fix: distinguish auth and network validation failures

NianJiuZst · NianJiuZst · commit faab965e9a18 · 2026-07-14T20:21:32.000+08:00
diff --git a/src/commands/auth/login.ts b/src/commands/auth/login.ts
@@ -20,6 +20,37 @@ interface QuotaApiResponse {
   model_remains: QuotaModelRemain[];
 }
 
+function isNetworkUnavailable(error: unknown): boolean {
+  if (error instanceof CLIError) {
+    return error.exitCode === ExitCode.NETWORK || error.exitCode === ExitCode.TIMEOUT;
+  }
+
+  if (!(error instanceof Error)) return false;
+
+  if (error.name === 'AbortError' || error.name === 'TimeoutError') return true;
+
+  const message = error.message.toLowerCase();
+  const code = 'code' in error ? String(error.code).toLowerCase() : '';
+  return (error instanceof TypeError && message === 'fetch failed')
+    || message.includes('failed to fetch')
+    || message.includes('unable to connect')
+    || message.includes('connection refused')
+    || message.includes('econnrefused')
+    || message.includes('connection reset')
+    || message.includes('econnreset')
+    || message.includes('network error')
+    || message.includes('enotfound')
+    || message.includes('getaddrinfo')
+    || message.includes('proxy')
+    || message.includes('socket')
+    || message.includes('etimedout')
+    || code === 'connectionrefused'
+    || code === 'econnrefused'
+    || code === 'econnreset'
+    || code === 'enotfound'
+    || code === 'etimedout';
+}
+
 async function showQuotaAfterLogin(config: Config): Promise<void> {
   try {
     const url = quotaEndpoint(config.baseUrl);
@@ -149,11 +180,23 @@ async function loginWithApiKey(
   // Verify the selected region actually authorizes the quota endpoint.
   try {
     await requestJson<QuotaApiResponse>(cfg, { url: quotaEndpoint(cfg.baseUrl) });
-  } catch {
-    throw new CLIError(
-      'API key validation failed.',
-      ExitCode.AUTH,
-      'Check that your key is valid and belongs to a Token Plan.',
+  } catch (error) {
+    if (error instanceof CLIError && error.exitCode === ExitCode.AUTH) {
+      throw new CLIError(
+        'API key validation failed.',
+        ExitCode.AUTH,
+        'Check that your key is valid and belongs to a Token Plan.',
+      );
+    }
+
+    if (!explicitRegion) throw error;
+
+    const validationFailure = isNetworkUnavailable(error)
+      ? `the ${detected} API endpoint is unreachable`
+      : `the ${detected} API endpoint returned an inconclusive response`;
+    process.stderr.write(
+      `Warning: Could not validate the API key because ${validationFailure}.\n` +
+      `Saving the explicitly selected region "${detected}". Requests may fail until validation succeeds.\n`,
     );
   }
 
diff --git a/src/config/detect-region.ts b/src/config/detect-region.ts
@@ -5,6 +5,8 @@ import { ExitCode } from "../errors/codes";
 
 const QUOTA_PATH = "/v1/token_plan/remains";
 
+type ProbeResult = "authorized" | "unauthorized" | "unreachable" | "inconclusive";
+
 function quotaUrl(region: Region): string {
   return REGIONS[region] + QUOTA_PATH;
 }
@@ -13,7 +15,7 @@ async function probeRegion(
   region: Region,
   apiKey: string,
   timeoutMs: number,
-): Promise<boolean> {
+): Promise<ProbeResult> {
   // MiniMax endpoints accept either Bearer or x-api-key auth — try both.
   // Some API key types only work with one style; trying both prevents false
   // negatives that would cause the wrong region to be selected, leading to
@@ -23,22 +25,41 @@ async function probeRegion(
     { "x-api-key": apiKey },
   ];
 
+  let sawNetworkFailure = false;
+  let sawInconclusiveResponse = false;
+
   for (const authHeader of authHeaders) {
+    let res: Response;
     try {
-      const res = await fetch(quotaUrl(region), {
+      res = await fetch(quotaUrl(region), {
         headers: { ...authHeader, "Content-Type": "application/json" },
         signal: AbortSignal.timeout(timeoutMs),
       });
-      if (!res.ok) continue;
+    } catch {
+      sawNetworkFailure = true;
+      continue;
+    }
+
+    if (res.status === 401 || res.status === 403) continue;
+    if (!res.ok) {
+      sawInconclusiveResponse = true;
+      continue;
+    }
+
+    try {
       const data = (await res.json()) as {
         base_resp?: { status_code?: number };
       };
-      if (data.base_resp?.status_code === 0) return true;
+      if (data.base_resp?.status_code === 0) return "authorized";
+      sawInconclusiveResponse = true;
     } catch {
-      // Try next auth style before giving up on this region
+      sawInconclusiveResponse = true;
     }
   }
-  return false;
+
+  if (sawInconclusiveResponse) return "inconclusive";
+  if (sawNetworkFailure) return "unreachable";
+  return "unauthorized";
 }
 
 export async function detectRegion(apiKey: string): Promise<Region> {
@@ -47,16 +68,33 @@ export async function detectRegion(apiKey: string): Promise<Region> {
   const results = await Promise.all(
     regions.map(async (r) => ({
       region: r,
-      ok: await probeRegion(r, apiKey, 5000),
+      result: await probeRegion(r, apiKey, 5000),
     })),
   );
-  const match = results.find((r) => r.ok);
+  const match = results.find((r) => r.result === "authorized");
   if (!match) {
     process.stderr.write(" failed\n");
+
+    if (results.every((r) => r.result === "unauthorized")) {
+      throw new CLIError(
+        "API key was rejected by all regions.",
+        ExitCode.AUTH,
+        "No credentials were changed. Check that the key is valid and belongs to a Token Plan.",
+      );
+    }
+
+    if (results.some((r) => r.result === "unreachable")) {
+      throw new CLIError(
+        "Could not reach the regional API endpoints.",
+        ExitCode.NETWORK,
+        "No region was changed. Check the network or proxy, then retry or pass --region global|cn explicitly.",
+      );
+    }
+
     throw new CLIError(
       "Could not determine the API key region.",
-      ExitCode.AUTH,
-      "No region was changed. Check the key and network, then retry or pass --region global|cn explicitly.",
+      ExitCode.GENERAL,
+      "No region was changed because the API returned an inconclusive response. Retry later or pass --region global|cn explicitly.",
     );
   }
   const detected: Region = match.region;
diff --git a/test/auth/timeout-fix.test.ts b/test/auth/timeout-fix.test.ts
@@ -98,14 +98,37 @@ describe('detect-region: probeRegion auth style fallback', () => {
         throw new Error('Expected region detection to fail');
       } catch (error) {
         expect(error).toBeInstanceOf(CLIError);
-        expect((error as CLIError).message).toBe('Could not determine the API key region.');
+        expect((error as CLIError).message).toBe('API key was rejected by all regions.');
         expect((error as CLIError).exitCode).toBe(ExitCode.AUTH);
       }
     } finally {
       (REGIONS as Record<string, string>).global = origGlobal;
       (REGIONS as Record<string, string>).cn = origCn;
     }
   });
+
+  it('reports a network error when no regional endpoint is reachable', async () => {
+    const { REGIONS } = await import('../../src/config/schema');
+    const origGlobal = REGIONS.global;
+    const origCn = REGIONS.cn;
+    (REGIONS as Record<string, string>).global = 'http://127.0.0.1:1';
+    (REGIONS as Record<string, string>).cn = 'http://127.0.0.1:1';
+
+    try {
+      const { detectRegion } = await import('../../src/config/detect-region');
+      try {
+        await detectRegion('unverifiable-key');
+        throw new Error('Expected region detection to fail');
+      } catch (error) {
+        expect(error).toBeInstanceOf(CLIError);
+        expect((error as CLIError).message).toBe('Could not reach the regional API endpoints.');
+        expect((error as CLIError).exitCode).toBe(ExitCode.NETWORK);
+      }
+    } finally {
+      (REGIONS as Record<string, string>).global = origGlobal;
+      (REGIONS as Record<string, string>).cn = origCn;
+    }
+  });
 });
 
 // ---------------------------------------------------------------------------
diff --git a/test/commands/auth/login.test.ts b/test/commands/auth/login.test.ts
@@ -3,7 +3,10 @@ import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { default as loginCommand } from '../../../src/commands/auth/login';
+import { readConfigFile, writeConfigFile } from '../../../src/config/loader';
 import { REGIONS } from '../../../src/config/schema';
+import { CLIError } from '../../../src/errors/base';
+import { ExitCode } from '../../../src/errors/codes';
 import { createMockServer, jsonResponse, type MockServer } from '../../helpers/mock-server';
 
 describe('auth login command', () => {
@@ -106,6 +109,168 @@ describe('auth login command', () => {
       );
 
       expect(quotaRequests).toBe(2);
+      expect(readConfigFile()).toMatchObject({
+        api_key: 'cn-test-key',
+        region: 'cn',
+      });
+    } finally {
+      (REGIONS as Record<string, string>).global = originalGlobal;
+      (REGIONS as Record<string, string>).cn = originalCn;
+    }
+  });
+
+  it('does not save an explicitly selected region when authentication is rejected', async () => {
+    server = createMockServer({
+      routes: {
+        '/v1/token_plan/remains': () => jsonResponse({ error: 'unauthorized' }, 401),
+      },
+    });
+
+    configDir = mkdtempSync(join(tmpdir(), 'mmx-region-login-'));
+    process.env.MMX_CONFIG_DIR = configDir;
+    await writeConfigFile({ api_key: 'existing-key', region: 'global' });
+
+    const originalCn = REGIONS.cn;
+    (REGIONS as Record<string, string>).cn = server.url;
+
+    try {
+      try {
+        await loginCommand.execute(
+          {
+            region: 'global',
+            baseUrl: REGIONS.global,
+            output: 'text',
+            timeout: 1,
+            verbose: false,
+            quiet: true,
+            noColor: true,
+            yes: false,
+            dryRun: false,
+            nonInteractive: true,
+            async: false,
+          },
+          {
+            apiKey: 'rejected-key',
+            region: 'cn',
+            quiet: true,
+            verbose: false,
+            noColor: true,
+            yes: false,
+            dryRun: false,
+            help: false,
+            nonInteractive: true,
+            async: false,
+          },
+        );
+        throw new Error('Expected API key validation to fail');
+      } catch (error) {
+        expect(error).toBeInstanceOf(CLIError);
+        expect((error as CLIError).exitCode).toBe(ExitCode.AUTH);
+      }
+
+      expect(readConfigFile()).toEqual({ api_key: 'existing-key', region: 'global' });
+    } finally {
+      (REGIONS as Record<string, string>).cn = originalCn;
+    }
+  });
+
+  it('warns and saves an explicit region when its endpoint is unreachable', async () => {
+    configDir = mkdtempSync(join(tmpdir(), 'mmx-region-login-'));
+    process.env.MMX_CONFIG_DIR = configDir;
+    await writeConfigFile({ api_key: 'existing-key', region: 'global' });
+
+    const originalCn = REGIONS.cn;
+    (REGIONS as Record<string, string>).cn = 'http://127.0.0.1:1';
+    const originalWrite = process.stderr.write.bind(process.stderr);
+    let stderr = '';
+    (process.stderr as NodeJS.WriteStream).write = (chunk: unknown) => {
+      stderr += String(chunk);
+      return true;
+    };
+
+    try {
+      await loginCommand.execute(
+        {
+          region: 'global',
+          baseUrl: REGIONS.global,
+          output: 'text',
+          timeout: 1,
+          verbose: false,
+          quiet: true,
+          noColor: true,
+          yes: false,
+          dryRun: false,
+          nonInteractive: true,
+          async: false,
+        },
+        {
+          apiKey: 'explicit-cn-key',
+          region: 'cn',
+          quiet: true,
+          verbose: false,
+          noColor: true,
+          yes: false,
+          dryRun: false,
+          help: false,
+          nonInteractive: true,
+          async: false,
+        },
+      );
+
+      expect(readConfigFile()).toEqual({ api_key: 'explicit-cn-key', region: 'cn' });
+      expect(stderr).toContain('Warning: Could not validate the API key');
+      expect(stderr).toContain('Saving the explicitly selected region "cn"');
+    } finally {
+      (process.stderr as NodeJS.WriteStream).write = originalWrite;
+      (REGIONS as Record<string, string>).cn = originalCn;
+    }
+  });
+
+  it('keeps existing credentials when auto-detection cannot reach either region', async () => {
+    configDir = mkdtempSync(join(tmpdir(), 'mmx-region-login-'));
+    process.env.MMX_CONFIG_DIR = configDir;
+    await writeConfigFile({ api_key: 'existing-key', region: 'cn' });
+
+    const originalGlobal = REGIONS.global;
+    const originalCn = REGIONS.cn;
+    (REGIONS as Record<string, string>).global = 'http://127.0.0.1:1';
+    (REGIONS as Record<string, string>).cn = 'http://127.0.0.1:1';
+
+    try {
+      try {
+        await loginCommand.execute(
+          {
+            region: 'cn',
+            baseUrl: originalCn,
+            output: 'text',
+            timeout: 1,
+            verbose: false,
+            quiet: true,
+            noColor: true,
+            yes: false,
+            dryRun: false,
+            nonInteractive: true,
+            async: false,
+          },
+          {
+            apiKey: 'unverifiable-key',
+            quiet: true,
+            verbose: false,
+            noColor: true,
+            yes: false,
+            dryRun: false,
+            help: false,
+            nonInteractive: true,
+            async: false,
+          },
+        );
+        throw new Error('Expected region detection to fail');
+      } catch (error) {
+        expect(error).toBeInstanceOf(CLIError);
+        expect((error as CLIError).exitCode).toBe(ExitCode.NETWORK);
+      }
+
+      expect(readConfigFile()).toEqual({ api_key: 'existing-key', region: 'cn' });
     } finally {
       (REGIONS as Record<string, string>).global = originalGlobal;
       (REGIONS as Record<string, string>).cn = originalCn;
