fix(auth): whoami never reports an unconfirmed or dead session as signed in - #277
Merged
Merged
Conversation
…signed in `auth whoami` looks the identity up with GET /v1/me as a best-effort enrichment and swallowed every failure of it, so it works offline. That blanket catch also swallowed the engine's definitive verdict on the credential: a refresh refused with invalid_grant (the stored session already compare-and-cleared), a credential that could never be renewed, or a session ended underneath the process. whoami then printed `authenticated: true` with the dead session's workspace. Automation trusts that answer: create-prisma runs `prisma auth whoami --json`, skips sign-in, and its next command fails with CLI.CREDENTIALS_REQUIRED. The lookup now tells the verdict apart from an outage by the structured error's code, as the engine raised it, never by origin or message: - CLI.CREDENTIALS_REQUIRED reads as signed out: `authenticated: false`, exit 0, the existing Sign in next action, the same result an unauthenticated user gets. This is the question whoami exists to answer, and it is what legacy did for a 401 on its lookup (1271c57). - AUTH.SERVICE_TOKEN_REJECTED settles as itself, exit 2, as AUTH.SERVICE_TOKEN_EMPTY already does for this command. Signing in cannot help while PRISMA_SERVICE_TOKEN is set, so "signed out" with a Sign in action would send the reader the wrong way. - Everything else (network error, timeout, 5xx, CLI.AUTH_SERVICE_ERROR) still answers from the credential's own claims, unchanged. Ctrl-C still outranks whatever the interrupted request threw. No new engine API, result field, or flag. The one existing test that pinned the old behaviour for a 401 on an environment token now asserts the rejection; the never-answering-host test beside it keeps covering the claims fallback for that credential. Verified with the built binary against a local HTTP server: 401 plus invalid_grant gives `authenticated: false` and an emptied state file; 401 plus a 503 token endpoint still gives the claims and leaves the state file untouched. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
|
Understand this PR’s impact Explore downstream dependencies and potential security impact with Blast Radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Essentials Run ID: 📒 Files selected for processing (5)
Included review availability: 1 review is currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour. Summary by CodeRabbit
Walkthrough
Priority: ⬇️ Low 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 4 files. (1 skipped: 1 unsupported.)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
commit: |
Shorten the comments in whoami.ts and keep fetchedIdentity and the handler's `credential` name, so the source diff stays small. Drop the error-conventions passage, restore the parity record, and keep one sentence per touched error-reference entry. Keep three tests: expired session reads as signed out, a refused env token settles as itself, and a transient auth-service failure still answers from the claims. Behaviour is unchanged. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
After an inconclusive /v1/me lookup (timeout, network error, 5xx, CLI.AUTH_SERVICE_ERROR) whoami still answered `authenticated: true` from the credential's claims with no hint that nothing was verified. The result gains `verified`: true only when the API accepted the credential during this run, false when answering from claims and whenever `authenticated` is false. Human output adds one info line for a held but unverified credential. Exit codes, `authenticated`, the 3s bound and the plain stdout rows are unchanged. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
AmanVarshney01
changed the title
AmanVarshney01
marked this pull request as ready for review
September 21, 2026 13:53
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
wmadden
approved these changes
Sep 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
auth whoamienriches its answer withGET /v1/meand swallowed every failure so it works offline. That gave two false answers:invalid_grant, session already cleared) and printedauthenticated: true. create-prisma trusts that, skips sign-in, and its next command fails withCLI.CREDENTIALS_REQUIRED.authenticated: truewith no hint that nothing had been confirmed.For comparison,
wrangler whoami,netlify status,vercel whoamiandgh auth statusnever report "logged in" without an API confirmation in that run;ghreports a distinct "timeout" state. Prisma's whoami keeps its offline behaviour but now says when the answer is unconfirmed.Changes, discriminated by the structured error's code (
CliStructuredError.is), never by message:CLI.CREDENTIALS_REQUIREDfrom the lookup → signed out:authenticated: false, exit 0, the existingSign innext action.AUTH.SERVICE_TOKEN_REJECTED→ settles as itself (exit 2); signing in cannot fix an environment token.verified: true only when the API accepted the credential during this run. An inconclusive lookup still answers from the credential's claims, withverified: falseand one notice line in human output: "Could not reach Prisma to confirm this sign-in. Showing what the local credential says."{"authenticated":true,"verified":false,"workspace":{…},"user":{…},"source":"stored","expiresAt":null}To review: (a)
verifiedis an additive result field; (b) the test that pinned "a 401 on an env token falls back to claims" now assertsAUTH.SERVICE_TOKEN_REJECTED, exit 2.No new engine API or flag; exit codes and the 3s bound are unchanged. Checked with the built binary against a local server for all three cases. Lint, typecheck, cli and engine tests,
check:error-reference,check:grammar,check:conformancepass; e2e 6 passed, 48 skipped (no E2E token locally). Not verified against the real auth service.🤖 Generated with Claude Code