From a27122ab769d3604fdf2ed3b17022cff61baf893 Mon Sep 17 00:00:00 2001
From: wbtiger <28288271@qq.com>
Date: Wed, 8 Apr 2026 12:38:25 +0800
Subject: [PATCH] fix: GetCurrentUser must check HTTP status and JSON status
 for token verification
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

GetCurrentUser() was not checking the HTTP status code or the JSON
"status" field. GitLink returns {"status":401,"message":"无效token"}
as valid JSON, so json.Unmarshal succeeds and the function returns nil
error — making any token appear valid.

Now properly checks HTTP status code, JSON status field, and requires
"login" field in response. If login API tokens fail verification,
shows clear guidance to use private token (--token mode).

Root cause of Windows 401: login API returns session/CSRF token, not
a valid API access_token. The broken verification masked this entirely.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 internal/auth/login.go | 18 +++++++++++++++++-
 npm/package.json       |  2 +-
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/internal/auth/login.go b/internal/auth/login.go
index cf59054..18ea099 100644
--- a/internal/auth/login.go
+++ b/internal/auth/login.go
@@ -123,10 +123,11 @@ func Login(username, password string) (*LoginResult, error) {
 		}
 	}
 
-	return nil, fmt.Errorf("login succeeded but token verification failed: %w", lastErr)
+	return nil, fmt.Errorf("login succeeded but token verification failed (%v).\n\nPlease use private token instead:\n  1. Visit https://www.gitlink.org.cn/tokens → Create a new token\n  2. Run: gitlink-cli auth login --token\n  3. Paste your private token", lastErr)
 }
 
 // GetCurrentUser fetches the authenticated user info.
+// Returns error if not authenticated or token is invalid.
 func GetCurrentUser() (map[string]interface{}, error) {
 	cfg, err := config.Load()
 	if err != nil {
@@ -145,10 +146,25 @@ func GetCurrentUser() (map[string]interface{}, error) {
 		return nil, err
 	}
 
+	if resp.StatusCode != 200 {
+		return nil, fmt.Errorf("HTTP %d: %s", resp.StatusCode, string(data))
+	}
+
 	var result map[string]interface{}
 	if err := json.Unmarshal(data, &result); err != nil {
 		return nil, err
 	}
 
+	// GitLink returns {"status": -1, "message": "..."} for auth errors with HTTP 200
+	if status, ok := result["status"].(float64); ok && status < 0 {
+		msg, _ := result["message"].(string)
+		return nil, fmt.Errorf("%s", msg)
+	}
+
+	// Verify we got actual user data
+	if _, ok := result["login"]; !ok {
+		return nil, fmt.Errorf("invalid response: missing login field")
+	}
+
 	return result, nil
 }
diff --git a/npm/package.json b/npm/package.json
index f33ccd8..797f109 100644
--- a/npm/package.json
+++ b/npm/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@gitlink-ai/cli",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "GitLink 平台官方命令行工具 — 代码托管、协作开发和自动化",
   "bin": {
     "gitlink-cli": "bin/cli.js",