Re-mint watchpr's Gitea token when it expires

Vault-minted Gitea tokens last ~1h, far less than a watch, and every poll
past expiry 401'd into a warning while watchpr looked healthy.

- retry a rejected request once with a freshly minted token
- abort the watch when the fresh token is rejected too
- poll anonymously when no token can be minted, mint only on a real 401/403

cmd/watchpr/main.go

@@ -58,10 +58,7 @@ func newRootCmd() *cobra.Command {
 				}
 				refs = append(refs, ref)
 			}
-			c, err := clientFor()
-			if err != nil {
-				return err
-			}
+			c := clientFor()
 			if once {
 				return runOnce(c, refs, jsonMode)
 			}
@@ -84,12 +81,16 @@ func newRootCmd() *cobra.Command {
 	return root
 }
 
-func clientFor() (*agent.GiteaClient, error) {
+// clientFor builds the Gitea client. Watching public repos works anonymously,
+// so an unavailable token is a warning, not a failure; a poll that is actually
+// rejected re-mints then.
+func clientFor() *agent.GiteaClient {
 	token, err := agent.GiteaToken()
 	if err != nil {
-		return nil, err
+		fmt.Fprintf(os.Stderr, "warning: no Gitea token (%v); polling anonymously\n", err)
+		token = ""
 	}
-	return agent.NewGiteaClient(token), nil
+	return agent.NewGiteaClient(token)
 }
 
 // runOnce fetches and prints the current state of each PR, then exits 0.
@@ -131,6 +132,9 @@ func runWatch(c *agent.GiteaClient, refs []agent.PRRef, interval time.Duration,
 
 	res, err := agent.Watch(c, refs, login, ticker.C, onBaseline, onError)
 	if err != nil {
+		if agent.IsAuthError(err) {
+			return fmt.Errorf("gitea authentication failed after re-minting the token, watch aborted: %w", err)
+		}
 		return err
 	}
 	report(res.Ref.String(), res.Reason, res.State, jsonMode)

cmd/watchpr/main_test.go

@@ -2,6 +2,8 @@ package main
 
 import (
 	"io"
+	"net/http"
+	"net/http/httptest"
 	"testing"
 )
 
@@ -28,3 +30,43 @@ func TestExecuteNoArgsErrors(t *testing.T) {
 		t.Fatal("Execute() = nil, want error when no PR references are given")
 	}
 }
+
+// Watching a public repo with no credentials available must work: the failed
+// mint is a warning, the poll goes out unauthenticated, and the command exits 0.
+func TestOnceRunsAnonymouslyWhenNoTokenIsAvailable(t *testing.T) {
+	vault := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusForbidden)
+	}))
+	defer vault.Close()
+
+	authHeaders := 0
+	mux := http.NewServeMux()
+	mux.HandleFunc("/api/v1/repos/unkin/repo/pulls/7", func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("Authorization") != "" {
+			authHeaders++
+		}
+		_, _ = io.WriteString(w, `{"number":7,"state":"open","mergeable":true,"head":{"sha":"cafebabe"}}`)
+	})
+	mux.HandleFunc("/api/v1/repos/unkin/repo/commits/cafebabe/status", func(w http.ResponseWriter, r *http.Request) {
+		_, _ = io.WriteString(w, `{"state":"success"}`)
+	})
+	mux.HandleFunc("/api/v1/repos/unkin/repo/issues/7/comments", func(w http.ResponseWriter, r *http.Request) {
+		_, _ = io.WriteString(w, `[]`)
+	})
+	gitea := httptest.NewServer(mux)
+	defer gitea.Close()
+
+	t.Setenv("VAULT_ADDR", vault.URL)
+	t.Setenv("GITEA_URL", gitea.URL)
+
+	cmd := newRootCmd()
+	cmd.SetArgs([]string{"--once", "unkin/repo#7"})
+	cmd.SetOut(io.Discard)
+	cmd.SetErr(io.Discard)
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("anonymous --once should succeed without a token: %v", err)
+	}
+	if authHeaders != 0 {
+		t.Errorf("sent %d Authorization headers, want none", authHeaders)
+	}
+}