From 6d9991fc7b2d09a430925295c72f91b3403db352 Mon Sep 17 00:00:00 2001
From: Allen Li <ayatane@chromium.org>
Date: Thu, 4 Sep 2025 14:15:17 -0700
Subject: [PATCH] auth: Print specific instructions for ReAuth, other errors

Bug: 442666611
Change-Id: Icfc9c223937b9035f0364630455a50492e282128
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/6912692
Reviewed-by: Jiewei Qian <qjw@chromium.org>
Reviewed-by: Gavin Mak <gavinmak@google.com>
Commit-Queue: Allen Li <ayatane@chromium.org>
---
 auth.py | 41 ++++++++++++++++++++++++++++++++++++-----
 1 file changed, 36 insertions(+), 5 deletions(-)

diff --git a/auth.py b/auth.py
index a951738497..a8d5895a0b 100644
--- a/auth.py
+++ b/auth.py
@@ -75,7 +75,36 @@ class GitLoginRequiredError(Exception):
 
     @property
     def login_command(self) -> str:
-        return 'git-credential-luci login'
+        return 'git credential-luci login'
+
+
+class GitReAuthRequiredError(Exception):
+    """Interaction with the user is required to ReAuth.
+
+    This is for git-credential-luci, not luci-auth.
+    """
+
+    def __init__(self):
+        msg = ('You have not done ReAuth. Please run and try again:\n'
+               '  %s' % self.reauth_command)
+        super(GitReAuthRequiredError, self).__init__(msg)
+
+    @property
+    def reauth_command(self) -> str:
+        return 'git credential-luci reauth'
+
+
+class GitUnknownError(Exception):
+    """Unknown error from git-credential-luci."""
+
+    def __init__(self):
+        msg = ('Unknown error from git-credential-luci. Try logging in? Run:\n'
+               '  %s' % self.login_command)
+        super(GitLoginRequiredError, self).__init__(msg)
+
+    @property
+    def login_command(self) -> str:
+        return 'git credential-luci login'
 
 
 def has_luci_context_local_auth():
@@ -232,15 +261,17 @@ class GerritAuthenticator(object):
         try:
             access_token = self._get_luci_auth_token()
             if not access_token:
-                logging.debug('Failed to create access token')
-                raise GitLoginRequiredError()
+                raise GitUnknownError()
             return access_token
         except subprocess2.CalledProcessError as e:
             # subprocess2.CalledProcessError.__str__ nicely formats
             # stdout/stderr.
             logging.error('git-credential-luci failed: %s', e)
-            logging.debug('Failed to create access token')
-            raise GitLoginRequiredError()
+            if e.returncode == 2:
+                raise GitLoginRequiredError()
+            if e.returncode == 3:
+                raise GitReAuthRequiredError()
+            raise GitUnknownError()
 
     def _get_luci_auth_token(self) -> Optional[str]:
         logging.debug('Running git-credential-luci')