `--no-cache` | | | Skip caching credentials (just print to stdout) |
 
diff --git a/src/main.rs b/src/main.rs
index eeb7193..f26ba4b 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -176,6 +176,11 @@ struct LoginArgs {
     #[arg(long, env = "SOURCE_API_AUDIENCE", default_value = defaults::API_URL)]
     audience: String,
 
+    /// source.coop site URL whose API names the account you logged in as,
+    /// shown by `auth status`
+    #[arg(long, env = "SOURCE_API_URL", default_value = defaults::API_URL)]
+    api_url: String,
+
     /// Local callback port (0 for random available port)
     #[arg(long, default_value = "0")]
     port: u16,
@@ -282,6 +287,27 @@ async fn main() {
     }
 }
 
+/// The account `access_token` acts as, from the API's `/whoami`, to keep
+/// with the session. None without a token; a failed lookup is noted, not an
+/// error, since the login itself worked.
+async fn whoami(
+    api_url: &str,
+    access_token: Option<String>,
+    verbose: bool,
+) -> Option<session::Account> {
+    let client = api::Client::new(api_url, Some(access_token?), verbose).ok()?;
+    match client
+        .get::<serde_json::Value>(client.url(&["whoami"]))
+        .await
+    {
+        Ok(me) => session::Account::from_whoami(&me),
+        Err(e) => {
+            eprintln!("Couldn't look up your account ({e}); `auth status` won't name it.");
+            None
+        }
+    }
+}
+
 fn run_status(args: StatusArgs) -> Result<(), String> {
     let env = cache::env(&args.proxy_url)?;
     let session = cache::read_session(env.as_deref())?;
@@ -295,30 +321,31 @@ fn run_status(args: StatusArgs) -> Result<(), String> {
             session.as_ref(),
             entry.as_ref().map(|e| &e.creds),
             chrono::Utc::now().timestamp(),
+            style::wanted(std::io::IsTerminal::is_terminal(&std::io::stdout())),
         )
     );
     Ok(())
 }
 
-/// `<expires> <time>` or `expired <time>` for a Unix timestamp, as of `now`.
-fn expiry(exp: Option<i64>, now: i64, expires: &str) -> String {
+/// `<expires> <time>` for a Unix timestamp, or `expired <time>` (yellow)
+/// once it's past, as of `now`.
+fn expiry(exp: Option<i64>, now: i64, expires: &str, color: bool) -> String {
     match exp.and_then(|t| chrono::DateTime::from_timestamp(t, 0)) {
         None => "expiry unknown".into(),
         Some(t) => {
-            let verb = if t.timestamp() > now {
-                expires
+            let when = t.to_rfc3339_opts(chrono::SecondsFormat::Secs, true);
+            if t.timestamp() > now {
+                format!("{expires} {when}")
             } else {
-                "expired"
-            };
-            format!(
-                "{verb} {}",
-                t.to_rfc3339_opts(chrono::SecondsFormat::Secs, true)
-            )
+                style::paint(color, "33", &format!("expired {when}"))
+            }
         }
     }
 }
 
-/// The `auth status` report for one environment and role, as of `now`.
+/// The `auth status` report for one environment and role, as of `now`: a
+/// `Label  value` row each, labels dim and the login's state green (logged
+/// in) or red (expired, not logged in) when `color`.
 fn status_report(
     proxy_url: &str,
     env: Option<&str>,
@@ -326,54 +353,77 @@ fn status_report(
     session: Option<&session::Session>,
     creds: Option<&sts::Credentials>,
     now: i64,
+    color: bool,
 ) -> String {
-    let mut out = format!(
-        "Environment: {} ({proxy_url})\n",
-        env.unwrap_or("production")
-    );
-    let login = match session {
-        None => "not logged in".to_string(),
+    let mut rows = vec![(
+        "Environment",
+        format!("{} ({proxy_url})", env.unwrap_or("production")),
+    )];
+    match session {
+        None => rows.push(("Login", style::paint(color, "31", "not logged in"))),
         Some(s) => {
             let id_exp = session::jwt_exp(&s.id_token);
             // Without a refresh token, the session ends when its ID token does.
             let state = match (&s.refresh_token, id_exp) {
-                (None, Some(exp)) if exp <= now => "expired",
-                _ => "logged in",
-            };
-            let access = match (&s.access_token, &s.audience) {
-                (None, _) => "no access token".to_string(),
-                (Some(_), aud) => format!(
-                    "access token{} {}",
-                    aud.as_deref()
-                        .map(|a| format!(" for {a}"))
-                        .unwrap_or_default(),
-                    expiry(s.access_token_expires_at, now, "expires")
-                ),
+                (None, Some(exp)) if exp <= now => style::paint(color, "31", "expired"),
+                _ => style::paint(color, "32", "logged in"),
             };
+            rows.push(("Login", state));
+            rows.push((
+                "Account",
+                match &s.account {
+                    Some(a) => match &a.name {
+                        Some(name) => format!("{name} ({})", style::id(color, &a.account_id)),
+                        None => a.account_id.clone(),
+                    },
+                    None => style::paint(color, "2", "unknown until your next `auth login`"),
+                },
+            ));
             let refresh = if s.refresh_token.is_some() {
                 "yes"
             } else {
                 "no"
             };
-            format!(
-                "{state} (refresh token: {refresh}; ID token {}; {access})",
-                expiry(id_exp, now, "expires")
-            )
+            rows.push(("Refresh token", refresh.into()));
+            rows.push(("ID token", expiry(id_exp, now, "expires", color)));
+            rows.push((
+                "Access token",
+                match &s.access_token {
+                    None => "none".into(),
+                    Some(_) => format!(
+                        "{}{}",
+                        s.audience
+                            .as_deref()
+                            .map(|a| format!("for {a}, "))
+                            .unwrap_or_default(),
+                        expiry(s.access_token_expires_at, now, "expires", color)
+                    ),
+                },
+            ));
         }
-    };
-    out += &format!("Login session: {login}\n");
-    let role = match creds {
-        None => "no cached credentials".to_string(),
-        Some(c) => {
-            let exp = chrono::DateTime::parse_from_rfc3339(&c.expiration).ok();
+    }
+    rows.push((
+        "Credentials",
+        match creds {
+            None => format!("{role_arn}: none cached"),
+            Some(c) => {
+                let exp = chrono::DateTime::parse_from_rfc3339(&c.expiration).ok();
+                format!(
+                    "{role_arn}: {}",
+                    expiry(exp.map(|t| t.timestamp()), now, "expire", color)
+                )
+            }
+        },
+    ));
+    let width = rows.iter().map(|(label, _)| label.len()).max().unwrap_or(0);
+    rows.iter()
+        .map(|(label, value)| {
             format!(
-                "credentials {}",
-                expiry(exp.map(|t| t.timestamp()), now, "expire")
+                "{}  {value}\n",
+                style::paint(color, "2", &format!("{label:<width$}"))
             )
-        }
-    };
-    out += &format!("Role {role_arn}: {role}\n");
-    out
+        })
+        .collect()
 }
 
 async fn run_auth_token(args: TokenArgs, verbose: bool) -> Result<(), String> {
@@ -440,7 +490,7 @@ async fn run_login(args: LoginArgs, verbose: bool) -> Result<(), String> {
             "No access token issued; commands that call the source.coop API will run signed out."
         );
     }
-    let session = session::Session::new(
+    let mut session = session::Session::new(
         tokens,
         args.proxy_url.clone(),
         args.client_id,
@@ -448,6 +498,7 @@ async fn run_login(args: LoginArgs, verbose: bool) -> Result<(), String> {
         audience.map(String::from),
         chrono::Utc::now().timestamp(),
     );
+    session.account = whoami(&args.api_url, session.access_token.clone(), verbose).await;
     {
         let _lock = cache::lock_session(env.as_deref())?;
         cache::write_session(env.as_deref(), &session)?;
@@ -668,11 +719,8 @@ mod tests {
         format!("e30.{claims}.sig")
     }
 
-    #[test]
-    fn status_reports_a_live_session_and_credentials() {
-        // 2026-10-13T17:00:00Z
-        let now = 1_791_910_800;
-        let session = session::Session {
+    fn live_session(now: i64, account: Option<session::Account>) -> session::Session {
+        session::Session {
             proxy_url: Some("https://data.source.coop".into()),
             client_id: "cid".into(),
             token_endpoint: "https://auth.test/oauth2/token".into(),
@@ -681,42 +729,153 @@ mod tests {
             id_token: jwt(now + 3600),
             access_token: Some("at".into()),
             access_token_expires_at: Some(now - 60),
+            account,
+        }
+    }
+
+    #[test]
+    fn status_names_who_is_logged_in() {
+        // 2026-10-13T17:00:00Z
+        let now = 1_791_910_800;
+        let me = session::Account {
+            account_id: "alukach".into(),
+            name: Some("Anthony Lukach".into()),
         };
         let report = status_report(
             "https://data.source.coop",
             None,
             "_default",
-            Some(&session),
+            Some(&live_session(now, Some(me))),
             Some(&creds("2026-10-13T18:30:00Z")),
             now,
+            false,
         );
         assert_eq!(
             report,
-            "Environment: production (https://data.source.coop)\n\
-             Login session: logged in (refresh token: yes; ID token expires 2026-10-13T18:00:00Z; \
-             access token for https://source.coop expired 2026-10-13T16:59:00Z)\n\
-             Role _default: credentials expire 2026-10-13T18:30:00Z\n"
+            "Environment    production (https://data.source.coop)\n\
+             Login          logged in\n\
+             Account        Anthony Lukach (alukach)\n\
+             Refresh token  yes\n\
+             ID token       expires 2026-10-13T18:00:00Z\n\
+             Access token   for https://source.coop, expired 2026-10-13T16:59:00Z\n\
+             Credentials    _default: expire 2026-10-13T18:30:00Z\n"
         );
     }
 
     #[test]
-    fn status_reports_nothing_cached() {
-        let report = status_report(
+    fn status_says_when_the_account_is_unknown_or_nobody_is_logged_in() {
+        let now = 1_791_910_800;
+        let unknown = status_report(
+            "https://data.source.coop",
+            None,
+            "_default",
+            Some(&live_session(now, None)),
+            None,
+            now,
+            false,
+        );
+        assert!(
+            unknown.contains("Account        unknown until your next `auth login`\n"),
+            "{unknown}"
+        );
+        assert!(
+            unknown.ends_with("Credentials    _default: none cached\n"),
+            "{unknown}"
+        );
+
+        let nobody = status_report(
             "https://data.staging.source.coop",
             Some("data.staging.source.coop"),
             "_default",
             None,
             None,
             0,
+            false,
         );
         assert_eq!(
-            report,
-            "Environment: data.staging.source.coop (https://data.staging.source.coop)\n\
-             Login session: not logged in\n\
-             Role _default: no cached credentials\n"
+            nobody,
+            "Environment  data.staging.source.coop (https://data.staging.source.coop)\n\
+             Login        not logged in\n\
+             Credentials  _default: none cached\n"
+        );
+    }
+
+    #[test]
+    fn status_colours_labels_and_the_login_state() {
+        let now = 1_791_910_800;
+        let me = session::Account {
+            account_id: "alukach".into(),
+            name: Some("A".into()),
+        };
+        let report = status_report(
+            "https://data.source.coop",
+            None,
+            "_default",
+            Some(&live_session(now, Some(me))),
+            None,
+            now,
+            true,
+        );
+        assert!(
+            report.contains("\x1b[2mLogin        \x1b[0m  \x1b[32mlogged in\x1b[0m"),
+            "{report:?}"
+        );
+        // The ID in gray, and a past expiry in yellow.
+        assert!(report.contains("A (\x1b[90malukach\x1b[0m)"), "{report:?}");
+        assert!(
+            report.contains("\x1b[33mexpired 2026-10-13T16:59:00Z\x1b[0m"),
+            "{report:?}"
+        );
+        let nobody = status_report(
+            "https://data.source.coop",
+            None,
+            "_default",
+            None,
+            None,
+            now,
+            true,
+        );
+        assert!(
+            nobody.contains("\x1b[31mnot logged in\x1b[0m"),
+            "{nobody:?}"
+        );
+    }
+
+    #[test]
+    fn the_account_comes_from_whoami() {
+        let me =
+            serde_json::json!({"account": {"account_id": "alukach", "name": "Anthony Lukach"}});
+        assert_eq!(
+            session::Account::from_whoami(&me),
+            Some(session::Account {
+                account_id: "alukach".into(),
+                name: Some("Anthony Lukach".into())
+            })
+        );
+        // Signed in without an account yet.
+        assert_eq!(
+            session::Account::from_whoami(&serde_json::json!({"account": null})),
+            None
         );
     }
 
+    #[tokio::test]
+    async fn login_looks_up_the_account_only_with_an_access_token() {
+        let server = MockServer::start().await;
+        Mock::given(method("GET"))
+            .and(path("/api/v1/whoami"))
+            .respond_with(ResponseTemplate::new(200).set_body_json(
+                serde_json::json!({"account": {"account_id": "alukach", "name": "Anthony Lukach"}}),
+            ))
+            .expect(1)
+            .mount(&server)
+            .await;
+        let found = whoami(&server.uri(), Some("at".into()), false).await;
+        assert_eq!(found.map(|a| a.account_id), Some("alukach".to_string()));
+        // No token, no request (the mock expects exactly one).
+        assert_eq!(whoami(&server.uri(), None, false).await, None);
+    }
+
     /// `login` moved under `auth`; the old name still works, unlisted.
     #[test]
     fn login_still_works_by_its_old_name() {
diff --git a/src/session.rs b/src/session.rs
index b0f3877..772f904 100644
--- a/src/session.rs
+++ b/src/session.rs
@@ -35,6 +35,34 @@ pub struct Session {
     /// When the access token expires, in Unix seconds.
     #[serde(default)]
     pub access_token_expires_at: Option<i64>,
+    /// Who logged in, as the API's `/whoami` said at login, for `auth status`
+    /// to show without going to the network. Absent when it couldn't be asked
+    /// (no access token) and in sessions written before it was kept.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub account: Option<Account>,
+}
+
+/// The source.coop account a session acts as.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct Account {
+    pub account_id: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+}
+
+impl Account {
+    /// The account in a `/whoami` response, if it names one.
+    pub fn from_whoami(me: &serde_json::Value) -> Option<Account> {
+        let account = me.get("account")?;
+        Some(Account {
+            account_id: account.get("account_id")?.as_str()?.to_string(),
+            name: account
+                .get("name")
+                .and_then(serde_json::Value::as_str)
+                .filter(|n| !n.is_empty())
+                .map(String::from),
+        })
+    }
 }
 
 /// Which token a caller needs from the session.
@@ -64,6 +92,7 @@ impl Session {
             id_token: String::new(),
             access_token: None,
             access_token_expires_at: None,
+            account: None,
         };
         session.apply(tokens, now);
         session

From c7711a6d38b2be0b0b6aa3471ca1b461da3e06b0 Mon Sep 17 00:00:00 2001
From: Anthony Lukach <anthonylukach@gmail.com>
Date: Wed, 14 Oct 2026 10:41:35 -0700
Subject: [PATCH 3/5] feat: auth status links the account's profile and says
 when the login was renewed

auth status adds a Profile row (the account on the site the login was
for) and says when the refresh token was last renewed, with its expiry
where the provider gives one. Ory's refresh tokens are opaque and their
lifespan is its own setting, restarted at each renewal, so the renewal
time is what can be known. The session records it, and the expiry when
given (refresh_token_expires_in / refresh_expires_in), as optional
fields that older sessions read without.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md      |  5 +++-
 src/main.rs    | 77 ++++++++++++++++++++++++++++++++++++++++++++++----
 src/oidc.rs    |  7 +++++
 src/product.rs |  5 +++-
 src/session.rs | 40 ++++++++++++++++++++++++++
 5 files changed, 126 insertions(+), 8 deletions(-)

diff --git a/README.md b/README.md
index 36ee74c..5291074 100644
--- a/README.md
+++ b/README.md
@@ -105,12 +105,15 @@ source-coop auth status
 Environment    production (https://data.source.coop)
 Login          logged in
 Account        Anthony Lukach (alukach)
-Refresh token  yes
+Profile        https://source.coop/alukach
+Refresh token  yes, renewed 2026-10-13T14:00:00Z (3 hours ago)
 ID token       expires 2026-10-13T18:00:00Z
 Access token   for https://source.coop, expires 2026-10-13T18:00:00Z
 Credentials    _default: expire 2026-10-13T18:30:00Z
 ```
 
+**How long until you must log in again** is set by the refresh token, which `creds` and API commands use to renew everything else. source.coop's login (Ory) issues opaque refresh tokens and doesn't say how long they last: that's its own setting (30 days by default), and each renewal starts it again. So `auth status` shows when the refresh token was last renewed, and an expiry only for providers that give one. A login from before this was kept shows just `yes` until its next renewal or `auth login`. The profile link is on the site the login was for (`https://staging.source.coop` for a staging login).
+
 The keyring can't list its entries, so `auth status` reports on one environment and role. Pass `--proxy-url` and `--role-arn` (or set `SOURCE_PROXY_URL` and `SOURCE_ROLE_ARN`) to check others.
 
 ### Setting credentials on the environment
diff --git a/src/main.rs b/src/main.rs
index f26ba4b..17dafbb 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -327,6 +327,23 @@ fn run_status(args: StatusArgs) -> Result<(), String> {
     Ok(())
 }
 
+/// The site a session's account lives on: the API audience it was issued
+/// for (`https://source.coop`, or a staging or preview site), else this
+/// build's.
+fn site(s: &session::Session) -> &str {
+    s.audience
+        .as_deref()
+        .filter(|a| !a.is_empty())
+        .unwrap_or(defaults::API_URL)
+        .trim_end_matches('/')
+}
+
+/// A Unix timestamp as RFC 3339, the API's date format.
+fn rfc3339(t: i64) -> Option<String> {
+    chrono::DateTime::from_timestamp(t, 0)
+        .map(|t| t.to_rfc3339_opts(chrono::SecondsFormat::Secs, true))
+}
+
 /// `<expires> <time>` for a Unix timestamp, or `expired <time>` (yellow)
 /// once it's past, as of `now`.
 fn expiry(exp: Option<i64>, now: i64, expires: &str, color: bool) -> String {
@@ -379,12 +396,33 @@ fn status_report(
                     None => style::paint(color, "2", "unknown until your next `auth login`"),
                 },
             ));
-            let refresh = if s.refresh_token.is_some() {
-                "yes"
-            } else {
-                "no"
+            if let Some(a) = &s.account {
+                rows.push((
+                    "Profile",
+                    style::paint(color, "4", &format!("{}/{}", site(s), a.account_id)),
+                ));
+            }
+            // Ory's refresh tokens are opaque and their lifespan is server
+            // config, so this can say when the login was last renewed, and
+            // when it expires only where the provider said.
+            let refresh = match (&s.refresh_token, s.refresh_token_issued_at) {
+                (None, _) => "none: log in again when the ID token expires".into(),
+                (Some(_), None) => "yes".into(),
+                (Some(_), Some(issued)) => {
+                    let ago = match chrono::DateTime::from_timestamp(issued, 0)
+                        .zip(chrono::DateTime::from_timestamp(now, 0))
+                    {
+                        Some((then, at)) => format!(" ({})", product::ago(then, at)),
+                        None => String::new(),
+                    };
+                    format!("yes, renewed {}{ago}", rfc3339(issued).unwrap_or_default())
+                }
+            };
+            let refresh = match s.refresh_token_expires_at {
+                Some(exp) => format!("{refresh}; {}", expiry(Some(exp), now, "expires", color)),
+                None => refresh,
             };
-            rows.push(("Refresh token", refresh.into()));
+            rows.push(("Refresh token", refresh));
             rows.push(("ID token", expiry(id_exp, now, "expires", color)));
             rows.push((
                 "Access token",
@@ -730,6 +768,8 @@ mod tests {
             access_token: Some("at".into()),
             access_token_expires_at: Some(now - 60),
             account,
+            refresh_token_issued_at: Some(now - 3 * 3600),
+            refresh_token_expires_at: None,
         }
     }
 
@@ -755,13 +795,38 @@ mod tests {
             "Environment    production (https://data.source.coop)\n\
              Login          logged in\n\
              Account        Anthony Lukach (alukach)\n\
-             Refresh token  yes\n\
+             Profile        https://source.coop/alukach\n\
+             Refresh token  yes, renewed 2026-10-13T14:00:00Z (3 hours ago)\n\
              ID token       expires 2026-10-13T18:00:00Z\n\
              Access token   for https://source.coop, expired 2026-10-13T16:59:00Z\n\
              Credentials    _default: expire 2026-10-13T18:30:00Z\n"
         );
     }
 
+    #[test]
+    fn status_shows_the_refresh_tokens_expiry_where_the_provider_gave_one() {
+        let now = 1_791_910_800;
+        let mut s = live_session(now, None);
+        s.refresh_token_expires_at = Some(now + 30 * 86_400);
+        let report = status_report(
+            "https://data.source.coop",
+            None,
+            "_default",
+            Some(&s),
+            None,
+            now,
+            false,
+        );
+        assert!(
+            report.contains(
+                "Refresh token  yes, renewed 2026-10-13T14:00:00Z (3 hours ago); expires 2026-11-12T17:00:00Z\n"
+            ),
+            "{report}"
+        );
+        // No Profile row without a known account.
+        assert!(!report.contains("Profile"), "{report}");
+    }
+
     #[test]
     fn status_says_when_the_account_is_unknown_or_nobody_is_logged_in() {
         let now = 1_791_910_800;
diff --git a/src/oidc.rs b/src/oidc.rs
index bf525bc..41c3d6b 100644
--- a/src/oidc.rs
+++ b/src/oidc.rs
@@ -71,6 +71,10 @@ pub struct Tokens {
     pub refresh_token: Option<String>,
     pub access_token: Option<String>,
     pub expires_in: Option<i64>,
+    /// The refresh token's lifetime in seconds, from the providers that say
+    /// (`refresh_token_expires_in`, or `refresh_expires_in`). Ory doesn't:
+    /// its refresh tokens are opaque and their lifespan is server config.
+    pub refresh_expires_in: Option<i64>,
 }
 
 /// Run the browser-based OAuth2 Authorization Code flow with PKCE.
@@ -313,6 +317,9 @@ async fn token_request(
         refresh_token: body["refresh_token"].as_str().map(String::from),
         access_token: body["access_token"].as_str().map(String::from),
         expires_in: body["expires_in"].as_i64(),
+        refresh_expires_in: body["refresh_token_expires_in"]
+            .as_i64()
+            .or_else(|| body["refresh_expires_in"].as_i64()),
     })
 }
 
diff --git a/src/product.rs b/src/product.rs
index 788aa9c..b41df03 100644
--- a/src/product.rs
+++ b/src/product.rs
@@ -1412,7 +1412,10 @@ fn product_lines(p: &Value, site: &str, color: bool) -> Vec<String> {
 
 /// How long ago `then` was, at `now`, in the largest whole unit: "just now",
 /// "5 minutes ago", "3 days ago", "2 years ago".
-fn ago(then: chrono::DateTime<chrono::Utc>, now: chrono::DateTime<chrono::Utc>) -> String {
+pub(crate) fn ago(
+    then: chrono::DateTime<chrono::Utc>,
+    now: chrono::DateTime<chrono::Utc>,
+) -> String {
     let secs = (now - then).num_seconds();
     if secs < 0 {
         return "in the future".into();
diff --git a/src/session.rs b/src/session.rs
index 772f904..c79380e 100644
--- a/src/session.rs
+++ b/src/session.rs
@@ -40,6 +40,14 @@ pub struct Session {
     /// (no access token) and in sessions written before it was kept.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub account: Option<Account>,
+    /// When the refresh token was issued or last rotated, in Unix seconds:
+    /// how long ago the login was renewed. Absent in sessions written before
+    /// it was kept.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub refresh_token_issued_at: Option<i64>,
+    /// When the refresh token expires, in Unix seconds, if the provider said.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub refresh_token_expires_at: Option<i64>,
 }
 
 /// The source.coop account a session acts as.
@@ -93,6 +101,8 @@ impl Session {
             access_token: None,
             access_token_expires_at: None,
             account: None,
+            refresh_token_issued_at: None,
+            refresh_token_expires_at: None,
         };
         session.apply(tokens, now);
         session
@@ -103,6 +113,8 @@ impl Session {
         self.id_token = tokens.id_token;
         if let Some(rotated) = tokens.refresh_token {
             self.refresh_token = Some(rotated);
+            self.refresh_token_issued_at = Some(now);
+            self.refresh_token_expires_at = tokens.refresh_expires_in.map(|s| now + s);
         }
         self.access_token_expires_at = tokens
             .expires_in
@@ -228,6 +240,7 @@ mod tests {
             refresh_token: Some("rt-1".into()),
             access_token: access.map(String::from),
             expires_in,
+            refresh_expires_in: None,
         }
     }
 
@@ -253,6 +266,33 @@ mod tests {
             .await;
     }
 
+    #[test]
+    fn a_refresh_tokens_issue_time_follows_rotation_and_its_expiry_needs_saying() {
+        let mut s = Session::new(
+            tokens(NOW + 3600, None, None),
+            "https://data.source.coop".into(),
+            "cid".into(),
+            "https://auth.test/oauth2/token".into(),
+            None,
+            NOW,
+        );
+        assert_eq!(s.refresh_token_issued_at, Some(NOW));
+        // Ory says nothing of a refresh token's lifetime.
+        assert_eq!(s.refresh_token_expires_at, None);
+
+        // A refresh that doesn't rotate it leaves the time as it was...
+        let mut kept = tokens(NOW + 7200, None, None);
+        kept.refresh_token = None;
+        s.apply(kept, NOW + 100);
+        assert_eq!(s.refresh_token_issued_at, Some(NOW));
+        // ...and one that does, from a provider that gives a lifetime, moves both.
+        let mut rotated = tokens(NOW + 7200, None, None);
+        rotated.refresh_expires_in = Some(86_400);
+        s.apply(rotated, NOW + 200);
+        assert_eq!(s.refresh_token_issued_at, Some(NOW + 200));
+        assert_eq!(s.refresh_token_expires_at, Some(NOW + 200 + 86_400));
+    }
+
     #[test]
     fn reads_jwt_expiry() {
         assert_eq!(jwt_exp(&jwt(42)), Some(42));

From 49aeaabb10329c945b8c8dc9b66be54dd4bc49b8 Mon Sep 17 00:00:00 2001
From: Anthony Lukach <anthonylukach@gmail.com>
Date: Wed, 14 Oct 2026 10:59:21 -0700
Subject: [PATCH 4/5] feat: auth status estimates when an unused login lapses

Ory's token response gives no refresh-token lifetime (only the access
token's expires_in) and its refresh tokens are opaque, so auth status
estimates: the last renewal plus a lifetime, 30 days by default (Ory's
default oauth2.ttl.refresh_token) or SOURCE_REFRESH_TOKEN_LIFETIME, worded
as an estimate ("if unused, lapses around <day> (assuming a 30d
lifetime)"). An expiry the provider gives is shown instead. The lifetime
only feeds this estimate; nothing sent at login depends on it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md   |   4 +-
 src/main.rs | 118 ++++++++++++++++++++++++++++++++++++++++++++++++++--
 2 files changed, 116 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index 5291074..a5e530d 100644
--- a/README.md
+++ b/README.md
@@ -106,13 +106,13 @@ Environment    production (https://data.source.coop)
 Login          logged in
 Account        Anthony Lukach (alukach)
 Profile        https://source.coop/alukach
-Refresh token  yes, renewed 2026-10-13T14:00:00Z (3 hours ago)
+Refresh token  yes, renewed 2026-10-13T14:00:00Z (3 hours ago); if unused, lapses around 2026-11-12 (assuming a 30d lifetime)
 ID token       expires 2026-10-13T18:00:00Z
 Access token   for https://source.coop, expires 2026-10-13T18:00:00Z
 Credentials    _default: expire 2026-10-13T18:30:00Z
 ```
 
-**How long until you must log in again** is set by the refresh token, which `creds` and API commands use to renew everything else. source.coop's login (Ory) issues opaque refresh tokens and doesn't say how long they last: that's its own setting (30 days by default), and each renewal starts it again. So `auth status` shows when the refresh token was last renewed, and an expiry only for providers that give one. A login from before this was kept shows just `yes` until its next renewal or `auth login`. The profile link is on the site the login was for (`https://staging.source.coop` for a staging login).
+**How long until you must log in again** is set by the refresh token, which `creds` and API commands use to renew everything else, so the expiries of the ID token, access token and credentials don't force a login. source.coop's login (Ory) issues opaque refresh tokens, and its token response doesn't say how long they last: that's an Ory project setting, and each renewal starts the clock again. So `auth status` shows when the refresh token was last renewed and estimates when it lapses if left unused, assuming a 30-day lifetime (Ory's default). Set `SOURCE_REFRESH_TOKEN_LIFETIME` (e.g. `720h`, `14d`) if the server uses another; it only changes this estimate, since a login can't ask for a lifetime. Where a provider does give an expiry, that's shown instead. A login from before renewals were recorded shows just `yes` until its next renewal or `auth login`. The profile link is on the site the login was for (`https://staging.source.coop` for a staging login).
 
 The keyring can't list its entries, so `auth status` reports on one environment and role. Pass `--proxy-url` and `--role-arn` (or set `SOURCE_PROXY_URL` and `SOURCE_ROLE_ARN`) to check others.
 
diff --git a/src/main.rs b/src/main.rs
index 17dafbb..3a96480 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -20,6 +20,7 @@ mod defaults {
     pub const PROXY_URL: &str = "https://data.staging.source.coop";
     pub const ROLE_ARN: &str = "_default";
     pub const API_URL: &str = "https://staging.source.coop";
+    pub const REFRESH_TOKEN_LIFETIME: &str = "30d";
 }
 
 #[cfg(not(feature = "staging"))]
@@ -29,6 +30,10 @@ mod defaults {
     pub const PROXY_URL: &str = "https://data.source.coop";
     pub const ROLE_ARN: &str = "_default";
     pub const API_URL: &str = "https://source.coop";
+    /// Ory's default `oauth2.ttl.refresh_token`: its refresh tokens carry no
+    /// expiry and the token response gives none, so `auth status` counts from
+    /// the last renewal. Overridden by `SOURCE_REFRESH_TOKEN_LIFETIME`.
+    pub const REFRESH_TOKEN_LIFETIME: &str = "30d";
 }
 
 /// Parse a duration into seconds. Accepts a bare number (seconds) or a value
@@ -312,6 +317,7 @@ fn run_status(args: StatusArgs) -> Result<(), String> {
     let env = cache::env(&args.proxy_url)?;
     let session = cache::read_session(env.as_deref())?;
     let entry = cache::read_credentials(env.as_deref(), &args.role_arn)?;
+    let lifetime = refresh_lifetime()?;
     print!(
         "{}",
         status_report(
@@ -321,12 +327,27 @@ fn run_status(args: StatusArgs) -> Result<(), String> {
             session.as_ref(),
             entry.as_ref().map(|e| &e.creds),
             chrono::Utc::now().timestamp(),
+            Some((lifetime.0, lifetime.1.as_str())),
             style::wanted(std::io::IsTerminal::is_terminal(&std::io::stdout())),
         )
     );
     Ok(())
 }
 
+/// How long a refresh token lasts unused, in seconds, with how it was given
+/// (`30d`): `SOURCE_REFRESH_TOKEN_LIFETIME`, else this build's default. The
+/// provider doesn't say, so this is what `auth status` estimates from. It's
+/// only for display: OAuth2 has no way to ask for a refresh token's lifetime,
+/// so nothing sent at login depends on it; Ory's project config decides.
+fn refresh_lifetime() -> Result<(i64, String), String> {
+    let text = std::env::var("SOURCE_REFRESH_TOKEN_LIFETIME")
+        .ok()
+        .filter(|v| !v.trim().is_empty())
+        .unwrap_or_else(|| defaults::REFRESH_TOKEN_LIFETIME.to_string());
+    let secs = parse_duration(&text).map_err(|e| format!("SOURCE_REFRESH_TOKEN_LIFETIME: {e}"))?;
+    Ok((secs as i64, text.trim().to_string()))
+}
+
 /// The site a session's account lives on: the API audience it was issued
 /// for (`https://source.coop`, or a staging or preview site), else this
 /// build's.
@@ -362,7 +383,10 @@ fn expiry(exp: Option<i64>, now: i64, expires: &str, color: bool) -> String {
 
 /// The `auth status` report for one environment and role, as of `now`: a
 /// `Label  value` row each, labels dim and the login's state green (logged
-/// in) or red (expired, not logged in) when `color`.
+/// in) or red (expired, not logged in) when `color`. `refresh_lifetime`, the
+/// assumed lifetime and how it was given, estimates when an unused login lapses.
+// Every input is a separate fact the report shows; a struct would only rename them.
+#[allow(clippy::too_many_arguments)]
 fn status_report(
     proxy_url: &str,
     env: Option<&str>,
@@ -370,6 +394,7 @@ fn status_report(
     session: Option<&session::Session>,
     creds: Option<&sts::Credentials>,
     now: i64,
+    refresh_lifetime: Option<(i64, &str)>,
     color: bool,
 ) -> String {
     let mut rows = vec![(
@@ -418,9 +443,34 @@ fn status_report(
                     format!("yes, renewed {}{ago}", rfc3339(issued).unwrap_or_default())
                 }
             };
-            let refresh = match s.refresh_token_expires_at {
-                Some(exp) => format!("{refresh}; {}", expiry(Some(exp), now, "expires", color)),
-                None => refresh,
+            // An expiry the provider gave is exact. Otherwise, estimate it from
+            // the last renewal and the configured lifetime, and say so: the
+            // real lifetime is server config this can't see.
+            let refresh = match (
+                &s.refresh_token,
+                s.refresh_token_expires_at,
+                s.refresh_token_issued_at.zip(refresh_lifetime),
+            ) {
+                (_, Some(exp), _) => {
+                    format!("{refresh}; {}", expiry(Some(exp), now, "expires", color))
+                }
+                (Some(_), None, Some((issued, (secs, label)))) => {
+                    let at = issued + secs;
+                    let day = chrono::DateTime::from_timestamp(at, 0)
+                        .map(|d| d.format("%Y-%m-%d").to_string())
+                        .unwrap_or_default();
+                    let note = if at > now {
+                        format!("if unused, lapses around {day} (assuming a {label} lifetime)")
+                    } else {
+                        style::paint(
+                            color,
+                            "33",
+                            &format!("probably lapsed around {day} (assuming a {label} lifetime)"),
+                        )
+                    };
+                    format!("{refresh}; {note}")
+                }
+                _ => refresh,
             };
             rows.push(("Refresh token", refresh));
             rows.push(("ID token", expiry(id_exp, now, "expires", color)));
@@ -788,6 +838,7 @@ mod tests {
             Some(&live_session(now, Some(me))),
             Some(&creds("2026-10-13T18:30:00Z")),
             now,
+            None,
             false,
         );
         assert_eq!(
@@ -815,6 +866,7 @@ mod tests {
             Some(&s),
             None,
             now,
+            None,
             false,
         );
         assert!(
@@ -827,6 +879,60 @@ mod tests {
         assert!(!report.contains("Profile"), "{report}");
     }
 
+    #[test]
+    fn status_estimates_when_an_unused_login_lapses_and_says_it_is_an_estimate() {
+        let now = 1_791_910_800; // 2026-10-13T17:00:00Z, renewed 3 hours before
+        let row = |s: &session::Session, lifetime| {
+            let report = status_report(
+                "https://data.source.coop",
+                None,
+                "_default",
+                Some(s),
+                None,
+                now,
+                Some(lifetime),
+                false,
+            );
+            report
+                .lines()
+                .find(|l| l.starts_with("Refresh token"))
+                .unwrap()
+                .to_string()
+        };
+        let s = live_session(now, None);
+        assert_eq!(
+            row(&s, (30 * 86_400, "30d")),
+            "Refresh token  yes, renewed 2026-10-13T14:00:00Z (3 hours ago); \
+             if unused, lapses around 2026-11-12 (assuming a 30d lifetime)"
+        );
+        // Renewed longer ago than the lifetime: probably lapsed.
+        assert_eq!(
+            row(&s, (3600, "1h")),
+            "Refresh token  yes, renewed 2026-10-13T14:00:00Z (3 hours ago); \
+             probably lapsed around 2026-10-13 (assuming a 1h lifetime)"
+        );
+        // An expiry the provider gave is exact, and beats the estimate.
+        let mut exact = live_session(now, None);
+        exact.refresh_token_expires_at = Some(now + 86_400);
+        assert!(row(&exact, (30 * 86_400, "30d")).ends_with("; expires 2026-10-14T17:00:00Z"));
+        // Without a renewal time there's nothing to count from.
+        let mut unknown = live_session(now, None);
+        unknown.refresh_token_issued_at = None;
+        assert_eq!(row(&unknown, (30 * 86_400, "30d")), "Refresh token  yes");
+    }
+
+    #[test]
+    fn a_bad_refresh_lifetime_override_says_which_variable() {
+        let err = parse_duration("forever").unwrap_err();
+        assert!(err.contains("invalid duration"), "{err}");
+        // refresh_lifetime() names SOURCE_REFRESH_TOKEN_LIFETIME around that;
+        // the default must always parse.
+        assert_eq!(
+            parse_duration(defaults::REFRESH_TOKEN_LIFETIME),
+            Ok(30 * 86_400)
+        );
+    }
+
     #[test]
     fn status_says_when_the_account_is_unknown_or_nobody_is_logged_in() {
         let now = 1_791_910_800;
@@ -837,6 +943,7 @@ mod tests {
             Some(&live_session(now, None)),
             None,
             now,
+            None,
             false,
         );
         assert!(
@@ -855,6 +962,7 @@ mod tests {
             None,
             None,
             0,
+            None,
             false,
         );
         assert_eq!(
@@ -879,6 +987,7 @@ mod tests {
             Some(&live_session(now, Some(me))),
             None,
             now,
+            None,
             true,
         );
         assert!(
@@ -898,6 +1007,7 @@ mod tests {
             None,
             None,
             now,
+            None,
             true,
         );
         assert!(

From 6a411fda541b5bdcbd815ef82578d2fd3b967676 Mon Sep 17 00:00:00 2001
From: Anthony Lukach <anthonylukach@gmail.com>
Date: Wed, 14 Oct 2026 11:15:42 -0700
Subject: [PATCH 5/5] feat: shorten auth status's refresh-token row
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"renewed <time> (<ago>); expires <when> (in <n> days)", or "expired
<when> (<n> ago)" in yellow, instead of "yes, renewed …; if unused,
lapses around … (assuming a 30d lifetime)". An estimated expiry is
given to the day; one the provider gave, to the second. The README still
explains that the estimate assumes a lifetime.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md   |   4 +-
 src/main.rs | 112 +++++++++++++++++++++++++++++++---------------------
 2 files changed, 69 insertions(+), 47 deletions(-)

diff --git a/README.md b/README.md
index a5e530d..bb22f4b 100644
--- a/README.md
+++ b/README.md
@@ -106,13 +106,13 @@ Environment    production (https://data.source.coop)
 Login          logged in
 Account        Anthony Lukach (alukach)
 Profile        https://source.coop/alukach
-Refresh token  yes, renewed 2026-10-13T14:00:00Z (3 hours ago); if unused, lapses around 2026-11-12 (assuming a 30d lifetime)
+Refresh token  renewed 2026-10-13T14:00:00Z (3 hours ago); expires 2026-11-12 (in 29 days)
 ID token       expires 2026-10-13T18:00:00Z
 Access token   for https://source.coop, expires 2026-10-13T18:00:00Z
 Credentials    _default: expire 2026-10-13T18:30:00Z
 ```
 
-**How long until you must log in again** is set by the refresh token, which `creds` and API commands use to renew everything else, so the expiries of the ID token, access token and credentials don't force a login. source.coop's login (Ory) issues opaque refresh tokens, and its token response doesn't say how long they last: that's an Ory project setting, and each renewal starts the clock again. So `auth status` shows when the refresh token was last renewed and estimates when it lapses if left unused, assuming a 30-day lifetime (Ory's default). Set `SOURCE_REFRESH_TOKEN_LIFETIME` (e.g. `720h`, `14d`) if the server uses another; it only changes this estimate, since a login can't ask for a lifetime. Where a provider does give an expiry, that's shown instead. A login from before renewals were recorded shows just `yes` until its next renewal or `auth login`. The profile link is on the site the login was for (`https://staging.source.coop` for a staging login).
+**How long until you must log in again** is set by the refresh token, which `creds` and API commands use to renew everything else, so the expiries of the ID token, access token and credentials don't force a login. source.coop's login (Ory) issues opaque refresh tokens, and its token response doesn't say how long they last: that's an Ory project setting, and each renewal starts the clock again. So `auth status` shows when the refresh token was last renewed, and when it expires if left unused: an estimate, to the day, assuming a 30-day lifetime (Ory's default). Set `SOURCE_REFRESH_TOKEN_LIFETIME` (e.g. `720h`, `14d`) if the server uses another; it only changes this estimate, since a login can't ask for a lifetime. Where a provider does give an expiry, that's shown instead. A login from before renewals were recorded shows just `yes` until its next renewal or `auth login`. The profile link is on the site the login was for (`https://staging.source.coop` for a staging login).
 
 The keyring can't list its entries, so `auth status` reports on one environment and role. Pass `--proxy-url` and `--role-arn` (or set `SOURCE_PROXY_URL` and `SOURCE_ROLE_ARN`) to check others.
 
diff --git a/src/main.rs b/src/main.rs
index 3a96480..7c3919c 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -359,6 +359,23 @@ fn site(s: &session::Session) -> &str {
         .trim_end_matches('/')
 }
 
+/// `at` relative to `now`, in the largest whole unit: "3 hours ago", or
+/// "in 29 days" while still ahead.
+fn relative(at: i64, now: i64) -> String {
+    let Some((at_t, now_t)) =
+        chrono::DateTime::from_timestamp(at, 0).zip(chrono::DateTime::from_timestamp(now, 0))
+    else {
+        return String::new();
+    };
+    if at <= now {
+        return product::ago(at_t, now_t);
+    }
+    match product::ago(now_t, at_t).as_str() {
+        "just now" => "in under a minute".into(),
+        ahead => format!("in {}", ahead.trim_end_matches(" ago")),
+    }
+}
+
 /// A Unix timestamp as RFC 3339, the API's date format.
 fn rfc3339(t: i64) -> Option<String> {
     chrono::DateTime::from_timestamp(t, 0)
@@ -427,50 +444,44 @@ fn status_report(
                     style::paint(color, "4", &format!("{}/{}", site(s), a.account_id)),
                 ));
             }
-            // Ory's refresh tokens are opaque and their lifespan is server
-            // config, so this can say when the login was last renewed, and
-            // when it expires only where the provider said.
+            // `renewed <time> (<ago>); expires <when> (<in>)`. Ory's refresh
+            // tokens are opaque and its token response gives no lifetime, so
+            // the expiry is the provider's where it said, and otherwise the
+            // last renewal plus the configured lifetime (to the day, as it's
+            // an estimate; the README says so).
             let refresh = match (&s.refresh_token, s.refresh_token_issued_at) {
                 (None, _) => "none: log in again when the ID token expires".into(),
                 (Some(_), None) => "yes".into(),
-                (Some(_), Some(issued)) => {
-                    let ago = match chrono::DateTime::from_timestamp(issued, 0)
-                        .zip(chrono::DateTime::from_timestamp(now, 0))
-                    {
-                        Some((then, at)) => format!(" ({})", product::ago(then, at)),
-                        None => String::new(),
-                    };
-                    format!("yes, renewed {}{ago}", rfc3339(issued).unwrap_or_default())
-                }
+                (Some(_), Some(issued)) => format!(
+                    "renewed {} ({})",
+                    rfc3339(issued).unwrap_or_default(),
+                    relative(issued, now)
+                ),
             };
-            // An expiry the provider gave is exact. Otherwise, estimate it from
-            // the last renewal and the configured lifetime, and say so: the
-            // real lifetime is server config this can't see.
-            let refresh = match (
-                &s.refresh_token,
-                s.refresh_token_expires_at,
-                s.refresh_token_issued_at.zip(refresh_lifetime),
-            ) {
-                (_, Some(exp), _) => {
-                    format!("{refresh}; {}", expiry(Some(exp), now, "expires", color))
-                }
-                (Some(_), None, Some((issued, (secs, label)))) => {
+            let expires = match (s.refresh_token_expires_at, s.refresh_token_issued_at) {
+                (Some(exp), _) => Some((exp, rfc3339(exp).unwrap_or_default())),
+                (None, Some(issued)) => refresh_lifetime.map(|(secs, _)| {
                     let at = issued + secs;
                     let day = chrono::DateTime::from_timestamp(at, 0)
                         .map(|d| d.format("%Y-%m-%d").to_string())
                         .unwrap_or_default();
-                    let note = if at > now {
-                        format!("if unused, lapses around {day} (assuming a {label} lifetime)")
-                    } else {
-                        style::paint(
-                            color,
-                            "33",
-                            &format!("probably lapsed around {day} (assuming a {label} lifetime)"),
-                        )
-                    };
-                    format!("{refresh}; {note}")
+                    (at, day)
+                }),
+                _ => None,
+            };
+            let refresh = match expires.filter(|_| s.refresh_token.is_some()) {
+                Some((at, when)) if at > now => {
+                    format!("{refresh}; expires {when} ({})", relative(at, now))
                 }
-                _ => refresh,
+                Some((at, when)) => format!(
+                    "{refresh}; {}",
+                    style::paint(
+                        color,
+                        "33",
+                        &format!("expired {when} ({})", relative(at, now))
+                    )
+                ),
+                None => refresh,
             };
             rows.push(("Refresh token", refresh));
             rows.push(("ID token", expiry(id_exp, now, "expires", color)));
@@ -847,7 +858,7 @@ mod tests {
              Login          logged in\n\
              Account        Anthony Lukach (alukach)\n\
              Profile        https://source.coop/alukach\n\
-             Refresh token  yes, renewed 2026-10-13T14:00:00Z (3 hours ago)\n\
+             Refresh token  renewed 2026-10-13T14:00:00Z (3 hours ago)\n\
              ID token       expires 2026-10-13T18:00:00Z\n\
              Access token   for https://source.coop, expired 2026-10-13T16:59:00Z\n\
              Credentials    _default: expire 2026-10-13T18:30:00Z\n"
@@ -871,7 +882,7 @@ mod tests {
         );
         assert!(
             report.contains(
-                "Refresh token  yes, renewed 2026-10-13T14:00:00Z (3 hours ago); expires 2026-11-12T17:00:00Z\n"
+                "Refresh token  renewed 2026-10-13T14:00:00Z (3 hours ago); expires 2026-11-12T17:00:00Z (in 1 month)\n"
             ),
             "{report}"
         );
@@ -880,7 +891,7 @@ mod tests {
     }
 
     #[test]
-    fn status_estimates_when_an_unused_login_lapses_and_says_it_is_an_estimate() {
+    fn status_estimates_when_an_unused_login_expires() {
         let now = 1_791_910_800; // 2026-10-13T17:00:00Z, renewed 3 hours before
         let row = |s: &session::Session, lifetime| {
             let report = status_report(
@@ -902,25 +913,36 @@ mod tests {
         let s = live_session(now, None);
         assert_eq!(
             row(&s, (30 * 86_400, "30d")),
-            "Refresh token  yes, renewed 2026-10-13T14:00:00Z (3 hours ago); \
-             if unused, lapses around 2026-11-12 (assuming a 30d lifetime)"
+            "Refresh token  renewed 2026-10-13T14:00:00Z (3 hours ago); \
+             expires 2026-11-12 (in 29 days)"
         );
-        // Renewed longer ago than the lifetime: probably lapsed.
+        // Renewed longer ago than the lifetime: expired.
         assert_eq!(
             row(&s, (3600, "1h")),
-            "Refresh token  yes, renewed 2026-10-13T14:00:00Z (3 hours ago); \
-             probably lapsed around 2026-10-13 (assuming a 1h lifetime)"
+            "Refresh token  renewed 2026-10-13T14:00:00Z (3 hours ago); \
+             expired 2026-10-13 (2 hours ago)"
         );
-        // An expiry the provider gave is exact, and beats the estimate.
+        // An expiry the provider gave is exact, to the second, and beats the
+        // estimate.
         let mut exact = live_session(now, None);
         exact.refresh_token_expires_at = Some(now + 86_400);
-        assert!(row(&exact, (30 * 86_400, "30d")).ends_with("; expires 2026-10-14T17:00:00Z"));
+        assert!(row(&exact, (30 * 86_400, "30d"))
+            .ends_with("; expires 2026-10-14T17:00:00Z (in 1 day)"));
         // Without a renewal time there's nothing to count from.
         let mut unknown = live_session(now, None);
         unknown.refresh_token_issued_at = None;
         assert_eq!(row(&unknown, (30 * 86_400, "30d")), "Refresh token  yes");
     }
 
+    #[test]
+    fn relative_times_read_ahead_and_behind() {
+        let now = 1_791_910_800;
+        assert_eq!(relative(now + 29 * 86_400 + 5, now), "in 29 days");
+        assert_eq!(relative(now + 30, now), "in under a minute");
+        assert_eq!(relative(now - 3 * 3600, now), "3 hours ago");
+        assert_eq!(relative(now, now), "just now");
+    }
+
     #[test]
     fn a_bad_refresh_lifetime_override_says_which_variable() {
         let err = parse_duration("forever").unwrap_err();