fix: Cleaner error when not authenticated and token file is missing (#366)

When no token file exists (user never ran `cloudquery login`), `GetToken` now returns a concise "not authenticated" message instead of leaking the wrapped `os.ReadFile` error (`failed to read refresh token: failed to read file: open …/cloudquery/token: no such file or directory`); genuine read errors still surface verbosely.

Currently, the error message from `cloudquery switch` right after `cloudquery logout`:
> Error: failed to get auth token: failed to read refresh token: failed to read file: open /Users/<me>/Library/Application Support/cloudquery/token: no such file or directory. Hint: You may need to run `cloudquery login` or set CLOUDQUERY_API_KEY

Author: disq

auth/token.go

@@ -2,6 +2,7 @@ package auth
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -84,7 +85,10 @@ func (tc *TokenClient) GetToken() (Token, error) {
 	}
 
 	refreshToken, err := ReadRefreshToken()
-	if err != nil {
+	switch {
+	case errors.Is(err, os.ErrNotExist):
+		return UndefinedToken, fmt.Errorf("not authenticated. Hint: You may need to run `cloudquery login` or set %s", EnvVarCloudQueryAPIKey)
+	case err != nil:
 		return UndefinedToken, fmt.Errorf("failed to read refresh token: %w. Hint: You may need to run `cloudquery login` or set %s", err, EnvVarCloudQueryAPIKey)
 	}
 	if refreshToken == "" {

auth/token_test.go

@@ -9,6 +9,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/cloudquery/cloudquery-api-go/config"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -41,6 +42,18 @@ func TestRefreshToken_Removal(t *testing.T) {
 	require.Error(t, err)
 }
 
+func TestTokenClient_GetToken_NotAuthenticated(t *testing.T) {
+	t.Setenv(EnvVarCloudQueryAPIKey, "")
+	require.NoError(t, config.SetDataHome(t.TempDir()))
+	defer func() { require.NoError(t, config.UnsetDataHome()) }()
+
+	_, err := NewTokenClient().GetToken()
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "not authenticated")
+	require.NotContains(t, err.Error(), "no such file")
+	require.NotContains(t, err.Error(), "failed to read file")
+}
+
 func TestToken_Stringer(t *testing.T) {
 	token := Token{Type: BearerToken, Value: "my_token"}
 	out := fmt.Sprintf("Bearer %s", token)