fix: implement flexible account name matching for AWS ARN prefixes

[OlivierCloudar]

Summary

Fixes #25 - Implements account name matching using the credential.id field to support full ARN format, resolving "Account not found" errors when using the daemon with AWS CLI credential_process integration.

Problem

The ykman CLI tool displays AWS account names with full ARN format (e.g., arn:aws:iam::123456:mfa/user), but when querying the daemon API, account lookup failed even though the account existed on the YubiKey.

Root Cause

The yubikey-manager library splits credential IDs on the first : to create issuer and name fields:

• credential.id (bytes): b'arn:aws:iam::123456:mfa/user' - full original value
• credential.issuer: "arn"
• credential.name: "aws:iam::123456:mfa/user" - everything after first :

The ykman CLI displays the full credential.id, but the daemon was only matching against credential.name, causing mismatches.

Solution

Simplified the matching logic to prioritize credential.id (which contains the full original credential string) and fall back to credential.name for backward compatibility.

Changes

Core Implementation (src/yk_daemon/yubikey.py:73)

• Implemented _find_matching_credential() method that:
  1. First tries matching against credential.id (decoded from bytes)
  2. Falls back to matching against credential.name
• Added debug logging in list_accounts() to show credential structure (name, issuer, id)
• Updated generate_totp() to use the new matching method

Tests (tests/test_yubikey.py)

• Added test suite TestAccountNameMatching with 6 test cases:
  • Matching by credential.id with full ARN
  • Matching by credential.name as fallback
  • No match scenarios
  • TOTP generation with full ARN format
  • Multiple AWS accounts scenario

Test Results

All 182 tests pass:

• 6 new tests for account name matching
• All existing tests remain passing (backward compatibility confirmed)
• Linting (ruff) passes
• Type checking (mypy) passes

Backward Compatibility

The implementation maintains full backward compatibility:

• credential.id matching is tried first (supports full ARN format)
• Falls back to credential.name matching if id doesn't match
• Non-AWS accounts and partial names continue to work

Example Usage

After this fix, both formats work correctly:

# With full ARN (as shown by ykman CLI)
curl http://localhost:5100/totp/arn:aws:iam::123456:mfa/user

# With partial name (library's name field)
curl http://localhost:5100/totp/aws:iam::123456:mfa/user

Both requests will successfully find and generate TOTP codes for the same account.

Debug Output

The debug logging added in this fix shows the actual credential structure:

Credential details - name: 'aws:iam::123456:mfa/user', issuer: 'arn', id: 'b'arn:aws:iam::123456:mfa/user''

This confirms that credential.id contains the full ARN that matches what ykman CLI displays.