fix(auth): only fail the identity lookup when the token itself is refused

Resolving the identity from the APIFY_TOKEN account put a network call inside
getLocalUserInfo(), which threw on any failure. `apify run` and `mcp install`
call it and need no network, so `APIFY_TOKEN=<token> apify run` broke offline
or on any API hiccup — the command from the original report.

HTTP 401/403/409 mean the token itself was refused and still fail loudly, with
the status code and a mention of permissions in the message (403 is a valid
token without the required rights, which the old "is it still valid?" wording
got wrong). Everything else degrades to no identity, leaving the existing
"not logged in" handling to deal with it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: l2ysho

src/lib/utils.ts

@@ -191,7 +191,15 @@ async function fetchActiveUserInfo(token: string): Promise<AuthJSON> {
 			activeUserInfo = { token, info: await client.user('me').get() };
 		} catch (err) {
 			cliDebugPrint('[fetchActiveUserInfo] error getting user info', { error: err });
-			throw new Error(`The token in ${APIFY_ENV_VARS.TOKEN} was rejected by the Apify API. Is it still valid?`);
+			// The token itself being refused is worth failing on. Anything else (offline, API hiccup) must not
+			// break commands that work locally — `apify run` needs no network, so it degrades to no identity.
+			const { statusCode } = err as { statusCode?: number };
+			if (statusCode && [401, 403, 409].includes(statusCode)) {
+				throw new Error(
+					`The token in ${APIFY_ENV_VARS.TOKEN} was refused by the Apify API (HTTP ${statusCode}). Check that it is valid and has the required permissions.`,
+				);
+			}
+			return {};
 		}
 	}
 

test/local/lib/credentials.test.ts

@@ -16,6 +16,9 @@ import {
 } from '../../../src/lib/credentials.js';
 import { getApifyClientOptions, getLocalUserInfo, getLoggedClient } from '../../../src/lib/utils.js';
 
+/** `user('me').get()` failures for the mock below to simulate, keyed by the token used. */
+const userFetchFailures = new Map<string, { statusCode?: number }>();
+
 // Stubs out the `user('me').get()` round-trip so getLoggedClient() can be tested without the API.
 vi.mock('apify-client', () => {
 	class ApifyClient {
@@ -25,11 +28,16 @@ vi.mock('apify-client', () => {
 		}
 		user() {
 			return {
-				get: async () => ({
-					id: `id_for_${this.token}`,
-					username: `user_for_${this.token}`,
-					proxy: { password: `pw_for_${this.token}` },
-				}),
+				get: async () => {
+					const failure = userFetchFailures.get(this.token!);
+					if (failure) throw Object.assign(new Error('simulated API failure'), failure);
+
+					return {
+						id: `id_for_${this.token}`,
+						username: `user_for_${this.token}`,
+						proxy: { password: `pw_for_${this.token}` },
+					};
+				},
 			};
 		}
 	}
@@ -72,6 +80,7 @@ describe('credentials', () => {
 		vitest.stubEnv('APIFY_TOKEN', undefined);
 		keyringStore.clear();
 		keyringFailures.clear();
+		userFetchFailures.clear();
 		__resetCredentialsForTests();
 	});
 
@@ -319,6 +328,28 @@ describe('credentials', () => {
 
 			expect(await getLocalUserInfo()).toMatchObject({ username: 'user_for_env_tok_b', id: 'id_for_env_tok_b' });
 		});
+
+		// `apify run` needs no network, so an unreachable API must not stop it — only a refused token is fatal.
+		it.each([[undefined], [500], [502]])(
+			'degrades to no identity when the identity lookup fails with statusCode %s',
+			async (statusCode) => {
+				const token = `env_tok_soft_${statusCode}`;
+				vitest.stubEnv('APIFY_DISABLE_KEYRING', '1');
+				vitest.stubEnv('APIFY_TOKEN', token);
+				userFetchFailures.set(token, { statusCode });
+
+				expect(await getLocalUserInfo()).toEqual({ token });
+			},
+		);
+
+		it.each([[401], [403], [409]])('throws when the API refuses the APIFY_TOKEN with %i', async (statusCode) => {
+			const token = `env_tok_refused_${statusCode}`;
+			vitest.stubEnv('APIFY_DISABLE_KEYRING', '1');
+			vitest.stubEnv('APIFY_TOKEN', token);
+			userFetchFailures.set(token, { statusCode });
+
+			await expect(getLocalUserInfo()).rejects.toThrow(`refused by the Apify API (HTTP ${statusCode})`);
+		});
 	});
 
 	// Precedence: explicit token arg (e.g. --token) > APIFY_TOKEN env var > stored login token.