Function EnsureAuthenticated

pkg/auth/authenticate.go:14–29

EnsureAuthenticated returns a valid access token from the stored session. If no valid session exists and the terminal is interactive, it triggers the browser-based OAuth login flow automatically.

(
	io *iostreams.IOStreams,
	client *dashboard.Client,
)

// If no valid session exists and the terminal is interactive, it triggers the
// browser-based OAuth login flow automatically.
func EnsureAuthenticated(
	io *iostreams.IOStreams,
	client *dashboard.Client,
) (string, error) {
	accessToken, err := GetValidToken(client)
	if err == nil {
		return accessToken, nil
	}

	cs := io.ColorScheme()
	fmt.Fprintf(io.Out, "%s %s\n", cs.WarningIcon(), err)

	// No flow tracker: this re-authentication belongs to the calling flow,
	// not to an `auth login` funnel.
	return RunOAuth(io, client, false, true, nil)
}

// ReauthenticateIfExpired checks if err is a session-expired error from the API.
// If so, it clears the invalid token and triggers the login flow.