fix: AWS elevation shows Azure CLI message (#37)

* fix: use CSP to determine post-elevation message instead of AccessCredentials

AWS elevations with nil AccessCredentials incorrectly showed the Azure
CLI message. Switch on target CSP so AWS always gets AWS-appropriate
guidance and Azure gets the az CLI message.

Also fix time-sensitive test in session_tracker_test.go that used a
hardcoded past date, causing failures after 24h elapsed.

* fix: use explicit CSPAzure case instead of default in post-elevation switch

The default case would incorrectly show the Azure CLI message for any
future CSP. Using an explicit case means unknown CSPs simply show no
post-elevation guidance, which is the safer behavior.

---------

Co-authored-by: Tim Schindler <tim@iosharp.com>

Author: svnlto

cmd/root.go

@@ -811,16 +811,21 @@ func runElevateWithDeps(
 	fmt.Fprintf(cmd.OutOrStdout(), "  Session ID: %s\n", res.result.SessionID)
 
 	// CSP-aware post-elevation guidance
-	if res.result.AccessCredentials != nil {
-		awsCreds, err := models.ParseAWSCredentials(*res.result.AccessCredentials)
-		if err != nil {
-			return fmt.Errorf("failed to parse access credentials: %w", err)
+	switch res.target.CSP {
+	case models.CSPAWS:
+		if res.result.AccessCredentials != nil {
+			awsCreds, err := models.ParseAWSCredentials(*res.result.AccessCredentials)
+			if err != nil {
+				return fmt.Errorf("failed to parse access credentials: %w", err)
+			}
+			fmt.Fprintf(cmd.OutOrStdout(), "\n  export AWS_ACCESS_KEY_ID='%s'\n", awsCreds.AccessKeyID)
+			fmt.Fprintf(cmd.OutOrStdout(), "  export AWS_SECRET_ACCESS_KEY='%s'\n", awsCreds.SecretAccessKey)
+			fmt.Fprintf(cmd.OutOrStdout(), "  export AWS_SESSION_TOKEN='%s'\n", awsCreds.SessionToken)
+			fmt.Fprintf(cmd.OutOrStdout(), "\n  Or run: eval $(grant env --provider aws)\n")
+		} else {
+			fmt.Fprintf(cmd.OutOrStdout(), "\n  Run: eval $(grant env --provider aws) to get credentials.\n")
 		}
-		fmt.Fprintf(cmd.OutOrStdout(), "\n  export AWS_ACCESS_KEY_ID='%s'\n", awsCreds.AccessKeyID)
-		fmt.Fprintf(cmd.OutOrStdout(), "  export AWS_SECRET_ACCESS_KEY='%s'\n", awsCreds.SecretAccessKey)
-		fmt.Fprintf(cmd.OutOrStdout(), "  export AWS_SESSION_TOKEN='%s'\n", awsCreds.SessionToken)
-		fmt.Fprintf(cmd.OutOrStdout(), "\n  Or run: eval $(grant env --provider aws)\n")
-	} else {
+	case models.CSPAzure:
 		fmt.Fprintf(cmd.OutOrStdout(), "\n  Your az CLI session now has the elevated permissions.\n")
 	}
 

cmd/root_elevate_test.go

@@ -17,11 +17,12 @@ import (
 
 func TestRootElevate_InteractiveMode(t *testing.T) {
 	tests := []struct {
-		name        string
-		setupMocks  func() (*mockAuthLoader, *mockEligibilityLister, *mockElevateService, *mockUnifiedSelector, *config.Config)
-		args        []string
-		wantContain []string
-		wantErr     bool
+		name           string
+		setupMocks     func() (*mockAuthLoader, *mockEligibilityLister, *mockElevateService, *mockUnifiedSelector, *config.Config)
+		args           []string
+		wantContain    []string
+		wantNotContain []string
+		wantErr        bool
 	}{
 		{
 			name: "interactive mode success",
@@ -314,6 +315,69 @@ func TestRootElevate_InteractiveMode(t *testing.T) {
 			},
 			wantErr: false,
 		},
+		{
+			name: "AWS elevation without credentials should not show Azure message",
+			setupMocks: func() (*mockAuthLoader, *mockEligibilityLister, *mockElevateService, *mockUnifiedSelector, *config.Config) {
+				authLoader := &mockAuthLoader{
+					token: &authmodels.IdsecToken{
+						Token:     "test-jwt",
+						Username:  "test@example.com",
+						ExpiresIn: commonmodels.IdsecRFC3339Time(time.Now().Add(1 * time.Hour)),
+					},
+				}
+
+				awsTarget := models.EligibleTarget{
+					CSP:            models.CSPAWS,
+					OrganizationID: "o-abc123",
+					WorkspaceID:    "123456789012",
+					WorkspaceName:  "test-aws-account-7x9k",
+					WorkspaceType:  models.WorkspaceTypeAccount,
+					RoleInfo: models.RoleInfo{
+						ID:   "arn:aws:iam::123456789012:role/Edit",
+						Name: "Edit",
+					},
+				}
+
+				eligibilityLister := &mockEligibilityLister{
+					listFunc: func(ctx context.Context, csp models.CSP) (*models.EligibilityResponse, error) {
+						if csp == models.CSPAWS {
+							return &models.EligibilityResponse{Response: []models.EligibleTarget{awsTarget}, Total: 1}, nil
+						}
+						return &models.EligibilityResponse{}, nil
+					},
+				}
+
+				// AWS elevation succeeds but API returns nil AccessCredentials
+				elevateService := &mockElevateService{
+					response: &models.ElevateResponse{
+						Response: models.ElevateAccessResult{
+							CSP:            models.CSPAWS,
+							OrganizationID: "o-abc123",
+							Results: []models.ElevateTargetResult{
+								{
+									WorkspaceID:       "123456789012",
+									RoleID:            "Edit",
+									SessionID:         "session-aws-nocreds",
+									AccessCredentials: nil,
+								},
+							},
+						},
+					},
+				}
+
+				selector := &mockUnifiedSelector{
+					item: &selectionItem{kind: selectionCloud, cloud: &awsTarget},
+				}
+
+				cfg := config.DefaultConfig()
+
+				return authLoader, eligibilityLister, elevateService, selector, cfg
+			},
+			args:           []string{},
+			wantContain:    []string{"Elevated to Edit on test-aws-account-7x9k"},
+			wantNotContain: []string{"az CLI session"},
+			wantErr:        false,
+		},
 		{
 			name: "no eligible targets found across all providers",
 			setupMocks: func() (*mockAuthLoader, *mockEligibilityLister, *mockElevateService, *mockUnifiedSelector, *config.Config) {
@@ -360,6 +424,11 @@ func TestRootElevate_InteractiveMode(t *testing.T) {
 					t.Errorf("output missing %q\ngot:\n%s", want, output)
 				}
 			}
+			for _, notWant := range tt.wantNotContain {
+				if strings.Contains(output, notWant) {
+					t.Errorf("output should not contain %q\ngot:\n%s", notWant, output)
+				}
+			}
 		})
 	}
 }

internal/cache/session_tracker_test.go

@@ -10,7 +10,7 @@ import (
 func TestRecordSession_AndLookup(t *testing.T) {
 	t.Parallel()
 	s := NewStore(t.TempDir(), 25*time.Hour)
-	now := time.Date(2026, 2, 21, 12, 0, 0, 0, time.UTC)
+	now := time.Now().UTC().Truncate(time.Second)
 
 	if err := RecordSession(s, "sess-1", now); err != nil {
 		t.Fatalf("RecordSession() error = %v", err)