From 2c16e51de3e19fb2f3e921cc202c03a6d87ec696 Mon Sep 17 00:00:00 2001
From: "mendral-app[bot]" <233154221+mendral-app[bot]@users.noreply.github.com>
Date: Wed, 10 Jun 2026 12:51:47 -0700
Subject: [PATCH] fix: replace BlaxelAuth fallback with MissingCredentials
 sentinel

When credentials exist but don't match any known auth type (e.g. only
refresh_token/access_token), the auth() function previously returned a
raw BlaxelAuth base class whose .token property raises NotImplementedError.

Replace with MissingCredentials that raises an actionable CredentialsError
guiding users to run `bl login` or set BL_API_KEY.
---
 src/blaxel/core/authentication/__init__.py |  9 +++++-
 tests/core/test_authentication_env_vars.py | 33 ++++++++++++++++++++++
 2 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/src/blaxel/core/authentication/__init__.py b/src/blaxel/core/authentication/__init__.py
index 02953d2..f637f45 100644
--- a/src/blaxel/core/authentication/__init__.py
+++ b/src/blaxel/core/authentication/__init__.py
@@ -126,7 +126,14 @@ def auth(env: str, base_url: str) -> BlaxelAuth:
         logger.debug("Using device code for authentication")
         return DeviceMode(credentials, credentials.workspace, base_url)
 
-    return BlaxelAuth(credentials, credentials.workspace, base_url)
+    return MissingCredentials(
+        base_url,
+        message=(
+            "Blaxel credentials were found but no supported authentication method "
+            "could be determined. Your credentials may be incomplete or corrupted. "
+            "Run `bl login` to re-authenticate, or set BL_API_KEY."
+        ),
+    )
 
 
 __all__ = [
diff --git a/tests/core/test_authentication_env_vars.py b/tests/core/test_authentication_env_vars.py
index 0ee57ef..f4af947 100644
--- a/tests/core/test_authentication_env_vars.py
+++ b/tests/core/test_authentication_env_vars.py
@@ -110,3 +110,36 @@ def test_settings_headers_clear_error_without_credentials(no_config, clear_auth_
     s = Settings()
     with pytest.raises(CredentialsError):
         _ = s.headers
+
+
+def test_incomplete_credentials_fallback_raises_credentials_error(
+    no_config, clear_auth_env, monkeypatch, tmp_path
+):
+    """Credentials with only refresh_token/access_token must raise CredentialsError, not NotImplementedError."""
+    import yaml
+
+    config_dir = tmp_path / ".blaxel"
+    config_dir.mkdir()
+    config_path = config_dir / "config.yaml"
+    config_path.write_text(
+        yaml.dump(
+            {
+                "context": {"workspace": "my-ws"},
+                "workspaces": [
+                    {
+                        "name": "my-ws",
+                        "credentials": {
+                            "refresh_token": "some-token",
+                            "access_token": "some-access",
+                        },
+                    }
+                ],
+            }
+        )
+    )
+    monkeypatch.setattr("pathlib.Path.home", lambda: tmp_path)
+    a = auth("prod", BASE_URL)
+    assert isinstance(a, MissingCredentials)
+    with pytest.raises(CredentialsError) as exc:
+        _ = a.token
+    assert "bl login" in str(exc.value)