fix(hosting): share temporary token validation guidance

Author: masenf

packages/reflex-hosting-cli/news/+initial-token-recovery.bugfix.md

@@ -1,2 +1,2 @@
 Show `reflex login` guidance when initial authentication rejects an access token, including instructions to replace or remove an explicit `REFLEX_ACCESS_TOKEN` or `--token` override.
-When `reflex cloud whoami` cannot validate a token due to a temporary service or connection failure, suggest retrying instead of replacing credentials.
+When `reflex cloud whoami` or a noninteractive cloud command cannot validate a token due to a temporary service or connection failure, suggest retrying instead of replacing credentials.

packages/reflex-hosting-cli/src/reflex_cli/utils/hosting.py

@@ -493,6 +493,24 @@ def rejected_token_message(source: TokenSource, err: TokenAccessDeniedError) ->
     )
 
 
+def _token_validation_failure_message(
+    source: TokenSource, err: TokenValidationError
+) -> str:
+    """Describe a temporary validation failure and suggest retrying.
+
+    Args:
+        source: Where the token was loaded from.
+        err: The validation error.
+
+    Returns:
+        The message to report.
+    """
+    return (
+        f"Unable to validate the access token from the {source.value}: "
+        f"{err} (auth request id: {err.request_id}). Please try again later."
+    )
+
+
 def get_existing_access_token() -> str:
     """Fetch the access token from the existing config if applicable.
 
@@ -932,10 +950,7 @@ def get_authenticated_client(
             raise click.exceptions.Exit(1) from err
         except TokenValidationError as err:
             api.close()
-            logger.error(
-                f"Unable to validate the access token from the {source.value}: "
-                f"{err} (auth request id: {err.request_id})"
-            )
+            logger.error(_token_validation_failure_message(source, err))
             raise click.exceptions.Exit(1) from err
         return AuthenticatedClient(api, me)
 

packages/reflex-hosting-cli/src/reflex_cli/v2/auth.py

@@ -110,10 +110,7 @@ def whoami_command(token: str | None, loglevel: str, as_json: bool):
         logger.error(hosting.rejected_token_message(source, err))
         raise click.exceptions.Exit(1) from err
     except TokenValidationError as err:
-        logger.error(
-            f"Unable to validate the access token from the {source.value}: "
-            f"{err} (auth request id: {err.request_id}). Please try again later."
-        )
+        logger.error(hosting._token_validation_failure_message(source, err))
         raise click.exceptions.Exit(1) from err
 
     identity = {

tests/units/reflex_cli/utils/test_hosting.py

@@ -588,7 +588,7 @@ def test_unvalidated_token_in_non_interactive_mode_is_not_called_rejected(
     browser.assert_not_called()
     errors = [r.getMessage() for r in caplog.records if r.levelno == logging.ERROR]
     assert errors == [
-        "Unable to validate the access token from the config file: server error (auth request id: req-2)"
+        "Unable to validate the access token from the config file: server error (auth request id: req-2). Please try again later."
     ]