Transparently run jf auth if the tokens are expired

Summary:
sapling piggybacks on jellyfish auth. jf transparently refreshes tokens (see D103844199) but sapling does not. this leads to weird errors where someone does `sl pull` and it says:

> warning: failed to read from Phabricator for landed commits (ClientError('Failed to get diff info via Phabricator. GraphQL response: {"error": "The provided crypto auth token(s) are expired. Check to make sure you have specified a long enough expiration time for your crypto auth token(s)."}. If this is an authentication issue, try running `jf auth` or check your ~/.arcrc file.')), not marking commits as landed.

this is gated behind hg config `phabricator.skip_jf_auth_refresh`, setting it to `true` will bypass this behavior completely.

Reviewed By: zzl0

Differential Revision: D106702265

fbshipit-source-id: a95df0465b253c85c5d3ac6acc66b188eb3c5ce9

Author: joshkehn

eden/scm/sapling/ext/extlib/phabricator/graphql.py

@@ -10,6 +10,8 @@
 
 
 import os
+import re
+import subprocess
 from typing import Optional
 
 from sapling import encoding, error, json, util
@@ -71,6 +73,14 @@ def __init__(self, repodir=None, repo=None, ui=None):
         # TODO: remove this force_arcrc safety check when sl release has soaked
         # for a while.
         self._force_arcrc = ui.configbool("phabricator", "force_arcrc", False)
+        self._phabricator_auth_command = ui.configlist(
+            "phabricator", "auth-command", ["jf", "auth"]
+        )
+        self._auth_token_regex = ui.config(
+            "phabricator",
+            "auth-expired-regex",
+            r"invalid auth token|the provided crypto auth token\(s\) are expired",
+        )
         if not self._mock:
             self._app_id = ui.config("phabricator", "graphql_app_id")
             self._host = ui.config("phabricator", "graphql_host")
@@ -99,6 +109,51 @@ def _get_phab_client(self):
             self._host,
         )
 
+    def _is_token_expired(self, response):
+        if not self._auth_token_regex:
+            return False
+        pattern = re.compile(self._auth_token_regex, re.IGNORECASE)
+        possible_errors = [response.get(key) for key in ("error", "errors")]
+        possible_errors = [e if isinstance(e, list) else [e] for e in possible_errors]
+        possible_messages = [str(m) for e in possible_errors for m in e]
+        return any(pattern.search(m) for m in possible_messages)
+
+    # _query wraps self._client.query and provides transparent re-auth
+    # if the response looks like it failed due to expired tokens.
+    def _query(self, timeout, request, params=None):
+        ret = self._client.query(timeout, request, params)
+        if not self._phabricator_auth_command or not self._is_token_expired(ret):
+            return ret
+
+        try:
+            subprocess.run(
+                self._phabricator_auth_command,
+                stdin=subprocess.DEVNULL,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                check=True,
+                timeout=60,
+            )
+        except Exception as ex:
+            cmd_str = " ".join(self._phabricator_auth_command)
+            self._ui.warn(_("warning: `%s` failed: %s\n") % (cmd_str, ex))
+            stderr = getattr(ex, "stderr", None) or b""
+            stdout = getattr(ex, "stdout", None) or b""
+            if stderr:
+                self._ui.warn(
+                    _("  stderr: %s\n")
+                    % stderr.decode("utf-8", errors="replace").strip()
+                )
+            if stdout:
+                self._ui.warn(
+                    _("  stdout: %s\n")
+                    % stdout.decode("utf-8", errors="replace").strip()
+                )
+            return ret
+
+        self._client = self._get_phab_client()
+        return self._client.query(timeout, request, params)
+
     def _applyarcconfig(self, config, defaultarcrchost):
         arcrchost = config.get("graphql_uri", None)
         if "OVERRIDE_GRAPHQL_URI" in encoding.environ:
@@ -221,7 +276,7 @@ def getdiffversion(self, timeout, diffid, version=None):
         query = query % extra_query
 
         params = {"diffid": diffid}
-        ret = self._client.query(timeout, query, params)
+        ret = self._query(timeout, query, params)
 
         try:
             latest: Optional[dict] = ret["data"]["phabricator_diff_query"][0][
@@ -305,7 +360,7 @@ def getnodes(self, repo, diffids, diff_status, timeout=10):
                 }
                 """
             params = {"diffids": diffids}
-            ret = self._client.query(timeout, query, params)
+            ret = self._query(timeout, query, params)
             # Example result:
             # { "data": {
             #     "phabricator_diff_query": [
@@ -425,13 +480,13 @@ def getrevisioninfo(self, timeout, signalstatus, *revision_numbers):
             ret = self._mocked_responses.pop()
         else:
             params = {"params": {"numbers": rev_numbers}}
-            ret = self._client.query(timeout, self._getquery(signalstatus), params)
+            ret = self._query(timeout, self._getquery(signalstatus), params)
         return self._processrevisioninfo(ret)
 
     def graphqlquery(self, query, variables, timeout=60_000):
         if self._mock:
             return self._mocked_responses.pop()
-        return self._client.query(timeout, query, variables)
+        return self._query(timeout, query, variables)
 
     def _getquery(self, signalstatus):
         signalquery = ""
@@ -592,7 +647,7 @@ def getmirroredrev(self, fromrepo, fromtype, torepo, totype, rev, timeout=15):
                 "revs": [rev],
             }
         }
-        ret = self._client.query(timeout, query, json.dumps(params))
+        ret = self._query(timeout, query, json.dumps(params))
         self._raise_errors(ret)
         for pair in ret["data"]["query"]["rev_map"]:
             if pair["from_rev"] == rev:
@@ -625,7 +680,7 @@ def getmirroredrevmap(self, repo, nodes, fromtype, totype, timeout=15):
                 "revs": list(map(fromenc, nodes)),
             }
         }
-        ret = self._client.query(timeout, query, json.dumps(params))
+        ret = self._query(timeout, query, json.dumps(params))
         self._raise_errors(ret)
         result = {}
         for pair in ret["data"]["query"]["rev_map"]:
@@ -688,7 +743,7 @@ def scmquery_log(
                 "follow_mutable_file_history": use_mutable_history,
             }
         }
-        ret = self._client.query(timeout, query, json.dumps(params))
+        ret = self._query(timeout, query, json.dumps(params))
         self._raise_errors(ret)
         return ret["data"]["query"]
 
@@ -701,7 +756,7 @@ def get_username(self, unixname=None, timeout=10) -> str:
         query = "query($u: String!) { intern_user_for_unixname(unixname: $u) { access_name email } }"
         params = {"u": unixname}
         # {'data': {'intern_user_for_unixname': {'access_name': 'Name', 'email': 'foo@example.com'}}}
-        ret = self._client.query(timeout, query, json.dumps(params))
+        ret = self._query(timeout, query, json.dumps(params))
         self._raise_errors(ret)
         data = ret["data"]["intern_user_for_unixname"]
         if not data: