project: Handle git sso auth failures as repo exit

If a user is not authenticated, repo continues execution and it will
likely result in more of the same errors being printed. A user is also
likely to SIGTERM the process resulting in more errors.

This change stops repo sync if any of repositories can't be fetched to
Git authentcation using sso helper. We could extend this to all Git
authentication

Change-Id: I9e471e063450c0a51f25a5e7f12a83064dfb170c
Reviewed-on: https://gerrit-review.googlesource.com/c/git-repo/+/438522
Reviewed-by: Gavin Mak <[email protected]>
Tested-by: Josip Sokcevic <[email protected]>
Commit-Queue: Josip Sokcevic <[email protected]>

error.py

@@ -107,6 +107,10 @@ def __str__(self):
         return self.message
 
 
+class GitAuthError(RepoExitError):
+    """Cannot talk to remote due to auth issue."""
+
+
 class GitcUnsupportedError(RepoExitError):
     """Gitc no longer supported."""
 

project.py

@@ -32,6 +32,7 @@
 
 from color import Coloring
 from error import DownloadError
+from error import GitAuthError
 from error import GitError
 from error import ManifestInvalidPathError
 from error import ManifestInvalidRevisionError
@@ -2713,6 +2714,20 @@ def _RemoteFetch(
                     file=output_redir,
                 )
                 break
+            elif (
+                ret == 128
+                and gitcmd.stdout
+                and "remote helper 'sso' aborted session" in gitcmd.stdout
+            ):
+                # User needs to be authenticated, and Git wants to prompt for
+                # username and password.
+                print(
+                    "git requires authentication, but repo cannot perform "
+                    "interactive authentication.",
+                    file=output_redir,
+                )
+                raise GitAuthError(gitcmd.stdout)
+                break
             elif current_branch_only and is_sha1 and ret == 128:
                 # Exit code 128 means "couldn't find the ref you asked for"; if
                 # we're in sha1 mode, we just tried sync'ing from the upstream