Add multi-profile authentication support

README.md

@@ -67,6 +67,47 @@ $ API_SERVER_NAME=local cargo build --release
 
 Explore available commands [here](https://developer.screenly.io/cli/#commands).
 
+## Authentication and profiles
+
+Credentials are stored in `~/.screenly` as named profiles, with one profile active at a time. This lets you keep several tokens (for example one per workspace) and switch between them.
+
+```bash
+# Log in. On a fresh install this creates the "default" profile; with a
+# profile already active it updates that profile (e.g. after a token rotation).
+$ screenly login
+
+# Log in under a specific profile name.
+$ screenly login --name work
+
+# Log in without a prompt, for scripts and CI. --token-stdin is optional when
+# stdin is already a pipe or a file, and required to skip the prompt on a
+# terminal.
+$ echo "$SCREENLY_TOKEN" | screenly login --token-stdin --name ci
+
+# Show the profile you are currently authenticated as.
+$ screenly me
+
+# List stored profiles (the active one is marked with *). Honors --output.
+$ screenly auth list
+
+# Switch the active profile.
+$ screenly auth switch work
+
+# Remove a profile. Without --name, removes the active one.
+$ screenly logout
+$ screenly logout --name work
+```
+
+Removing the active profile leaves no profile active, even when others are still stored. The CLI will not pick a replacement for you, because doing so would silently point the next command at a different workspace. Run `screenly auth switch <name>` to choose one.
+
+The `API_TOKEN` environment variable overrides the stored profiles when set, so `me` and every other command authenticate with that token regardless of the active profile.
+
+Plain-text `~/.screenly` files from older versions are migrated to the profile format automatically on first write.
+
+If `~/.screenly` becomes malformed (for example from a hand-edit), the CLI reports the problem and leaves the file untouched rather than discarding credentials. Fix the file's YAML, or delete it and run `screenly login` to start fresh.
+
+The file holds every profile's token in plain text. On Linux and macOS it is created with `0600` permissions, so only your user can read it. On Windows it inherits the permissions of your home directory, so treat it the way you would any other credentials file. Avoid running two `login` commands at the same time: the CLI replaces the file atomically, but it does not lock it, so simultaneous writes can drop one of the two profiles.
+
 ## Output Formats
 
 All list and get commands support three output formats via the global `--output` (`-o`) flag:

docs/CommandLineHelp.md

@@ -7,6 +7,10 @@ This document contains the help content for the `screenly` command-line program.
 * [`screenly`↴](#screenly)
 * [`screenly login`↴](#screenly-login)
 * [`screenly logout`↴](#screenly-logout)
+* [`screenly me`↴](#screenly-me)
+* [`screenly auth`↴](#screenly-auth)
+* [`screenly auth list`↴](#screenly-auth-list)
+* [`screenly auth switch`↴](#screenly-auth-switch)
 * [`screenly screen`↴](#screenly-screen)
 * [`screenly screen list`↴](#screenly-screen-list)
 * [`screenly screen get`↴](#screenly-screen-get)
@@ -57,7 +61,9 @@ Command line interface is intended for quick interaction with Screenly through t
 ###### **Subcommands:**
 
 * `login` — Logs in with the provided token and stores it for further use if valid. You can set the API_TOKEN environment variable to override the stored token
-* `logout` — Logs out and removes the stored token
+* `logout` — Removes a stored authentication profile. Removing the active profile leaves no profile active; other profiles are kept
+* `me` — Show information about the currently authenticated profile
+* `auth` — Manage stored authentication profiles
 * `screen` — Screen related commands
 * `asset` — Asset related commands
 * `playlist` — Playlist related commands
@@ -85,15 +91,65 @@ Command line interface is intended for quick interaction with Screenly through t
 
 Logs in with the provided token and stores it for further use if valid. You can set the API_TOKEN environment variable to override the stored token
 
-**Usage:** `screenly login`
+**Usage:** `screenly login [OPTIONS]`
+
+###### **Options:**
+
+* `--name <NAME>` — Profile name to store the token under. Defaults to the active profile, or "default" on a fresh install
+* `--token-stdin` — Read the token from stdin instead of prompting, for scripts: `echo "$TOKEN" | screenly login --token-stdin`. Implied when stdin is not a terminal
 
 
 
 ## `screenly logout`
 
-Logs out and removes the stored token
+Removes a stored authentication profile. Removing the active profile leaves no profile active; other profiles are kept
+
+**Usage:** `screenly logout [OPTIONS]`
+
+###### **Options:**
+
+* `--name <NAME>` — Profile name to remove. Removes the active profile if not specified
+
+
+
+## `screenly me`
+
+Show information about the currently authenticated profile
+
+**Usage:** `screenly me`
+
+
+
+## `screenly auth`
+
+Manage stored authentication profiles
+
+**Usage:** `screenly auth <COMMAND>`
+
+###### **Subcommands:**
+
+* `list` — List stored authentication profiles
+* `switch` — Switch the active authentication profile
+
+
+
+## `screenly auth list`
+
+List stored authentication profiles
+
+**Usage:** `screenly auth list`
+
+
+
+## `screenly auth switch`
+
+Switch the active authentication profile
+
+**Usage:** `screenly auth switch [NAME]`
+
+###### **Arguments:**
 
-**Usage:** `screenly logout`
+* `<NAME>` — Profile name to activate. If omitted, the available profiles are listed and the command exits with an error