From 42cfc1ef220a9d926e370ff5b3a7a1e408d4bd06 Mon Sep 17 00:00:00 2001
From: Allen Li <ayatane@chromium.org>
Date: Wed, 3 Sep 2025 15:31:20 -0700
Subject: [PATCH] auth: Hoist exception handling in GerritAuthenticator

This moves the handling to the same level as
`raise GitLoginRequiredError()` so we can check for other exit codes
and raise other errors.

Bug: 442666611
Change-Id: Idbb34d6549b47b715bf59d6720362293d5c28039
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/6912689
Commit-Queue: Allen Li <ayatane@chromium.org>
Reviewed-by: Gavin Mak <gavinmak@google.com>
---
 auth.py | 45 ++++++++++++++++++++++-----------------------
 1 file changed, 22 insertions(+), 23 deletions(-)

diff --git a/auth.py b/auth.py
index 52d4454c1e..1e8bb53de1 100644
--- a/auth.py
+++ b/auth.py
@@ -229,7 +229,13 @@ class GerritAuthenticator(object):
         Raises:
             GitLoginRequiredError if user interaction is required.
         """
-        access_token = self._get_luci_auth_token()
+        try:
+            access_token = self._get_luci_auth_token()
+        except subprocess2.CalledProcessError as e:
+            # subprocess2.CalledProcessError.__str__ nicely formats
+            # stdout/stderr.
+            logging.error('git-credential-luci failed: %s', e)
+            access_token = None
         if access_token:
             return access_token
         logging.debug('Failed to create access token')
@@ -237,25 +243,18 @@ class GerritAuthenticator(object):
 
     def _get_luci_auth_token(self, use_id_token=False) -> Optional[str]:
         logging.debug('Running git-credential-luci')
-        try:
-            # TODO(crbug.com/442666611): depot_tools doesn't support
-            # ReAuth creds from the helper yet.
-            env = os.environ.copy()
-            env['LUCI_ENABLE_REAUTH'] = '0'
-            out, err = subprocess2.check_call_out(
-                ['git-credential-luci', 'get'],
-                stdin=subprocess2.DEVNULL,
-                stdout=subprocess2.PIPE,
-                stderr=subprocess2.PIPE,
-                env=env)
-            logging.debug('git-credential-luci stderr:\n%s', err)
-            for line in out.decode().splitlines():
-                if line.startswith('password='):
-                    return line[len('password='):].rstrip()
-            logging.error('git-credential-luci did not return a token')
-            return None
-        except subprocess2.CalledProcessError as e:
-            # subprocess2.CalledProcessError.__str__ nicely formats
-            # stdout/stderr.
-            logging.error('git-credential-luci failed: %s', e)
-            return None
+        # TODO(crbug.com/442666611): depot_tools doesn't support
+        # ReAuth creds from the helper yet.
+        env = os.environ.copy()
+        env['LUCI_ENABLE_REAUTH'] = '0'
+        out, err = subprocess2.check_call_out(['git-credential-luci', 'get'],
+                                              stdin=subprocess2.DEVNULL,
+                                              stdout=subprocess2.PIPE,
+                                              stderr=subprocess2.PIPE,
+                                              env=env)
+        logging.debug('git-credential-luci stderr:\n%s', err)
+        for line in out.decode().splitlines():
+            if line.startswith('password='):
+                return line[len('password='):].rstrip()
+        logging.error('git-credential-luci did not return a token')
+        return None