fix(init): enrich 401 Unauthorized errors with actionable guidance#971
Merged
Conversation
Contributor
|
Contributor
Codecov Results 📊✅ 6975 passed | Total: 6975 | Pass Rate: 100% | Execution Time: 0ms 📊 Comparison with Base Branch
All tests are passing successfully. ✅ Patch coverage is 91.53%. Project has 14086 uncovered lines. Files with missing lines (3)
Coverage diff@@ Coverage Diff @@
## main #PR +/-##
==========================================
+ Coverage 77.10% 77.14% +0.04%
==========================================
Files 320 320 —
Lines 61568 61609 +41
Branches 0 0 —
==========================================
+ Hits 47465 47523 +58
- Misses 14103 14086 -17
- Partials 0 0 —Generated by Codecov Action |
cb8f6f8 to
7007e81
Compare
7007e81 to
70e0c6c
Compare
0400fb2 to
fe033af
Compare
Contributor
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit fe033af. Configure here.
403 errors already get actionable hints via enrich403Detail() — telling
users to check token scopes or re-authenticate. 401 errors (invalid or
expired token) were falling through with the raw HTTP status text
("Failed to list organizations: 401 Unauthorized"), which gives no
indication of how to fix the problem.
Adds enrich401Detail() that mirrors the 403 pattern:
- env-var token path: directs to the token settings page
- OAuth path: tells the user to run sentry auth login
Also extends the resolveOrgSlug() catch in preflight.ts (which already
handled 403) to also catch 401 and surface the enriched detail via the
same { ok: false } return path — so the culprit in Sentry points to
ensureOrg rather than the generic withPreflightHandling catch.
Fixes: throwRawApiError's JSON-stringify fallback was not excluding 401
alongside 403, which would have produced noisy {"detail":null} prefixes
in the enriched message for 401 responses with non-string detail fields.
Also corrects a stale "sentry login" string (should be "sentry auth login")
in the empty-orgs fallback path.
Ref: CLI-1SD
Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
fe033af to
be67e5b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

When
sentry initruns without an org argument it callslistOrganizations()to show a picker. If the token is invalid or expired that call returns 401. Before this change users saw:No hint about what to do. Compare that to 403, which already had
enrich403Detail()pointing at the token settings page or suggesting re-auth. 401 was just falling through with the raw HTTP status.After (env-var token):
After (OAuth):
What changed
enrich401Detail()ininfrastructure.ts— mirrorsenrich403Detail(), applied in boththrowApiError()andthrowRawApiError()resolveOrgSlug()inpreflight.ts— extended the existing 403 catch to also handle 401, returning{ ok: false }so the error surfaces throughensureOrgwith the full enriched message (same flow as 403, same Sentry culprit attribution)throwRawApiError's JSON-stringify fallback to exclude 401 alongside 403 — otherwise{"detail":null}responses would produce noisy prefixes in the enriched messagesentry login→sentry auth loginin the empty-orgs fallbackTest plan
SENTRY_AUTH_TOKENto a garbage value, runsentry initwith no org arg — should print the token hint + settings URLsentry auth logout, runsentry initwith no org arg — should print the session-expired + re-auth hintbun test test/lib/api/infrastructure.test.ts— 17 tests passRef: CLI-1SD