feat: Add multi-profile support for managing multiple Okta organizations

[dan-redcupit]

Summary

This PR adds multi-profile support to the Okta CLI, enabling users to manage credentials for multiple Okta organizations using named profiles. This is particularly valuable for:

• Enterprises/MSPs/MSSPs managing multiple internal or client Okta tenants
• Developers working across dev/staging/prod environments
• Consultants switching between customer organizations

New Commands

• okta login --profile-name <name> - Create or update a named profile
• okta profiles list - List all configured profiles with active indicator
• okta profiles use <name> - Switch the active profile
• okta profiles show [name] - Display profile details (token masked)
• okta profiles delete <name> - Remove a profile

New Global Option

• okta --profile <name> <command> - Run any command with a specific profile (one-off)
• OKTA_CLI_PROFILE environment variable - Set profile for shell session

Configuration Format

okta:
  profiles:
    default:
      orgUrl: https://dev-123456.okta.com
      token: 00abc...
    acme-corp:
      orgUrl: https://acme.okta.com  
      token: 00xyz...
  activeProfile: default

Backward Compatibility

• Legacy single-profile format (okta.client.orgUrl/token) is automatically migrated on first write
• Legacy format remains readable without migration
• Existing users' credentials are preserved as the "default" profile

Example Usage

# Login to multiple orgs
okta login --profile-name acme-corp
okta login --profile-name bigco-prod

# List all profiles
okta profiles list
# Output:
#   NAME         ORG URL                         STATUS
#   ----         -------                         ------
# * default      https://dev-123456.okta.com     * active
#   acme-corp    https://acme.okta.com
#   bigco-prod   https://bigco.okta.com

# Switch profiles
okta profiles use acme-corp

# One-off command with specific profile
okta --profile bigco-prod apps list

Test plan

• Unit tests for DefaultProfileConfigurationService
• Manual testing of okta login --profile-name
• Manual testing of okta profiles list/use/show/delete
• Manual testing of okta --profile flag
• Verify backward compatibility with legacy config format
• Verify file permissions (0600) on POSIX systems

Files Changed

New Files

• common/.../model/OktaProfile.java - Profile data model
• common/.../service/ProfileConfigurationService.java - Service interface
• common/.../service/DefaultProfileConfigurationService.java - Implementation
• cli/.../commands/profiles/Profiles.java - Parent command
• cli/.../commands/profiles/ProfilesList.java - List subcommand
• cli/.../commands/profiles/ProfilesUse.java - Use subcommand
• cli/.../commands/profiles/ProfilesShow.java - Show subcommand
• cli/.../commands/profiles/ProfilesDelete.java - Delete subcommand
• common/.../service/DefaultProfileConfigurationServiceTest.groovy - Tests

Modified Files

• cli/.../Environment.java - Added profile state and activation
• cli/.../OktaCli.java - Added --profile flag and profiles command
• cli/.../commands/BaseCommand.java - Activate profile before command execution
• cli/.../commands/Login.java - Support --profile-name option

---

🤖 Generated with Claude Code