improve cli error handling

Author: carderne

packages/cli-v3/src/commands/deploy.ts

@@ -11,7 +11,7 @@ import { DeploymentEventFromString } from "@trigger.dev/core/v3/schemas";
 import type { Command } from "commander";
 import { Option as CommandOption } from "commander";
 import { join, relative, resolve } from "node:path";
-import { env, isCI } from "std-env";
+import { isCI } from "std-env";
 import { x } from "tinyexec";
 import { z } from "zod";
 import chalk from "chalk";
@@ -270,8 +270,8 @@ async function _deployCommand(dir: string, options: DeployCommandOptions) {
   verifyDirectory(dir, projectPath);
 
   const authorization = await authenticateForDeploy({
-    secretKey: env.TRIGGER_SECRET_KEY,
-    apiUrl: env.TRIGGER_API_URL ?? options.apiUrl,
+    secretKey: process.env.TRIGGER_SECRET_KEY,
+    apiUrl: process.env.TRIGGER_API_URL ?? options.apiUrl,
     profile: options.profile,
     silent: options.plain,
     login,

packages/cli-v3/src/deploy/auth.test.ts

@@ -78,6 +78,62 @@ describe("authenticateForDeploy", () => {
     });
     expect(result).toEqual({ ok: false, error: "login result" });
   });
+
+  it("rejects a PAT in TRIGGER_SECRET_KEY with a helpful error", async () => {
+    const result = await authenticateForDeploy({
+      secretKey: "tr_pat_abc123",
+      profile: "default",
+      silent: true,
+      login: async () => ({ ok: false, error: "should not be called" }),
+    });
+
+    expect(result).toEqual({
+      ok: false,
+      error: expect.stringContaining("TRIGGER_ACCESS_TOKEN"),
+    });
+  });
+
+  it("rejects an OAT in TRIGGER_SECRET_KEY with a helpful error", async () => {
+    const result = await authenticateForDeploy({
+      secretKey: "tr_oat_abc123",
+      profile: "default",
+      silent: true,
+      login: async () => ({ ok: false, error: "should not be called" }),
+    });
+
+    expect(result).toEqual({
+      ok: false,
+      error: expect.stringContaining("TRIGGER_ACCESS_TOKEN"),
+    });
+  });
+
+  it("rejects a secret key that doesn't look like an API key", async () => {
+    const result = await authenticateForDeploy({
+      secretKey: "not-a-valid-key",
+      profile: "default",
+      silent: true,
+      login: async () => ({ ok: false, error: "should not be called" }),
+    });
+
+    expect(result).toEqual({
+      ok: false,
+      error: expect.stringContaining("does not look like a Trigger.dev API key"),
+    });
+  });
+
+  it("throws a descriptive error for an invalid API URL", async () => {
+    await expect(
+      authenticateForDeploy({
+        secretKey: "tr_prod_sk_deploy",
+        apiUrl: "not-a-url",
+        profile: "default",
+        silent: true,
+        login: async () => ({ ok: false, error: "should not be called" }),
+      })
+    ).rejects.toThrow(
+      'Invalid API URL "not-a-url". Check your TRIGGER_API_URL environment variable or --api-url flag.'
+    );
+  });
 });
 
 describe("userIdForDeploy", () => {

packages/cli-v3/src/deploy/auth.ts

@@ -1,6 +1,10 @@
 import { CLOUD_API_URL, CLOUD_WEB_URL } from "../consts.js";
 import type { LoginResult, LoginResultOk } from "../utilities/session.js";
 
+const personalTokenPrefix = "tr_pat_";
+const organizationTokenPrefix = "tr_oat_";
+const apiKeyPrefix = "tr_";
+
 export type DeployAuthorization =
   | LoginResultOk
   | {
@@ -45,6 +49,23 @@ export async function authenticateForDeploy({
     });
   }
 
+  if (secretKey.startsWith(personalTokenPrefix) || secretKey.startsWith(organizationTokenPrefix)) {
+    return {
+      ok: false,
+      error: `TRIGGER_SECRET_KEY is set to a ${
+        secretKey.startsWith(personalTokenPrefix) ? "Personal" : "Organization"
+      } Access Token. Use TRIGGER_ACCESS_TOKEN instead, or remove TRIGGER_SECRET_KEY and use \`trigger login\`.`,
+    };
+  }
+
+  if (!secretKey.startsWith(apiKeyPrefix)) {
+    return {
+      ok: false,
+      error:
+        "TRIGGER_SECRET_KEY does not look like a Trigger.dev API key. API keys start with \`tr_\` (e.g. \`tr_prod_...\`).",
+    };
+  }
+
   return {
     ok: true,
     profile,
@@ -62,10 +83,16 @@ function dashboardUrlForApiUrl(apiUrl: string): string {
     return CLOUD_WEB_URL;
   }
 
-  const url = new URL(apiUrl);
-  if (url.hostname.startsWith("api.") && url.hostname.endsWith(".trigger.dev")) {
-    url.hostname = url.hostname.slice(4);
-    return url.toString().replace(/\/$/, "");
+  try {
+    const url = new URL(apiUrl);
+    if (url.hostname.startsWith("api.") && url.hostname.endsWith(".trigger.dev")) {
+      url.hostname = url.hostname.slice(4);
+      return url.toString().replace(/\/$/, "");
+    }
+  } catch {
+    throw new Error(
+      `Invalid API URL "${apiUrl}". Check your TRIGGER_API_URL environment variable or --api-url flag.`
+    );
   }
 
   return apiUrl;