[CFX-7263] Fail on bad env credentials instead of using the stored profile

[chasdr]

Summary

dr honored DATAROBOT_ENDPOINT/DATAROBOT_API_TOKEN only once they verified. On failure it silently fell back to the stored CLI profile, so a script passing a project's .env credentials ran against the caller's own instance with exit 0. dr llm-gateway list listed the wrong catalog. A complete env pair that fails verification now fails the command, with the reason on stderr and both endpoints named. dr auth check and dr auth export already treat env credentials as authoritative.

Notes for review

• A stale .env in a template checkout used to self-heal: task loads .env into the environment, and dr dotenv update quietly ran on the stored profile. Those runs now fail with the fix named. pulumi and the SDKs already fail on the same stale credentials.
• Partial env credentials (one var set) keep the old fallback. Only a complete pair is an explicit instance request.

Output

$ DATAROBOT_ENDPOINT=http://127.0.0.1:8471/api/v2 DATAROBOT_API_TOKEN=expired-token dr llm-gateway list
❌ DATAROBOT_API_TOKEN environment variable is invalid or expired.
Unset it and try again:
  unset DATAROBOT_API_TOKEN (or Remove-Item Env:\DATAROBOT_API_TOKEN on Windows)
Environment credentials for http://127.0.0.1:8471 failed to verify; not falling back to the stored profile for http://127.0.0.1:8600.
Error: Authentication failed.

$ DATAROBOT_ENDPOINT=http://127.0.0.1:9 DATAROBOT_API_TOKEN=some-token dr llm-gateway list
❌ Could not connect to http://127.0.0.1:9: dial tcp 127.0.0.1:9: connect: connection refused
Check DATAROBOT_ENDPOINT and your network, then try again.
Error: Authentication failed.

Before this change both commands printed the caller's own catalog and exited 0.

Technical Changes

• internal/auth/auth.go: EnsureAuthenticated fails before the stored-profile check when a complete env pair fails verification. Classification extracted to ReportEnvCredentialsError with a new transport-error branch. EnvCredentials.EndpointVar names DATAROBOT_API_ENDPOINT when that fallback supplied the endpoint. Styles bind to the destination writer so redirected stderr gets no ANSI codes.
• cmd/auth/check/cmd.go: drops its copy of the classification for the shared helper.
• docs: authentication.md documents the precedence; auth.md adds the could-not-connect example.
• 8 new tests. The load-bearing one pins env-invalid plus stored-valid to failure.

---

Note

Medium Risk
Changes global authentication precedence for every command using EnsureAuthenticated; workflows that relied on silent fallback to drconfig.yaml will now fail (intentional), but partial env vars still behave as before.

Overview
Fixes silent wrong-instance auth: when both DATAROBOT_ENDPOINT (or DATAROBOT_API_ENDPOINT) and DATAROBOT_API_TOKEN are set but verification fails, commands now fail instead of using the stored CLI profile or starting login—so scripts with a stale project .env no longer hit the wrong DataRobot instance with exit 0.

Shared env error reporting: ReportEnvCredentialsError centralizes classification (timeout, malformed endpoint, missing scheme, transport/DNS, invalid token) and is used from EnsureAuthenticated (stderr) and dr auth check. Transport failures no longer suggest unsetting the token. reportStoredProfileNotUsed names the requested vs stored endpoints when a profile exists.

Other: EnvCredentials.EndpointVar drives error text for the SDK fallback var; lipgloss styles bind to the destination writer for redirected stderr/tests. Docs describe env-first precedence and the unreachable-endpoint example. Regression tests cover env-invalid + stored-valid, unreachable endpoint, and error message branches.

^{Reviewed by Cursor Bugbot for commit 118d6cd. Configure here.}

[datarobot-pr-review-router]

🎫 Jira: CFX-7263 — dr silently falls back to its stored profile when passed-in credentials fail to verify

[chasdr]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 118d6cd. Configure here.}

[datarobot-pr-review-router]

Code Ownership

Cli Maintainers

• cmd/auth/check/cmd.go
• docs/commands/auth.md
• docs/development/authentication.md
• internal/auth/auth.go
• internal/auth/auth_test.go

Review requested from the teams above. Labels will be removed automatically upon approval.

[c-h-russell-walker]

Sorry I'm a little confused by this comment existing here.

Also what does 'dials' here mean in "dials the raw endpoint value"?

[c-h-russell-walker]

This looks great 🚀

Made one comment where I didn't really get the context/placement of a comment and some wording - but no blocking merge.

[ajalon1]

Concerned how this interacts with dr workload, please hold

[ajalon1]

aha, I know why this triggered my spidey sense. I tried changing this in #616

[ajalon1]

Manual CLI interaction testing — CFX-7263 (PR #751) with PR #750 locally merged

Note on scope: PR #750 (aj/CFX-6414-dotenv-setup-propagate, "fix(dotenv): make --if-needed skip only when .env is complete") is not part of this PR's remote diff. It was locally merged into chas/CFX-7263 solely to exercise the combination of the two changes. The rows below marked "(#750)" test #750's behavior; rows marked "(#751)" test the auth-precedence change; R15 is the cross-PR interaction. Reviewers should not expect #750's commits in this PR's remote diff.

Tested commit: f37f77ee0debb9c3c821d70285977ef61f571a97 — Merge branch 'pr-750' into chas/CFX-7263 (local merge, clean, no conflicts)
Binary: ./dist/dr built via task build at that commit (v0.2.82-13-gf37f77ee0debb9).
Credentials: Fake/unreachable endpoints (http://127.0.0.1:1/api/v2, closed port) and a local 127.0.0.1:8765 HTTP server returning 401 to simulate a reachable-but-rejecting endpoint. Dummy tokens only. No real DataRobot instance was contacted; DR_API_TOKEN was not set; no smoke tests were run. A temp HOME / XDG_CONFIG_HOME was used for every invocation so the reviewer's real config was never touched.

Summary verdict

All 9 exercised rows PASS. The two changes compose correctly: a stale .env loaded into the process environment now fails loudly (#751) instead of silently falling back to the stored profile, and dotenv setup --if-needed skips only when the .env file itself is complete (#750), ignoring OS environment variables for the skip decision.

Per-row results

Row	Command (abbreviated)	Expected	Result
R13 (#750)	dr dotenv setup --if-needed --skip-auth — .env missing core vars, DATAROBOT_ENDPOINT+DATAROBOT_API_TOKEN exported in env	Does NOT skip; wizard/flow proceeds	PASS — no skip message; proceeded to launch wizard TUI (failed only on no-TTY in the non-interactive harness)
R14 (#750)	dr dotenv setup --if-needed --skip-auth — .env has all core vars (dummy)	Skips	PASS — exit 0, Configuration already exists, skipping setup.
R15 (#751+#750)	dr llm-gateway list — complete bad env pair (127.0.0.1:1, expired)	Fails with env-credential error on stderr; no silent fallback; non-zero exit	PASS — exit 1, Could not connect to http://127.0.0.1:1: ... on stderr; no profile fallback
R16 (#751)	dr auth check — repo .env with dummy creds + complete bad env pair	Checks .env creds first, then CLI creds; reports env-credential failure via shared ReportEnvCredentialsError	PASS — .env token error printed, then Could not connect ... (ReportEnvCredentialsError classification)
R2 (#751)	dr llm-gateway list — complete bad pair, 401 (invalid token), stored profile present	Fails, no fallback to stored profile	PASS — DATAROBOT_API_TOKEN ... invalid or expired. + not falling back to the stored profile for https://app.datarobot.com.
R4 (#751)	dr llm-gateway list — unreachable endpoint (127.0.0.1:1)	Could not connect, not unset token	PASS — Could not connect to http://127.0.0.1:1: ...; no unset DATAROBOT_API_TOKEN advice
R10 (#751)	dr llm-gateway list — DATAROBOT_API_ENDPOINT (not DATAROBOT_ENDPOINT) + token, bad	Error names DATAROBOT_API_ENDPOINT	PASS — Check DATAROBOT_API_ENDPOINT and your network; does not name DATAROBOT_ENDPOINT
R11 (#751)	dr llm-gateway list 2>err.log — bad pair	err.log contains no ANSI escape codes	PASS — 0 ANSI escapes in err.log (renderer probes the file stream and disables color)
R12 (#751)	dr llm-gateway list --output-format json — bad pair	stdout pure JSON or empty; error on stderr; non-zero exit	PASS — stdout 0 bytes; classified error on stderr; exit 1

Manual CLI test output

$ # R13 — .env missing core vars, env has them (--skip-auth isolates #750 skip logic)
$ dr dotenv setup --if-needed --skip-auth
EXIT: 1
# stderr: WARN ... --skip-auth ...; INFO Parsing prompts ...; INFO Adding variable INFRA_ENABLE_LLM ...
# stderr: Error: could not open a new TTY: open /dev/tty: device not configured
# stdout: (no "Configuration already exists, skipping setup." message)
# -> did NOT skip; wizard launch attempted (failed only because the harness has no TTY)

$ # R14 — .env has all core vars (dummy)
$ dr dotenv setup --if-needed --skip-auth
EXIT: 0
# stdout: Configuration already exists, skipping setup.
# -> skipped

$ # R15 — cross-PR interaction: complete bad env pair via llm-gateway list
$ DATAROBOT_ENDPOINT=http://127.0.0.1:1/api/v2 DATAROBOT_API_TOKEN=expired dr llm-gateway list
EXIT: 1
# stderr:
#   ❌ Could not connect to http://127.0.0.1:1: dial tcp 127.0.0.1:1: connect: connection refused
#   Check DATAROBOT_ENDPOINT and your network, then try again.
#   Error: Authentication failed.
# -> fails loudly, no silent profile fallback

$ # R16 — dr auth check in repo with .env dummy creds + complete bad env pair
$ DATAROBOT_ENDPOINT=http://127.0.0.1:1/api/v2 DATAROBOT_API_TOKEN=expired dr auth check
EXIT: 1
# stdout:
#   ❌ DATAROBOT_API_TOKEN in '.env' is invalid or expired.
#   Run dr dotenv update to refresh credentials.
#   ❌ Could not connect to http://127.0.0.1:1: dial tcp 127.0.0.1:1: connect: connection refused
#   Check DATAROBOT_ENDPOINT and your network, then try again.
# -> .env creds checked first (verifyDotenvToken), then CLI creds (ReportEnvCredentialsError)

$ # R2 — complete bad pair (401 => invalid token) with a stored profile present
$ DATAROBOT_ENDPOINT=http://127.0.0.1:8765/api/v2 DATAROBOT_API_TOKEN=expired dr llm-gateway list
EXIT: 1
# stderr:
#   ❌ DATAROBOT_API_TOKEN environment variable is invalid or expired.
#   Unset it and try again:
#     unset DATAROBOT_API_TOKEN (or Remove-Item Env:\DATAROBOT_API_TOKEN on Windows)
#   Environment credentials for http://127.0.0.1:8765 failed to verify; not falling back to the stored profile for https://app.datarobot.com.
#   Error: Authentication failed.

$ # R4 — unreachable endpoint
$ DATAROBOT_ENDPOINT=http://127.0.0.1:1/api/v2 DATAROBOT_API_TOKEN=expired dr llm-gateway list
EXIT: 1
# stderr:
#   ❌ Could not connect to http://127.0.0.1:1: dial tcp 127.0.0.1:1: connect: connection refused
#   Check DATAROBOT_ENDPOINT and your network, then try again.
#   Error: Authentication failed.
# (no "unset DATAROBOT_API_TOKEN" advice)

$ # R10 — DATAROBOT_API_ENDPOINT (not DATAROBOT_ENDPOINT) + token, bad
$ DATAROBOT_API_ENDPOINT=http://127.0.0.1:1/api/v2 DATAROBOT_API_TOKEN=expired dr llm-gateway list
EXIT: 1
# stderr:
#   ❌ Could not connect to http://127.0.0.1:1: dial tcp 127.0.0.1:1: connect: connection refused
#   Check DATAROBOT_API_ENDPOINT and your network, then try again.
#   Error: Authentication failed.

$ # R11 — stderr redirected to a file; confirm no ANSI escape codes
$ dr llm-gateway list 2>err.log   # (bad env pair)
EXIT: 1
# err.log (cat -v): M-bM-^]M-^L Could not connect to ... (the M-… bytes are the ❌ emoji, not ANSI)
# ANSI escape count in err.log: 0

$ # R12 — --output-format json with a bad env pair
$ dr llm-gateway list --output-format json   # (bad env pair)
EXIT: 1
# stdout: 0 bytes (empty)
# stderr:
#   ❌ Could not connect to http://127.0.0.1:1: dial tcp 127.0.0.1:1: connect: connection refused
#   Check DATAROBOT_ENDPOINT and your network, then try again.
#   Error: Authentication failed.

Unit tests

Targeted packages covering both changes, with -race -count=1:

$ go test -race -count=1 ./internal/auth/... ./cmd/auth/... ./cmd/dotenv/... ./internal/envbuilder/...
ok      github.com/datarobot/cli/internal/auth        1.580s
?       github.com/datarobot/cli/cmd/auth              [no test files]
ok      github.com/datarobot/cli/cmd/auth/check        1.326s
ok      github.com/datarobot/cli/cmd/auth/export      1.206s
?       github.com/datarobot/cli/cmd/auth/login        [no test files]
?       github.com/datarobot/cli/cmd/auth/logout       [no test files]
?       github.com/datarobot/cli/cmd/auth/seturl       [no test files]
ok      github.com/datarobot/cli/cmd/dotenv           15.373s
ok      github.com/datarobot/cli/internal/envbuilder  1.598s

All packages pass (race detector enabled, no failures).

Lint

Per the task brief, task lint was already run (0 issues across all LINT_GOOS_TARGETS: linux darwin windows). Not re-run here.

Notes / caveats

• For R13/R14, --skip-auth was used to isolate the [CFX-6414] fix(dotenv): make --if-needed skip only when .env is complete #750 --if-needed skip logic from the [CFX-7263] Fail on bad env credentials instead of using the stored profile #751 auth precedence (otherwise a complete bad env pair would fail at PreRunE before the skip check runs). R13's TUI launch error is expected in this non-interactive harness and is unrelated to the skip decision — the assertion is the absence of the skip message.
• R2 used a local 127.0.0.1:8765 HTTP server returning 401 to produce the "invalid or expired" token classification (a reachable endpoint that rejects the token), since no real DataRobot instance could be contacted.
• The repo's working branch was observed to move to aj/CFX-6414-dotenv-setup-propagate with an uncommitted internal/envbuilder/validator.go refactor after these tests completed; the binary exercised above was built from the chas/CFX-7263 + [CFX-6414] fix(dotenv): make --if-needed skip only when .env is complete #750 local merge commit f37f77e, which is the combination this task asked to test. No source files were modified by this exercise.

[ajalon1]

What my 🤖 was trying to say is that ... I was concerned that #750 would conflict with #751, but they seem to handle different layers. The interaction-test droid I kicked off checked a bunch of scenarios, so I'm fine with merging both in now.

You should merge this one, I'll then merge #750 after dealing w. review comments, and then we'll revisit #616.

One nit below, everything from here on out is informational and non-blocking.

---

N2 — dr auth check omits the "not falling back" line (optional, not requesting a change)

dr auth check and every other command now share ReportEnvCredentialsError, but only the regular command path prints reportStoredProfileNotUsed ("not falling back to the stored profile for X"). dr auth check deliberately doesn't, but the asymmetry isn't obvious from the code. A one-line comment on checkCLICredentials noting why it intentionally skips reportStoredProfileNotUsed would save the next reader a minute.

🤖 Why the two paths diverge

cmd/auth/check/cmd.go's Cmd() has its own RunE and no EnsureAuthenticated PreRunE, so it never goes through the new early-fail branch in internal/auth/auth.go::EnsureAuthenticated. Its checkCLICredentials calls auth.ReportEnvCredentialsError(w, creds, err) directly (good — shared classification) but stops short of reportStoredProfileNotUsed, because auth check then goes on to evaluate the stored profile on its own and reports that result independently. Naming the stored profile in the env-error line would be redundant there. The only ask is a comment making that intent explicit so a future reader doesn't "fix" the inconsistency by adding the call.

Praise

• The main regression test guards both sides of the bug. TestEnsureAuthenticated_EnvInvalidStoredValid sets up a valid stored profile and an expired env token, asserts the command fails, and asserts the login flow never starts (the callback calls t.Error). It pins the exact silent-wrong-instance behavior this PR exists to kill, from both directions. The malformed-endpoint and unreachable-endpoint variants round it out.

• Error classification points the user at the right thing. A scheme-less endpoint (app.example.com/...) is reported as "missing URL scheme" rather than "could not connect to app.example.com" — the user is told to fix the URL, not chase a network problem that isn't there. The test "scheme-less endpoint is an endpoint problem, not transport" pins this; it's subtle and easy to get wrong.

• Styled text is bound to the stream it's written to. writerStyles(w) rebinds the lipgloss renderer to the destination writer, so redirected stderr (and test buffers) don't pick up ANSI codes the stream can't display. Small, correct, and verified by asserting on bytes.Buffer output.

• Errors name the variable that's actually set. When the endpoint came from the SDK-style DATAROBOT_API_ENDPOINT fallback, the error names that variable, not the default DATAROBOT_ENDPOINT — so the user fixes the one they really set. Tested explicitly.

Nits

Nits (non-blocking)

• EnsureAuthenticatedE still returns errors.New("Authentication failed.") with a capital "A" — pre-existing, not introduced here, but you're already in this function so it's a cheap s/Authentication failed/authentication failed/ if you follow the Go error-string convention. Not requesting.
• endpointVarName() is an unexported method on *EnvCredentials used only by ReportEnvCredentialsError. Reads cleanly as-is; could be a package-level func taking the string, but no need to change.
• //nolint: cyclop on EnsureAuthenticated is still warranted — the function grew one more branch. No action.

[github-actions]

🚀 Smoke tests triggered! Running on Linux and Windows...

[github-actions]

✅ All smoke tests passed!

✅ Linux: success
✅ Windows: success

View run details

[chasdr]

Manual CLI interaction testing — CFX-7263 (PR #751) with PR #750 locally merged

this is amazing