cli: do not panic on missing/invalid creds

CHANGELOG_PENDING.md

@@ -2,3 +2,5 @@
 
 ### Bug Fixes
 
+- Fix panics that could occur when no credentials are available or credentials were invalid.
+  [#93](https://github.com/pulumi/esc/pull/93)

cmd/esc/cli/cli_test.go

@@ -430,8 +430,11 @@ func (c *testPulumiClient) UpdateEnvironment(
 
 	_, diags, err := c.checkEnvironment(ctx, orgName, envName, yaml)
 	if err == nil && len(diags) == 0 {
+		h := fnv.New32()
+		h.Write(yaml)
+
 		env.yaml = yaml
-		env.tag = base64.StdEncoding.EncodeToString(fnv.New32().Sum(yaml))
+		env.tag = base64.StdEncoding.EncodeToString(h.Sum(nil))
 	}
 
 	return diags, err

cmd/esc/cli/login.go

@@ -73,12 +73,8 @@ func newLoginCmd(esc *escCommand) *cobra.Command {
 				backendURL, shared = account.BackendURL, isShared
 			}
 
-			switch {
-			case isInvalidSelfHostedURL(backendURL):
-				return fmt.Errorf("%s is not a valid self-hosted backend, "+
-					"use `esc login` without arguments to log into the Pulumi Cloud backend", backendURL)
-			case filestate.IsFileStateBackendURL(backendURL):
-				return fmt.Errorf("%s does not support Pulumi ESC.", backendURL)
+			if err := checkBackendURL(backendURL); err != nil {
+				return err
 			}
 
 			account, err := esc.login.Login(
@@ -141,11 +137,30 @@ func isInvalidSelfHostedURL(url string) bool {
 	return strings.HasPrefix(url, "app.pulumi.com/") || strings.HasPrefix(url, "pulumi.com")
 }
 
+func checkBackendURL(url string) error {
+	switch {
+	case isInvalidSelfHostedURL(url):
+		return fmt.Errorf("%s is not a valid self-hosted backend, "+
+			"use `esc login` without arguments to log into the Pulumi Cloud backend", url)
+	case filestate.IsFileStateBackendURL(url):
+		return fmt.Errorf("%s does not support Pulumi ESC.", url)
+	default:
+		return nil
+	}
+}
+
 func (esc *escCommand) getCachedClient(ctx context.Context) error {
 	account, _, err := esc.workspace.GetCurrentAccount(false)
 	if err != nil {
 		return fmt.Errorf("could not determine current cloud: %w", err)
 	}
+	if account == nil {
+		return fmt.Errorf("no credentials. Please run `esc login` to log in.")
+	}
+
+	if err := checkBackendURL(account.BackendURL); err != nil {
+		return err
+	}
 
 	ok, err := esc.getCachedCredentials(ctx, account.BackendURL, account.Insecure)
 	if err != nil {

cmd/esc/cli/login_test.go

@@ -0,0 +1,33 @@
+// Copyright 2023, Pulumi Corporation.
+
+package cli
+
+import (
+	"context"
+	"testing"
+
+	"github.com/pulumi/esc/cmd/esc/cli/workspace"
+	pulumi_workspace "github.com/pulumi/pulumi/sdk/v3/go/common/workspace"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestNoCreds(t *testing.T) {
+	fs := testFS{}
+	esc := &escCommand{workspace: workspace.New(fs, &testPulumiWorkspace{})}
+	err := esc.getCachedClient(context.Background())
+	assert.ErrorContains(t, err, "no credentials")
+}
+
+func TestFilestateBackend(t *testing.T) {
+	fs := testFS{}
+	esc := &escCommand{workspace: workspace.New(fs, &testPulumiWorkspace{
+		credentials: pulumi_workspace.Credentials{
+			Current: "gs://foo",
+			Accounts: map[string]pulumi_workspace.Account{
+				"gs://foo": {},
+			},
+		},
+	})}
+	err := esc.getCachedClient(context.Background())
+	assert.ErrorContains(t, err, "does not support Pulumi ESC")
+}