Handle macaroon-authorization-required error response
Metadata
Current evaluation
Snapcraft whoami bypasses the 401 re-login wrapper and shows a generic store error for missing or expired credentials; the open report remains valid and is linked to an unresolved craft-store bug.
Suggested action: keep open
Reason: The report provides an exact 401 macaroon-authorization-required response and clear reproduction using snapcraft whoami. Current StoreClientCLI.request() handles 401 reauthentication, but whoami() calls store_client.whoami() directly and bypasses that wrapper; craft-store#97 is also open for the same expired-macaroon behavior.
Evaluated by: mr-cal-bot
Impact:
46
Quick Win:
25
Complexity:
38
Confidence:
93
Actionability:
88
Issue body
When issuing snapcraft whoami on a system without credentials or with expired ones, as a user I get an error instead of a prompt to re-authenticate:
nessita@dali:~$ snapcraft whoami
Store Error: whoami failed.
nessita@dali:~$ export SNAPCRAFT_ENABLE_DEVELOPER_DEBUG=1
nessita@dali:~$ snapcraft whoami
Starting snapcraft 4.8 from /snap/snapcraft/6512/lib/python3.6/site-packages/snapcraft/cli.
configure_requests_ca: using '/etc/ssl/certs/ca-certificates.crt' for certificate verification
Candid forced: False. Candid crendendials: False.
Calling https://dashboard.snapcraft.io/api/v2/tokens/whoami with params None and headers {'Content-Type': 'application/json', 'Accept': 'application/json', 'Authorization': None, 'User-Agent': 'snapcraft/4.8 Ubuntu/20.04 (amd64)'}
Store error response: {'_content': b'{"error-list": [{"message": "The request is missing an Authorization header field containing a valid macaroon", "code": "macaroon-authorization-required", "extra": {"realm": "Developer Portal"}}]}', '_content_consumed': True, '_next': None, 'status_code': 401, 'headers': {'Date': 'Wed, 02 Jun 2021 13:32:10 GMT', 'Server': 'gunicorn/19.7.0', 'Content-Type': 'application/json', 'WWW-Authenticate': 'Macaroon realm="Developer Portal"', 'Expires': 'Wed, 02 Jun 2021 13:32:10 GMT', 'Cache-Control': 'max-age=0, no-cache, no-store, must-revalidate', 'X-View-Name': 'api-tokens-whoami', 'Vary': 'Accept-Language,Cookie', 'Content-Language': 'en', 'Content-Length': '196', 'X-VCS-Revision': 'b143b7791b', 'X-Request-Id': 'YLeIWn8AAQEAADi5H34AAAPd1', 'X-Cache': 'MISS from juju-08138e-prod-scasnap-xenial-4', 'X-Cache-Lookup': 'MISS from juju-08138e-prod-scasnap-xenial-4:3128', 'Via': '1.1 juju-08138e-prod-scasnap-xenial-4 (squid/3.5.12)', 'Strict-Transport-Security': 'max-age=2592000', 'Keep-Alive': 'timeout=5, max=100', 'Connection': 'Keep-Alive'}, 'raw': <urllib3.response.HTTPResponse object at 0x7f8439ce8f60>, 'url': 'https://dashboard.snapcraft.io/api/v2/tokens/whoami', 'encoding': 'utf-8', 'history': [], 'reason': 'Unauthorized', 'cookies': <RequestsCookieJar[]>, 'elapsed': datetime.timedelta(0, 0, 932062), 'request': <PreparedRequest [GET]>, 'connection': <requests.adapters.HTTPAdapter object at 0x7f8439ce82b0>}
Sorry, an error occurred in Snapcraft:
Store Error: whoami failed.
Traceback (most recent call last):
File "/snap/snapcraft/6512/bin/snapcraft", line 33, in <module>
sys.exit(load_entry_point('snapcraft==4.8', 'console_scripts', 'snapcraft')())
File "/snap/snapcraft/6512/lib/python3.6/site-packages/click/core.py", line 829, in __call__
return self.main(*args, **kwargs)
File "/snap/snapcraft/6512/lib/python3.6/site-packages/click/core.py", line 782, in main
rv = self.invoke(ctx)
File "/snap/snapcraft/6512/lib/python3.6/site-packages/click/core.py", line 1259, in invoke
return _process_result(sub_ctx.command.invoke(sub_ctx))
File "/snap/snapcraft/6512/lib/python3.6/site-packages/click/core.py", line 1066, in invoke
return ctx.invoke(self.callback, **ctx.params)
File "/snap/snapcraft/6512/lib/python3.6/site-packages/click/core.py", line 610, in invoke
return callback(*args, **kwargs)
File "/snap/snapcraft/6512/lib/python3.6/site-packages/snapcraft/cli/store.py", line 840, in whoami
account = StoreClientCLI().whoami().account
File "/snap/snapcraft/6512/lib/python3.6/site-packages/snapcraft/storeapi/_store_client.py", line 97, in whoami
return self.dashboard.whoami()
File "/snap/snapcraft/6512/lib/python3.6/site-packages/snapcraft/storeapi/_dashboard_api.py", line 367, in whoami
raise errors.GeneralStoreError(message="whoami failed.", response=response)
snapcraft.storeapi.errors.GeneralStoreError: Store Error: whoami failed.
You can find the traceback in file '/tmp/tmpsgqh5y34/trace.txt'.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha |
Impact:
46
Quick Win:
25
Complexity:
38
Confidence:
93
Actionability:
88
|
keep open | Snapcraft whoami bypasses the 401 re-login wrapper and shows a generic store error for missing or expired credentials; the open report remains valid and is linked to an unresolved craft-store bug. | |
| stealth/space-bunny-alpha |
Impact:
42
Quick Win:
22
Complexity:
28
Confidence:
78
Actionability:
73
|
needs triage | The 401 wrapper prompts reauthentication for normal requests, but whoami bypasses it and may expose raw macaroon-authorization-required errors; related reports remain open. | |
| stealth/space-bunny-alpha |
Impact:
42
Quick Win:
22
Complexity:
37
Confidence:
68
Actionability:
84
|
keep open | Snapcraft 4.8 whoami returns a generic 401 store error instead of prompting for re-authentication when credentials are missing or expired; the report remains open. | |
| qwen/qwen3.8-27b |
Impact:
35
Quick Win:
21
Staleness:
95
Complexity:
40
Confidence:
65
Support Request:
10
|
needs triage | snapcraft whoami shows a generic 'Store Error: whoami failed.' instead of prompting re-authentication when credentials are missing/expired (401 macaroon-authorization-required). Open since 2021, zero comments, no maintainer activity or labels. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
95
Complexity:
35
Confidence:
85
Support Request:
10
|
needs triage | snapcraft whoami fails with a generic error instead of prompting re-authentication when credentials are missing or expired. Open for over 5 years with no maintainer response or triage. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
95
Complexity:
25
Confidence:
85
Support Request:
15
|
close stale | Unhandled macaroon-authorization-required API error causes generic failure instead of re-auth prompt. Issue is over 5 years old with no maintainer response. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
95
Complexity:
20
Confidence:
85
Support Request:
10
|
close stale | Snapcraft fails with a generic error when credentials are missing or expired instead of prompting for re-authentication. Untriaged, inactive for over 5 years. |
Update history
| Date | Change |
|---|---|
| created |
Related work
-
Related To:
craft-store#97
(confidence 96%)
Covers the same confusing expired-macaroon and macaroon-authorization-required responses; it was reproduced and remains unresolved.
-
Related To:
snapcraft (launchpad)#1834469
(confidence 94%)
Addresses invalid-macaroon messaging and notes that newer 401 paths are actionable while legacy behavior remains unresolved.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1834469 error messaging for invalid macaroon could be improved | snapcraft (launchpad) | open | Expired legacy credentials can still yield a raw macaroon error or block login; newer 401s are actionable, but the legacy path and upstream craft-store report remain unresolved. | |
| #1856502 Obscure error message from snapcraft release when not logged in correctly | snapcraft (launchpad) | open | Snapcraft exposed a raw 401 macaroon error from release; commit 8a854a8de (#3907) now gives invalid legacy credentials an actionable login or export-login resolution. | |
| #1622635 Cryptic error message for store access failure. | snapcraft (launchpad) | closed | Request for a clearer 401 error suggesting 'snapcraft login' was closed as unnecessary after PR canonical/snapcraft#903 (commit 603948e1d) removed the login requirement for Store part downloads, fixing LP #1606903. | |
| #4226 snapcraft export-login ignores expires parameter | snapcraft | closed | Closed as stale without a Snapcraft fix. Maintainers attributed the short-lived macaroon to store-side refresh handling and later asked reporters to open a new ticket if the problem persisted. |