Fix/auth status 401 diagnostics - #94
Open
brandonc wants to merge 5 commits into
Open
Conversation
…uthorized"
`auth status` collapsed three distinct failures into one opaque
"Unauthorized for <host>" line: no token configured, a token the server
rejected (401), and the request never reaching the server (network/DNS,
or some other HTTP status). Users could not tell an expired token from a
connectivity blip, and the message suggested no remedy.
Classify the /account/details error with errors.As on the go-tfe
*APIError (it arrives wrapped in a *url.Error) and print a cause-specific,
actionable message:
- no token -> run `tfctl auth login`
- rejected (401) -> token expired/revoked (auth login), or an SSO
session that has lapsed on SSO-protected Terraform
Enterprise (re-authenticate in the browser)
- other status -> "<host> returned HTTP N" (not an auth problem)
- unreachable -> "could not reach <host>: <err>"
JSON/agent output gains a machine-readable `reason` field so scripts can
branch on the cause.
8 tasks
Maed223
reviewed
Jul 29, 2026
Maed223
left a comment
Maed223
left a comment
Collaborator
There was a problem hiding this comment.
Looking good, just caught a tiny error formatting omission.
| case reasonRejected: | ||
| fmt.Fprintf(w, "%s Token for %s was invalid (HTTP 401).\n", icon, hostname) | ||
| fmt.Fprintf(w, " - The token may be expired, revoked, or disabled: run '%s auth login' to create a new one.\n", version.Name) | ||
| if !strings.HasSuffix(opts.Profile.GetHostname(), ".terraform.io") { |
Collaborator
There was a problem hiding this comment.
nit: Looks like we could just use the passed hostname param, correct me if I'm missing a nuance here.
| if !strings.HasSuffix(opts.Profile.GetHostname(), ".terraform.io") { | ||
| fmt.Fprintf(w, " - Your Terraform Enterprise SSO session may have expired: sign in again, then retry.\n") | ||
| } | ||
| fmt.Fprintf(w, " - Ensure you are using the intended token configuration by adding '--debug' to this command") |
Collaborator
There was a problem hiding this comment.
Missing a newline at the end here, looks possible that lines later appended here would be glued right next to this one.
Maed223
approved these changes
Jul 29, 2026
Maed223
left a comment
Maed223
left a comment
Collaborator
There was a problem hiding this comment.
Meant to approve since my review only has nits
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
#86 but with some tweaks by me
Example Output
PR Checklist
npx changie newor install changie to prepare a new changelog entry for the next set of release notes.--json— Force machine readable output to stdout. Does not apply to stderr.--markdown— Force markdown output to stdout. Does not apply to stderr.--dry-run— Don't make any actual writes or other mutations. Describe what would have changed to stderr.--quiet— Only render essential content.make gen/screenshotif the root command output changes.Autocompletefield to positional arguments and flags to assist shell autocomplete.PCI review checklist
I have documented a clear reason for, and description of, the change I am making.
If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
If applicable, I've documented the impact of any changes to security controls.
Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.