fix(auth): short-circuit whoami for org auth tokens (CLI-1AZ)

[BYK]

Summary

Fix CLI-1AZ: sentry auth whoami throws a confusing empty-detail ApiError: API request failed: 400 Bad Request when the active token is an organization auth token (sntrys_...).

The Sentry backend's /auth/ endpoint (AuthIndexEndpoint) doesn't accept org auth tokens — UserAuthTokenAuthentication.accepts_auth explicitly rejects the sntrys_ prefix, and OrgAuthTokenAuthentication was never added to this endpoint (getsentry/sentry#112853 added user-token auth only). Even if it did, whoami is semantically meaningless for org tokens — they aren't tied to a single user. The CLI should detect this client-side and tell the user clearly, not let them hit a 400.

What this PR does

1. Org-token short-circuit (src/commands/auth/whoami.ts): before any API call, inspect the effective token via getAuthToken(). If it's sntrys_..., throw a ResolutionError pointing to sentry auth status and sentry org list. No request, no confusing 400, no auto-login loop.

2. Response-header telemetry (src/lib/api/infrastructure.ts): on every 4xx/5xx in apiRequestToRegion, attach an allow-listed subset of response headers (content-type, content-length, server, cf-ray, x-sentry-error, www-authenticate) to the Sentry scope as api_response_headers context. Lets future empty-detail 4xx events be triaged without user-side repro — Sentry-app 4xx (JSON body) vs CDN / WAF / proxy 4xx (HTML or empty body) is visible at a glance. Useful diagnostic for any future auth-class anomaly.

3. New classifySentryToken() helper (src/lib/token-type.ts): literal-prefix classification returning "org-auth-token" / "user-auth-token" / "oauth-or-legacy". Tiny, reusable, property-tested.

Background

Most events on CLI-1AZ pre-date the server-side rollout of getsentry/sentry#112853 (merged Apr 20, shipped 26.4.1). That PR added UserAuthTokenAuthentication to the /auth/ endpoint, fixing 400s for OAuth and user PATs (sntryu_...). Now that the rollout is complete, the only persistent 400 cause on /auth/ is org auth tokens — addressed by the short-circuit above.

Verification

• bun x tsc --noEmit — clean.
• bun run script/check-error-patterns.ts — no anti-patterns.
• bun test test/commands/auth/whoami.test.ts — 13/13 pass (org-token short-circuit + error message + sntryu_ passes through, plus existing happy-path coverage).
• bun test test/lib/token-type.property.test.ts — 10/10 pass (fast-check properties + case sensitivity + boundary cases).
• bun test test/lib/api/infrastructure.test.ts — 5/5 pass (telemetry addition doesn't regress).

Manual repro

# Org-token short-circuit (no API call, clear message)
SENTRY_AUTH_TOKEN='sntrys_fake' bun run src/bin.ts auth whoami

# Normal happy path (unchanged)
bun run src/bin.ts auth whoami

Refs

• Sentry issue: CLI-1AZ
• Server-side context: fix(api): Allow Bearer token auth for GET /api/0/auth/ sentry#112853 (6c28450, merged Apr 20 2026, shipped 26.4.1)

[github-actions]

PR Preview Action v1.8.1
🚀 View preview at https://cli.sentry.dev/_preview/pr-841/
Built to branch gh-pages at 2026-04-25 14:50 UTC. Preview will be ready when the GitHub Pages deployment is complete.

[github-actions]

Codecov Results 📊

✅ 5933 passed | Total: 5933 | Pass Rate: 100% | Execution Time: 0ms

📊 Comparison with Base Branch

Metric	Change
Total Tests	📈 +13
Passed Tests	📈 +13
Failed Tests	—
Skipped Tests	—

All tests are passing successfully.

❌ Patch coverage is 79.49%. Project has 13047 uncovered lines.
❌ Project coverage is 75.14%. Comparing base (base) to head (head).

Files with missing lines (1)

File	Patch %	Lines
src/commands/auth/whoami.ts	65.22%	⚠️ 8 Missing

Coverage diff

@@            Coverage Diff             @@
##          main       #PR       +/-##
==========================================
- Coverage    75.16%    75.14%    -0.02%
==========================================
  Files          284       285        +1
  Lines        52437     52490       +53
  Branches         0         0         —
==========================================
+ Hits         39412     39443       +31
- Misses       13025     13047       +22
- Partials         0         0         —

---

Generated by Codecov Action