← Back to issue list

Using token from `snapcraft export-login` as environment auth results in `craft_store.errors.CredentialsNotParseable`

View original Github issue

Metadata

Project
craft-store
Number
#265
Type
issue
State
open
Author
aywaldron
Labels
Created
Updated
Closed

Current evaluation

User used wrong client class (StoreClient instead of UbuntuOneStoreClient) for u1-macaroon credentials, self-resolved. Maintainer re-scoped as wishlist to improve the CredentialsNotParseable error message by inspecting the token type field. Not yet implemented in current code.

Suggested action: keep open

Reason: Maintainer lengau explicitly triaged and re-scoped this as a wishlist item: 'I'm going to reopen this as a wishlist item because we do have a way to make a nicer error message by looking at the value of t in the macaroon dictionary.' Current code in creds.py still raises the generic 'Expected valid Candid credentials' without inspecting the t field, confirming the improvement remains unimplemented.

Impact: 25 Quick Win: 18.75 Staleness: 55 Complexity: 25 Confidence: 80 Support Request: 65

Issue body

### Bug Description I am attempting to use a token generated by `snapcraft export-login` to login to the snap store API. When I store this token in an env var and try to login with the code included in the repro steps, I get ``` craft_store.errors.CredentialsNotParseable: Credentials could not be parsed. Expected valid Candid credentials. ``` The token generated by `snapcraft export-login` is formatted like `{"t": "u1-macaroon", "v": {"r": "<string>", "d": "<string>"}}`. I get the same output when setting the env var mentioned in the help `export SNAPCRAFT_STORE_AUTH=candid`. I can see from the `craft_store` code that the `"v"` value in the token is supposed to be a string, not a dict, but can't figure out how to generate a token that has a string `"v"` value. Versions: - snapcraft: 8.5.1.post36+git0a7f753ac - craft_store: 3.2.0 - python: 3.12 - OS: Ubuntu 22.04.5 ### To Reproduce 1. On Ubuntu 22, with `snapcraft` 8.5.1 installed, run ``` export SNAPCRAFT_STORE_AUTH=candid sudo snapcraft export-login snapcraft_store_credentials ``` and login with your ubuntu one account. Inspect the contents of `snapcraft_store_credentials` with ``` cat snapcraft_store_credentials | base64 -d ``` and see that it has the structure `{"t": "u1-macaroon", "v": {"r": "<string>", "d": "<string>"}}`. 2. Store the token from `snapcraft_store_credentials` in a `SNAPCRAFT_STORE_CREDENTIALS` env var and run the following code in python 3.12 with `craft_store==3.2.0` installed. ``` from craft_store import StoreClient, endpoints store_client = StoreClient( base_url="https://dashboard.snapcraft.io", storage_base_url="https://upload.apps.ubuntu.com", endpoints=endpoints.SNAP_STORE, user_agent="test-agent", application_name="test-app", environment_auth="SNAPCRAFT_STORE_CREDENTIALS", ) store_client.whoami() ``` See exception traceback in included logs. ### part yaml ```shell ``` ### Relevant log output ```shell Traceback (most recent call last): File "/usr/local/lib/python3.12/site-packages/craft_store/creds.py", line 94, in unmarshal_candid_credentials return CandidModel.unmarshal(data).value ^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.12/site-packages/craft_store/creds.py", line 42, in unmarshal return cls.model_validate(data) ^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.12/site-packages/pydantic/main.py", line 568, in model_validate return cls.__pydantic_validator__.validate_python( ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ pydantic_core._pydantic_core.ValidationError: 2 validation errors for CandidModel t Input should be 'macaroon' [type=literal_error, input_value='u1-macaroon', input_type=str] For further information visit https://errors.pydantic.dev/2.8/v/literal_error v Input should be a valid string [type=string_type, input_value={'r': 'MDAyOWxvY2F0aW9uIG...zQXgG8mV7-uBK008LJ3igo'}, input_type=dict] For further information visit https://errors.pydantic.dev/2.8/v/string_type The above exception was the direct cause of the following exception: Traceback (most recent call last): File "<stdin>", line 1, in <module> File "/usr/local/lib/python3.12/site-packages/craft_store/base_client.py", line 199, in whoami return dict(self.request("GET", self._base_url + self._endpoints.whoami).json()) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.12/site-packages/craft_store/base_client.py", line 187, in request headers["Authorization"] = self._get_authorization_header() ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.12/site-packages/craft_store/store_client.py", line 109, in _get_authorization_header auth = creds.unmarshal_candid_credentials(self._auth.get_credentials()) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.12/site-packages/craft_store/creds.py", line 97, in unmarshal_candid_credentials raise errors.CredentialsNotParseable( craft_store.errors.CredentialsNotParseable: Credentials could not be parsed. Expected valid Candid credentials. ```

Evaluation history

Date Model Scores Action Summary
qwen/qwen3.8-27b
Impact: 25
Quick Win: 18.75
Staleness: 55
Complexity: 25
Confidence: 80
Support Request: 65
keep open User used wrong client class (StoreClient instead of UbuntuOneStoreClient) for u1-macaroon credentials, self-resolved. Maintainer re-scoped as wishlist to improve the CredentialsNotParseable error message by inspecting the token type field. Not yet implemented in current code.
qwen/qwen3.6-35b-a3b
Staleness: 95
Complexity: 15
Confidence: 90
Support Request: 5
keep open User got CredentialsNotParseable when using snapcraft export-login token with StoreClient. They should use UbuntuOneStoreClient. Maintainer reopened as a wishlist to improve error messaging based on the token type field.
qwen3.6-35b-a3b-mtp-q6
Staleness: 85
Complexity: 20
Confidence: 90
Support Request: 20
keep open Maintainer reopened as a wishlist item to improve error messaging when users pass Ubuntu One credentials to the standard StoreClient. Awaiting implementation of a clearer validation message.
qwen3.6-35b-a3b-mtp-q6
Staleness: 15
Complexity: 20
Confidence: 90
Support Request: 30
keep open craft_store throws a confusing CredentialsNotParseable error when users pass snapcraft export-login tokens. Reopened as a wishlist item to improve error handling by detecting the token type and suggesting the correct client.

Update history

No update history recorded yet.

Related issues

No related issues found above the similarity threshold.