From e1d504077ab6b0bd996df58ebda76918c2fee076 Mon Sep 17 00:00:00 2001
From: MrBBot <bcoll@cloudflare.com>
Date: Tue, 2 Jan 2024 14:53:23 +0000
Subject: [PATCH] [wrangler] fix: check permissions on authentication error
 with API token set (#4597)

* fix: check permissions on authentication error with API token set

* Update packages/wrangler/src/index.ts

Co-authored-by: Pete Bacon Darwin <pete@bacondarwin.com>

---------

Co-authored-by: Pete Bacon Darwin <pete@bacondarwin.com>
---
 .changeset/strange-eels-search.md              |  5 +++++
 packages/wrangler/src/__tests__/deploy.test.ts |  3 +++
 packages/wrangler/src/index.ts                 | 16 +++++++++++++++-
 3 files changed, 23 insertions(+), 1 deletion(-)
 create mode 100644 .changeset/strange-eels-search.md

diff --git a/.changeset/strange-eels-search.md b/.changeset/strange-eels-search.md
new file mode 100644
index 000000000000..13fa359bdd5c
--- /dev/null
+++ b/.changeset/strange-eels-search.md
@@ -0,0 +1,5 @@
+---
+"wrangler": patch
+---
+
+fix: suggest checking permissions on authentication error with API token set
diff --git a/packages/wrangler/src/__tests__/deploy.test.ts b/packages/wrangler/src/__tests__/deploy.test.ts
index 565c955451db..96ea6d9599f8 100644
--- a/packages/wrangler/src/__tests__/deploy.test.ts
+++ b/packages/wrangler/src/__tests__/deploy.test.ts
@@ -8324,6 +8324,9 @@ export default{
 		  Authentication error [code: 10000]
 
 
+		📎 It looks like you are authenticating Wrangler via a custom API token set in an environment variable.
+		Please ensure it has the correct permissions for this operation.
+
 		Getting User settings...
 		👋 You are logged in with an API Token, associated with the email user@example.com!
 		┌───────────────┬────────────┐
diff --git a/packages/wrangler/src/index.ts b/packages/wrangler/src/index.ts
index c7d4981d0d09..ff793fb3fc79 100644
--- a/packages/wrangler/src/index.ts
+++ b/packages/wrangler/src/index.ts
@@ -1,6 +1,7 @@
 import module from "node:module";
 import os from "node:os";
 import TOML from "@iarna/toml";
+import chalk from "chalk";
 import { ProxyAgent, setGlobalDispatcher } from "undici";
 import makeCLI from "yargs";
 import { version as wranglerVersion } from "../package.json";
@@ -56,7 +57,13 @@ import {
 import { tailOptions, tailHandler } from "./tail";
 import { generateTypes } from "./type-generation";
 import { printWranglerBanner } from "./update-check";
-import { listScopes, login, logout, validateScopeKeys } from "./user";
+import {
+	getAuthFromEnv,
+	listScopes,
+	login,
+	logout,
+	validateScopeKeys,
+} from "./user";
 import { vectorize } from "./vectorize/index";
 import { whoami } from "./whoami";
 
@@ -724,6 +731,13 @@ export async function main(argv: string[]): Promise<void> {
 			await createCLIParser([...argv, "--help"]).parse();
 		} else if (isAuthenticationError(e)) {
 			logger.log(formatMessage(e));
+			const envAuth = getAuthFromEnv();
+			if (envAuth !== undefined && "apiToken" in envAuth) {
+				const message =
+					"📎 It looks like you are authenticating Wrangler via a custom API token set in an environment variable.\n" +
+					"Please ensure it has the correct permissions for this operation.\n";
+				logger.log(chalk.yellow(message));
+			}
 			await whoami();
 		} else if (e instanceof ParseError) {
 			e.notes.push({