`npm stars` don't send bogus auth when not authed

Fixes #7531.

2 files changed, 25 insertions, 10 deletions

diff --git a/lib/stars.js b/lib/stars.js
index 087e8d9bf..01ec76e42 100644
--- a/lib/stars.js
+++ b/lib/stars.js
@@ -9,6 +9,17 @@ var npm = require("./npm.js")
 function stars (args, cb) {
   npm.commands.whoami([], true, function (er, username) {
     var name = args.length === 1 ? args[0] : username
+
+    if (er) {
+      if (er.code === 'ENEEDAUTH' && !name) {
+        var needAuth = new Error("'npm stars' on your own user account requires auth")
+        needAuth.code = 'ENEEDAUTH'
+        return cb(needAuth)
+      }
+
+      if (er.code !== 'ENEEDAUTH') return cb(er)
+    }
+
     mapToRegistry("", npm.config, function (er, uri, auth) {
       if (er) return cb(er)
 
diff --git a/lib/whoami.js b/lib/whoami.js
index 42cede1b8..d92a6574a 100644
--- a/lib/whoami.js
+++ b/lib/whoami.js
@@ -14,14 +14,6 @@ function whoami (args, silent, cb) {
   var registry = npm.config.get("registry")
   if (!registry) return cb(new Error("no default registry set"))
 
-  function noUser () {
-    // At this point, if they have a credentials object, it doesn't have a
-    // token or auth in it.  Probably just the default registry.
-    var msg = "Not authed.  Run 'npm adduser'"
-    if (!silent) console.log(msg)
-    cb(null, msg)
-  }
-
   var auth = npm.config.getCredentialsByURI(registry)
   if (auth) {
     if (auth.username) {
@@ -31,7 +23,13 @@ function whoami (args, silent, cb) {
     else if (auth.token) {
       return npm.registry.whoami(registry, { auth : auth }, function (er, username) {
         if (er) return cb(er)
-        if (!username) return noUser()
+        if (!username) {
+          var needNewSession = new Error(
+            "Your auth token is no longer valid. Please log in again."
+          )
+          needNewSession.code = 'ENEEDAUTH'
+          return cb(needNewSession)
+        }
 
         if (!silent) console.log(username)
         cb(null, username)
@@ -39,5 +37,11 @@ function whoami (args, silent, cb) {
     }
   }
 
-  process.nextTick(noUser)
+  // At this point, if they have a credentials object, it doesn't have a token
+  // or auth in it.  Probably just the default registry.
+  var needAuth = new Error(
+    "'npm whoami' requires you to be logged in."
+  )
+  needAuth.code = 'ENEEDAUTH'
+  process.nextTick(cb.bind(this, needAuth))
 }