A refused checkout token falls back to this computer's sign-in for the hub, and says so (closes #155) 569802ebae0e

- **Fixed: an expired checkout token no longer hides your sign-in (#155).** A checkout's own token for a remote (`remote.NAME.token`) is used first, so when it expired every fetch, pull and push answered 401 although `oxy auth login` had a good sign-in for the same hub. A refused own token now falls back to that sign-in, with a warning naming `oxy config --unset remote.NAME.token` to drop the stale one; never to another checkout's token. When both are refused, the error says to sign in again and unset it.

    /// refused (401, 403 or 404): the credential store's sign-in when

    /// `token` is the remote's own (oxygen#155), or those of enclosing

    /// checkouts when it came from the credential store (oxygen#112).

                        "{}: the token in use was refused; trying another this computer has for the hub \

                         (a stale remote.NAME.token goes with `oxy config --unset remote.NAME.token`)",

        let own = options.token.is_some();

        let env = std::env::var("OXY_TOKEN").is_ok_and(|t| !t.is_empty());

        let explicit = own || env;

        // A checkout's own token refused (expired, say) falls back to this

        // computer's sign-in for the hub, never to another checkout's

        // (oxygen#155).

        if own && !env {

            if let Some(t) = stored

                .token

                .clone()

                .filter(|t| options.token.as_ref() != Some(t))

            {

                options.fallback_tokens.push(t);

            }

        }

        }

    }

    /// What to do when `remote`'s own token was refused (`message` says

    /// HTTP 401) and so was this computer's sign-in for its hub, which it

    /// falls back to (oxygen#155).

    pub fn stale_token_note(&self, remote: &str, message: &str) -> Option<String> {

        if !message.contains("HTTP 401") {

            return None;

        let own = self.config.remote_tokens.get(remote)?;

        let url = self.config.remotes.get(remote)?;

        let stored = self.credentials().options_for(url).token?;

        (stored != *own).then(|| {

            format!(

                "the hub refused both this checkout's own token for {remote} (remote.{remote}.token) and your sign-in: \

                 `oxy auth login HUB`, then `oxy config --unset remote.{remote}.token` so the sign-in is used"

            )

        })

    // Its own token, if refused, falls back to this computer's sign-in,

    // never to the parent's (#155): stale too here, so the push fails and

    // says what to do.

    let options = child.options_for_url(&format!("{base}/child"));

    assert_eq!(

        options.fallback_tokens,

        vec!["stale".to_string()],

        "the sign-in only"

    );

    let note = child.stale_token_note("origin", &err).expect("a note");

    assert!(

        note.contains("oxy auth login") && note.contains("oxy config --unset remote.origin.token"),

        "{note}"

    );

    assert!(child.stale_token_note("origin", "HTTP 500").is_none());

    // With a good sign-in, an expired checkout token no longer blocks.

    oxy_core::credentials::Credentials::at(&home)

        .save(&base, "good", Some("andy"), None)

        .unwrap();

    let child = Repo::open(&nested).unwrap().with_home(&home);

    let pushed = child.push("origin", false).unwrap();

    assert!(pushed[0].ok, "{}", pushed[0].reason);

    let report = noted(&repo, &remote, repo.fetch(&remote))?;

    let r = noted(&repo, &remote, repo.pull(&remote))?;

    let results = noted(

        &repo,

        &remote,

        repo.push_bookmark_with(&remote, &bookmark_name, force, &mut |m| {

            sp.set(&format!("Pushing to {remote}… {m}"))

        }),

    )?;

}

/// `r`, with a note when the remote's own token was refused while another

/// sign-in for its hub would do (oxygen#155).

fn noted<T>(repo: &oxy_core::repo::Repo, remote: &str, r: oxy_core::repo::Result<T>) -> Result<T> {

    r.map_err(|e| {

        let m = e.to_string();

        match repo.stale_token_note(remote, &m) {

            Some(note) => anyhow::anyhow!("{m}\n  note: {note}"),

            None => e.into(),

        }

    })