Keep the auth remedy for the credential sent when several filings fail

A 401 while filing several to-dos ended in a report that kept only
each failure's text, so App.Err no longer saw the SDK error and left
the bare "Run: basecamp auth login" in the hint. Under --profile work
that logs into the default profile; under BASECAMP_TOKEN no login
helps.

runFilings now settles the remedy on each failure before the report
drops the cause, through App.WithAuthRemedy, which App.Err already
used. The report stays non-retryable.

A 401 does not stop the remaining to-dos. Every to-do is read before
any is filed, so a rejected credential fails there, before the loop;
one rejected mid-run is refused before anything is filed for each
later to-do too, and the report already asks to run those again.

Author: robzolkos

internal/appctx/context.go

@@ -283,7 +283,7 @@ func (a *App) Err(err error) error {
 	}
 
 	// Print the error response
-	if outputErr := a.Output.Err(a.withAuthRemedy(err), opts...); outputErr != nil {
+	if outputErr := a.Output.Err(a.WithAuthRemedy(err), opts...); outputErr != nil {
 		return outputErr
 	}
 
@@ -295,7 +295,7 @@ func (a *App) Err(err error) error {
 	return nil
 }
 
-// withAuthRemedy replaces the generic login hint on an API 401 with one that
+// WithAuthRemedy replaces the generic login hint on an API 401 with one that
 // fits the credential the request actually sent. The SDK classifies a 401
 // far from the profile and the environment, so its conversion can only say
 // "basecamp auth login": under an active profile that command would store
@@ -305,7 +305,7 @@ func (a *App) Err(err error) error {
 // the credential manager's own failures name the profile themselves, and
 // come from stored-credential operations (auth refresh, auth token
 // --stored) that ignore the environment token by design.
-func (a *App) withAuthRemedy(err error) error {
+func (a *App) WithAuthRemedy(err error) error {
 	var sdkErr *basecamp.Error
 	e := output.AsError(err)
 	if e.Code != output.CodeAuth || !errors.As(err, &sdkErr) || (e.Hint != "" && !strings.HasPrefix(e.Hint, output.DefaultAuthHint)) {

internal/commands/filing.go

@@ -280,7 +280,10 @@ func runFilings(cmd *cobra.Command, app *appctx.App, scope followUpScope, filing
 		filed, outcome, err := fileRecording(cmd.Context(), app, f)
 		var e *output.Error
 		if err != nil {
-			e = output.AsError(err)
+			// The report keeps only each failure's text, so a 401's remedy
+			// for the credential sent is settled here, while the SDK error
+			// that App.Err would read is still attached.
+			e = output.AsError(app.WithAuthRemedy(err))
 			if worst == nil || outcome > worstOf {
 				worst, worstOf = e, outcome
 			}

internal/commands/todos_filing_test.go

@@ -640,3 +640,39 @@ func TestFilingFollowUpsNameTheProfileAndAnAccountGivenThisRun(t *testing.T) {
 		})
 	}
 }
+
+// A 401 partway through several filings must keep the remedy that fits the
+// credential sent, as a single filing's does: under a profile, a login to the
+// default one fixes nothing, and under BASECAMP_TOKEN no login does.
+func TestTodosFilingSeveralKeepsTheAuthRemedyForTheCredentialSent(t *testing.T) {
+	for name, tc := range map[string]struct {
+		envToken string
+		want     string
+	}{
+		"a profile":    {"", "Run: basecamp auth login -P work"},
+		"an env token": {"bc_at_env", "BASECAMP_TOKEN is set"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Setenv("BASECAMP_TOKEN", tc.envToken)
+			shortFilingWait(t)
+			transport := &mockTodoFilingTransport{postStatus: http.StatusUnauthorized}
+			app, buf := newTestAppWithTransport(t, transport)
+			app.Config.ActiveProfile = "work"
+
+			err := executeCommand(NewTodosCmd(), app, "copy", "456", "457", "--to-list", "901")
+			require.Error(t, err)
+			assert.Len(t, transport.posts, 2)
+			require.NoError(t, app.Err(err))
+
+			var envelope struct {
+				Code string `json:"code"`
+				Hint string `json:"hint"`
+			}
+			require.NoError(t, json.Unmarshal(buf.Bytes(), &envelope), buf.String())
+			assert.Equal(t, output.CodeAuth, envelope.Code)
+			assert.Contains(t, envelope.Hint, tc.want)
+			assert.NotRegexp(t, `basecamp auth login(\n|$)`, envelope.Hint, "the bare login hint is replaced")
+			assert.Contains(t, envelope.Hint, "run the command again for #456, #457 alone")
+		})
+	}
+}