Trim repo-creation errors to the API reason; bump to 2.11.10

The SDK appends the request path and the response headers to
APIAccessDenied's message, so logging the exception as-is printed a
multi-line header dump at the default log level. APIInsufficientPermissions
carries no message at all, which left the line ending in ": ". Log the
first line, falling back to the exception type.

Quota and organization-not-allowed errors are also 403s, so the
repo:create hint no longer fires for those.

Bump to 2.11.10: v2.11.9 is already taken by an existing tag and GitHub
release (#434), even though that release never reached PyPI.

Author: lelia

CHANGELOG.md

@@ -1,6 +1,6 @@
 # Changelog
 
-## 2.11.9
+## 2.11.10
 
 ### Fixed: report why a new repository couldn't be created
 

pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "socketsecurity"
-version = "2.11.9"
+version = "2.11.10"
 requires-python = ">= 3.11"
 license = {"file" = "LICENSE"}
 dependencies = [

socketsecurity/__init__.py

@@ -1,3 +1,3 @@
 __author__ = 'socket.dev'
-__version__ = '2.11.9'
+__version__ = '2.11.10'
 USER_AGENT = f'SocketPythonCLI/{__version__}'

socketsecurity/core/__init__.py

@@ -20,7 +20,11 @@
     from socketsecurity.config import CliConfig
 from git import Repo
 from socketdev import socketdev
-from socketdev.exceptions import APIFailure
+from socketdev.exceptions import (
+    APIFailure,
+    APIInsufficientQuota,
+    APIOrganizationNotAllowed,
+)
 from socketdev.fullscans import DiffArtifacts, FullScanParams, SocketArtifact
 from socketdev.org import Organization
 from socketdev.repos import RepositoryInfo
@@ -1534,8 +1538,11 @@ def get_repo_info(self, repo_slug: str, default_branch: str = "socket-default-br
 
             except APIFailure as e:
                 status = f" (HTTP {e.status_code})" if e.status_code else ""
-                log.error(f"API failure while creating repository {repo_slug}{status}: {e}")
-                if e.status_code == 403:
+                # The SDK appends the request path and response headers after the first line,
+                # and some subclasses carry no message at all.
+                reason = str(e).split("\n", 1)[0] or type(e).__name__
+                log.error(f"API failure while creating repository {repo_slug}{status}: {reason}")
+                if e.status_code == 403 and not isinstance(e, (APIInsufficientQuota, APIOrganizationNotAllowed)):
                     log.error("A 403 here usually means the API token is missing the repo:create scope.")
                 sys.exit(2) # Exit here with code 2. Code 1 indicates a successfully-detected security issue.
 

tests/core/test_sdk_methods.py

@@ -1,7 +1,13 @@
 import logging
 
 import pytest
-from socketdev.exceptions import APIAccessDenied, APIFailure, APIResourceNotFound
+from socketdev.exceptions import (
+    APIAccessDenied,
+    APIFailure,
+    APIInsufficientPermissions,
+    APIInsufficientQuota,
+    APIResourceNotFound,
+)
 from socketdev.fullscans import FullScanParams, FullScanStreamResponse, ScanType
 
 from socketsecurity.config import CliConfig
@@ -50,8 +56,10 @@ def test_get_repo_info(core, mock_sdk_with_responses):
 def test_get_repo_info_logs_why_repo_creation_failed(core, mock_sdk_with_responses, caplog):
     """A repo that isn't in Socket yet and can't be created exits 2 with the reason logged"""
     mock_sdk_with_responses.repos.repo.side_effect = APIResourceNotFound(status_code=404)
+    # Mirrors the SDK, which appends the request path and response headers to the message
     mock_sdk_with_responses.repos.post.side_effect = APIAccessDenied(
-        "Insufficient permissions", status_code=403
+        "Insufficient permissions\nPath: https://api.socket.dev/v0/orgs/test/repos\n\nHeaders:\nx-req: 1",
+        status_code=403,
     )
 
     with caplog.at_level(logging.INFO, logger="socketdev"), pytest.raises(SystemExit) as exit_info:
@@ -60,10 +68,32 @@ def test_get_repo_info_logs_why_repo_creation_failed(core, mock_sdk_with_respons
     assert exit_info.value.code == 2
     messages = [record.getMessage() for record in caplog.records]
     assert "Failed to get repository new-repo, attempting to create it" in messages
-    assert any("creating repository new-repo (HTTP 403)" in message for message in messages)
+    assert "API failure while creating repository new-repo (HTTP 403): Insufficient permissions" in messages
     assert any("repo:create" in message for message in messages)
 
 
+@pytest.mark.parametrize(
+    ("error", "expected_reason", "expects_scope_hint"),
+    [
+        (APIInsufficientPermissions(status_code=403), "APIInsufficientPermissions", True),
+        (APIInsufficientQuota(status_code=403), "APIInsufficientQuota", False),
+    ],
+)
+def test_get_repo_info_repo_creation_failure_reason(
+        core, mock_sdk_with_responses, caplog, error, expected_reason, expects_scope_hint
+):
+    """Message-less SDK errors still name a reason, and only permission 403s get the scope hint"""
+    mock_sdk_with_responses.repos.repo.side_effect = APIResourceNotFound(status_code=404)
+    mock_sdk_with_responses.repos.post.side_effect = error
+
+    with caplog.at_level(logging.INFO, logger="socketdev"), pytest.raises(SystemExit):
+        core.get_repo_info("new-repo")
+
+    messages = [record.getMessage() for record in caplog.records]
+    assert f"API failure while creating repository new-repo (HTTP 403): {expected_reason}" in messages
+    assert any("repo:create" in message for message in messages) is expects_scope_hint
+
+
 def test_get_repo_info_restores_log_level_after_creating_repo(
         core, mock_sdk_with_responses, repo_info_response, caplog
 ):