Unable to add owner via CLI; kinda works via web about crates.io

[weihanglo]

I got the same error message when the token scope is wrong.

    Updating crates.io index
error: failed to invite owners to crate `sfz` on registry at https://crates.io

Caused by:
  the remote server responded with an error (status 403 Forbidden): must be logged in to perform that action

Seems like crates.io returns the same error for different scenario. For 403 it's fine with returning fewer details, though maybe the error message could be more general?

crates.io/src/auth.rs

Lines 74 to 78 in 0371322

	if !self.endpoint_scope_matches(token.endpoint_scopes.as_ref()) {
	let error_message = "Endpoint scope mismatch";
	request.request_log().add("cause", error_message);
	return Err(forbidden());
	}

crates.io/src/util/errors.rs

Lines 57 to 60 in 0371322

	pub fn forbidden() -> BoxedAppError {
	let detail = "must be logged in to perform that action";
	custom(StatusCode::FORBIDDEN, detail)
	}

That said, not sure if it is something wrong in the CLI. That part hasn't changed for a while.

[Turbo87]

I just checked and the API token @metasim has created does not have the change owners token scope, which is most likely why the CLI command failed.

For 403 it's fine with returning fewer details, though maybe the error message could be more general?

yeah, that seems reasonable. we just reused the same error message that we had before token scopes got introduced, but we should probably adjust that to make people aware of that possibility.

[Turbo87]

/cc @rust-lang/cargo

[weihanglo]

Can't reproduce on my side. I've done the followings

• Tested with cargo version 1.76.0 and 1.77.2
• Created a change-owner scope token on my account (weihanglo)
• cargo login with that token
• cargo owner --add github:rust-tw:jobs-board-maintainers succeeded for my crate sfz
• Confirmed owner added on crates.io.
• cargo owner --remove github:rust-tw:jobs-board-maintainers succeeded for my crate sfz
• Confirmed owner removed on crates.io.

Could you try cargo logout and then cargo login again?

Also need more details from the server side.