fix(connect): report token mismatch, not org switching, for org-owned endpoint auth failures

[minekube-ai-engineer]

Source: Discord ask-support thread

Source: Discord ask-support thread — the exact thread this report came from. Kanban card: t_e7369f61.

Problem

On an org-owned endpoint (coconutsmptcp, org hwstudio), a user lost hours to a misleading error. The plugin printed:

WatchService rejected this endpoint because the endpoint name belongs to an organization. Switch to the owning Minekube organization/team, regenerate or import the endpoint token there, then restart the server.

That tells the user to fix their organization selection. The control plane returns CONNECT_AUTH_ENDPOINT_ORG_OWNED for any non-matching token when the endpoint name has an organization parent — in moxy/connect/endpointauth/watchauth.go ValidOrAcquire, the org-owned branch is taken on token mismatch (en.ParentID.String != ""), and the stale-name takeover path is reachable only for org-less names. So the actual conditions are:

1. a dashboard token reset invalidated the token the connector had on disk,
2. the token belongs in the connector token file (token.json / CONNECT_TOKEN), not in config.yml (which only holds the endpoint name),
3. a non-byte-identical copy (trailing space/newline) is a different token too.

The user did exactly what the message implied — reset/re-generated the token — and stayed broken, because the token never reached the file the plugin reads.

Change

WatchAuthFailureMessage now states the actual condition for both auth codes: the presented token does not match the token currently stored for this endpoint name, plus the fix steps (put the new token byte-for-byte into the connector token file — token.json in the data directory, or the CONNECT_TOKEN environment variable — not config.yml, then restart the connector). The organization ownership is now the secondary clause: only a token created for this endpoint name inside that organization is accepted, and a different token cannot take the name over.

No auth semantics changed; this is presentation only.

TDD evidence (RED → GREEN)

RED — test file only, against the unmodified WatchAuthFailureMessage on main (486d2b01):

> Task :core:test FAILED
WatchAuthFailureMessageTest > organizationOwnedMessageDoesNotSendUsersToOrgSwitching() FAILED (line 45)
WatchAuthFailureMessageTest > explainsOrganizationOwnedEndpointAsTokenMismatch() FAILED (line 33)
WatchAuthFailureMessageTest > bothAuthMessagesDescribeTheTokenFileAndTheConfigSplit() FAILED (line 59)
WatchAuthFailureMessageTest > explainsEndpointTokenMismatch() FAILED (line 23)
5 tests completed, 4 failed
BUILD FAILED

GREEN — ./gradlew :core:test :api:test:

BUILD SUCCESSFUL
core: tests=349 failures=0 errors=0
WatchAuthFailureMessageTest: 5 tests, 0 failures, 0 errors

Tests added/extended: exact wording for both codes, a guard that the org-owned text contains no org-switching instruction, and a contract test that both messages name token.json, CONNECT_TOKEN, the config.yml split, and the connector restart.

Release note

User-visible wording change (drives a patch release): the CONNECT_AUTH_ENDPOINT_ORG_OWNED message now describes the token mismatch and the token-file fix, and the CONNECT_AUTH_TOKEN_ENDPOINT_MISMATCH message additionally states that a dashboard reset invalidates the previous token and that the token must be copied byte-for-byte into the connector token file, not config.yml.