fix(local): stop sending the local service key on invoke and storage object I/O

[tkkhq]

Tracking

• Tracks: https://konghq.atlassian.net/browse/VOL-475
• Related: https://konghq.atlassian.net/browse/VOL-474 (server data-plane, volcano-hosting#656)
• Related: https://konghq.atlassian.net/browse/VOL-476 (server management, volcano-hosting#657)

Summary

• stop sending the world-identical local service key (sk-1111…) on the local operator data-plane: volcano functions invoke and volcano storage object … now send no Authorization header in local mode, and the local server defaults an absent credential to the pre-provisioned local user
• internal/config/config.go: add a synthetic Config.LocalMode flag (never persisted); FunctionInvokeToken() returns empty in local mode so both invoke paths send no credential
• internal/cmd/local/local.go: set LocalMode: true in the synthetic local config; drop the now-dead local WithObjectTokenProvider/storageObjectToken wiring (cloud's data-plane-key provider is untouched)
• internal/storage/storage.go: objectAPI sends no credential in local mode (previously an empty token fell back to the platform token, which storage rejects)
• internal/cmd/functions/invoke.go: document volcano functions invoke as a local function-logic harness — real per-user auth (signed-in vs anonymous), RLS, and cross-service behavior are exercised against a cloud deployment or the app-driven path, not the CLI
• cloud is unchanged: it still uses the reserved volcano-cli-data-plane service key via the invoke/object token providers; management commands still send the platform token

Rollout dependency

This depends on the server-side local defaults being present in the running kong/volcano:local-nightly image. VOL-474 (volcano-hosting#656) makes the local server default an absent data-plane credential to the seeded local user; without it, local functions invoke / storage object would 401. Land/deploy the server change (and refresh the local image) before releasing this CLI change.

Verification

• make lint
• make openapi-generated-check
• make test

[Copilot]

Pull request overview

Stops local function invocation and storage object operations from sending the shared local service key.

Changes:

• Adds a synthetic LocalMode configuration flag.
• Omits data-plane credentials locally while preserving cloud and management authentication.
• Updates command guidance and authentication tests.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
internal/storage/storage.go	Uses an unauthenticated client for local object operations.
internal/config/config.go	Adds LocalMode and suppresses local invoke tokens.
internal/config/config_test.go	Tests local invoke token suppression.
internal/cmd/root/root_test.go	Verifies direct local invocation omits authorization.
internal/cmd/local/local.go	Marks local configs and removes the object-token provider.
internal/cmd/local/local_test.go	Verifies local object uploads omit authorization.
internal/cmd/functions/invoke.go	Documents local invocation authentication semantics.
internal/cmd/functions/invoke_test.go	Verifies invoke authentication while retaining management authentication.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.