feat: read the connection settings from ASCENDER_ environment variables

[blaipr]

Every connection setting the client takes from the environment now answers to an ASCENDER_ name: ASCENDER_HOST, ASCENDER_OAUTH_TOKEN, ASCENDER_TOKEN, ASCENDER_USERNAME, ASCENDER_PASSWORD, ASCENDER_VERIFY_SSL, ASCENDER_VERBOSE, ASCENDER_FORMAT and ASCENDER_COLOR.

Same shape as ascender-manage: the new name is what the documentation says, and the old ones keep working.

Why a helper rather than one more level of env.get

The token lookup was already four deep:

default=env.get('CONTROLLER_OAUTH_TOKEN', env.get('CONTROLLER_TOKEN', env.get('TOWER_OAUTH_TOKEN', env.get('TOWER_TOKEN', '')))),

Adding two more spellings inside that would have put the default out of sight of the argument it belongs to. env_default takes the suffix and walks the prefixes, so the precedence is stated once and every argument reads the same way:

default=env_default(env, 'OAUTH_TOKEN', '', extra=('TOKEN',)),

Precedence

ASCENDER_, then CONTROLLER_, then TOWER_, prefix before suffix. So ASCENDER_TOKEN beats CONTROLLER_OAUTH_TOKEN: the prefix says which release the script was written against, where the suffix is only a spelling of the same thing. Below the new prefix the old chain keeps exactly the order it had, and a name that is set but empty still wins over a later one, which is what the nested env.get calls did.

One behaviour change

ascender login -f human prints export ASCENDER_OAUTH_TOKEN= rather than export CONTROLLER_OAUTH_TOKEN=. Both are read, so a shell that already sourced the old line keeps working.

Checking

Eight tests name the precedence one rule at a time, and two more go through parse_args so the wiring is covered rather than just the helper. Both kinds fail against the old code rather than passing regardless.

The integration tests that prove the token path works by stripping the username and password out of the environment now strip all three prefixes. With only one removed, a developer with an older spelling exported would have stayed authenticated by password and those tests would have passed without exercising the token at all.

378 unit tests pass, ruff format --check and ruff check are clean, and the documentation builds with -W.

[ciq-it-service-account]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.