fix(auth): identify workspace sessions by account

[AmanVarshney01]

What this PR does

Makes local workspace sessions clearly identifiable when multiple Prisma accounts have authorized workspaces on the same machine.

The observed failure mode was:

• Console showed many workspace memberships for the browser account.
• auth workspace list showed only two entries, including a stale Personal workspace.
• Those entries are local OAuth sessions, not the remote Console membership list.
• Sessions may belong to different Prisma users, but the CLI did not expose that identity.
• Real OAuth access tokens contain a user subject but do not necessarily contain an email, so decoding JWT claims alone cannot solve the UX.

Product behavior

• auth login resolves the authorizing account through /v1/me and stores only safe user metadata: id, email, and name.
• auth workspace list displays Workspace, User, Id, and Status.
• auth workspace use selection labels include the account identity.
• Login, workspace use, and workspace logout human and JSON results include the user.
• Ambiguous same-name workspace errors identify each matching account.
• JSON list results add items[].user and context.scope = "local-sessions".
• Workspace list always offers auth login as the next action so users can authorize another workspace.
• Older sessions are enriched best-effort and successful results are cached; ordinary sessions() reads remain local-only.
• If metadata is unavailable, output falls back to token claims and never guesses that a stale session belongs to the active account.

Safety and compatibility

• Token and refresh-token material never enters command results or renderers.
• Safe user metadata is stored in the existing mode-0600 credentials file.
• Stored metadata is normalized on read and the state schema remains backward compatible.
• Metadata lookups are best-effort and time-bounded; auth commands still work offline.
• Enrichment results are applied only if the workspace credential has not been replaced concurrently.
• Token rotation preserves stored account metadata.
• Expired or invalid legacy sessions are not silently removed.
• The extension stays inside packages/cli; the published @prisma/cli-engine@0.2.0 contract is unchanged, so Composer and ORM keep resolving one compatible engine.

Important scope boundary

This command lists workspace sessions authorized on this machine. It is not a list of every workspace membership visible in Console.

This PR does not fix the separate auth.prisma.io browser-session/account-switching problem. The OAuth authorization page can still open under a different browser account than console.prisma.io and currently has no clear account indicator or switch action; that needs a control-plane/auth UI follow-up.

After this lands, create-prisma should consume items[].user when rendering its own workspace deployment picker. The structured field added here is the supported input for that follow-up.

Verification

• node scripts/check-engine-version.mjs origin/main: engine version 0.2.0 is consistent
• pnpm lint
• pnpm typecheck
• pnpm check:grammar
• pnpm check:conformance: 5 subjects checked, nothing to report
• pnpm --filter @prisma/cli test: 985 passed, 1 skipped
• Targeted auth and credential tests: 104 passed
• Smoke-tested against a copy of the real local auth state: the active session resolved to varshney@prisma.io; an expired legacy session remained safely unidentified rather than being mislabeled or deleted

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 87e88932-cd0a-45ea-abc5-a96f0a13c43d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

npx https://pkg.pr.new/@prisma/cli@214

npx https://pkg.pr.new/@prisma/cli-engine@214

commit: e627c95