fix(auth): report OAuth denial instead of an internal CLI error

[AmanVarshney01]

Reproduced with the published binary

On Linux, start prisma@8.0.0-rc.13 auth login --json with isolated credentials and send a normal OAuth access_denied response to its local callback listener. The published binary reports CLI.INTERNAL_ERROR with the callback description as its summary. No authorization code, token exchange, or real account is needed to exercise this failure path.

Fix in the owning repo

Recognize access_denied where the callback is handled and emit AUTH.LOGIN_DENIED with an actionable next step. Do not echo the untrusted callback description. No token exchange runs and no existing session is cleared. Other OAuth/SDK errors and signal cancellation remain unchanged; this is not a catch-all auth wrapper.

Verification

• Actual built binary under Linux produces AUTH.LOGIN_DENIED for the same callback that produced CLI.INTERNAL_ERROR before.
• All 61 CLI test files passed locally: 961 passed, 1 skipped.
• Repository typecheck, lint, and error-reference completeness passed.
• One focused callback regression verifies the structured error, safe browser response, and no credential mutation.
• Existing CI runs Windows and Linux tests. No new workflow or dependency.

Scope and limits

This corrects an expected sign-in refusal being reported as a programming error; it does not make denied authorization succeed. Production create-prisma auth telemetry only contains generic exit codes, so this does not prove all reported auth failures are denials. Browser/account happy-path authorization was not performed, and no credentials were changed. The separate Linux localhost IPv4/IPv6 callback mismatch observed during reproduction is not changed here because the registered redirect-host contract needs separate validation.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

npx https://pkg.pr.new/@prisma/cli@251

npx https://pkg.pr.new/@prisma/cli-engine@251

commit: a36de01

[AmanVarshney01]

CI update: Windows and Linux CLI test jobs pass, along with lint, type checking, and error-reference completeness. Two checks are red: Skill Packaging reports the existing bundled skill stamped 8.0.0-rc.12 while the package is 8.0.0-rc.13; real-API e2e fails the init rerun expectation (synced versus up-to-date). Neither skill packaging nor init is modified by this PR. Keeping this draft and recording these separately rather than broadening the auth-denial fix.