Method fetchUser

packages/cli/src/auth/client.ts:119–162

(
    url: string,
    credential: ResolvedCredential,
    allowRefresh: boolean,
  )

  // fallow-ignore-next-line complexity
  private async fetchUser(
    url: string,
    credential: ResolvedCredential,
    allowRefresh: boolean,
  ): Promise<UserInfo> {
    const headers = buildAuthHeaders(credential);
    const res = await this.fetchImpl(url, { method: "GET", headers });

    if (res.status === 401) {
      if (
        allowRefresh &&
        credential.type === "oauth" &&
        credential.refresh_token &&
        this.onRefresh
      ) {
        const refreshed = await this.tryRefresh(credential.refresh_token);
        if (refreshed) {
          // Carry the new refresh_token forward too — for IdPs that
          // rotate RTs on every refresh, a future retry on this
          // in-memory credential would otherwise re-send the old
          // (now-invalidated) one.
          const next: ResolvedCredential = {
            ...credential,
            access_token: refreshed.access_token,
            ...(refreshed.refresh_token ? { refresh_token: refreshed.refresh_token } : {}),
          };
          return await this.fetchUser(url, next, false);
        }
      }
      const detail = await safeText(res);
      throw ErrUnauthenticated(detail || `${res.status} ${res.statusText}`);
    }
    if (!res.ok) {
      throw ErrApi(res.status, (await safeText(res)) || res.statusText);
    }

    let payload: unknown;
    try {
      payload = await res.json();
    } catch (err) {
      throw ErrApi(res.status, `non-JSON body: ${(err as Error).message}`);
    }
    return extractUserInfo(payload);
  }

  private async tryRefresh(refresh_token: string): Promise<OAuthTokens | null> {
    if (!this.onRefresh) return null;