fix(cli): stop masking auth errors as token expiry

[waveywaves]

Summary

• Fix all 401/UNAUTHORIZED auth errors being incorrectly displayed as "your authentication token has expired"
• Reorder switch cases so isUnmatchedAuthErr fallback does not shadow org-membership error cases
• Add unit tests for isWrappedErr and isUnmatchedAuthErr helper functions

Root Cause Analysis

The Kratos errors.Is() implementation only compares Code and Reason fields:

func (e *Error) Is(err error) bool {
    if se := new(Error); errors.As(err, &se) {
        return se.Code == e.Code && se.Reason == e.Reason
    }
    return false
}

All JWT middleware errors (ErrTokenExpired, ErrTokenInvalid, ErrTokenParseFail, ErrMissingJwtToken) are created with errors.Unauthorized("UNAUTHORIZED", "<message>"), giving them identical Code: 401 and Reason: "UNAUTHORIZED" fields. Only the Message field differs. This caused errors.Is() to match any auth error against ErrTokenExpired first in the switch statement, masking the real error type.

Changes

• Remove the errors.Is() short-circuit in isWrappedErr — keep only the Code + Message comparison, which correctly distinguishes between different JWT error types
• Add explicit case branches for ErrTokenInvalid ("token is invalid") and ErrTokenParseFail ("failed to parse token") so users see accurate error messages
• Add a fallback (isUnmatchedAuthErr) for unmatched 401 errors that surfaces the server's original message instead of silently dropping it
• Reorder switch cases so org-membership checks (IsUserNotMemberOfOrgErrorNotInOrg, IsUserWithNoMembershipErrorNotInOrg) come BEFORE the generic isUnmatchedAuthErr fallback. Note: org-membership errors use gRPC code 7 (PermissionDenied), not code 16 (Unauthenticated), so shadowing is structurally impossible — but the ordering is kept for readability/clarity
• Add explanatory comment on isWrappedErr documenting why we use Message comparison instead of Kratos errors.Is()
• Add unit tests covering:
  • isWrappedErr correctly matches each JWT error sentinel against itself
  • isWrappedErr does NOT cross-match different JWT error types
  • isUnmatchedAuthErr catches generic 401/Unauthenticated errors
  • isUnmatchedAuthErr does NOT catch non-401 errors (PermissionDenied, Internal, NotFound, OK)
  • Regression test demonstrating the Kratos errors.Is() masking bug and proving our fix avoids it
  • gRPC wire round-trip test — serializes each JWT sentinel to gRPC status proto bytes, deserializes back, and verifies isWrappedErr still works correctly (tests the full server-to-client error path)
  • Sentinel message canary assertions — asserts the exact Message strings of all four JWT sentinels (including ErrTokenParseFail's trailing space). If Kratos updates and changes these strings, the test fails immediately and alerts us to update our matching

Test Plan

• go test ./app/cli/ -v — all 23 test cases pass (5 test functions)
• go vet ./app/cli/... passes
• Test with an expired JWT token: confirms "token has expired" message
• Test with an invalid/revoked JWT token: confirms "token is invalid" message (previously showed "token has expired")
• Test with a malformed JWT token: confirms "failed to parse" message
• Test with missing JWT token: confirms "authentication required" message
• Test with an unrecognized 401 error: confirms server's original message is shown

Fixes #2922

[cubic-dev-ai]

No issues found across 4 files