fix(auth): print only a token that belongs to the selected account

Signed-off-by: bircni <bircni@icloud.com>

internal/app/target.go

@@ -37,6 +37,9 @@ type target struct {
 
 var errRepositoryRequired = errors.New("repository required: use --repo owner/name")
 
+// errEnvironmentAccount must not reveal which account the GITEA_TOKEN belongs to.
+var errEnvironmentAccount = errors.New("GITEA_TOKEN does not belong to the selected account; supply its matching --user or remove the environment token to use stored credentials")
+
 func (a *application) resolve(ctx context.Context, requireRepo bool) (target, error) {
 	return a.resolveTarget(ctx, requireRepo, true)
 }
@@ -185,7 +188,7 @@ func (a *application) connect(ctx context.Context, req targetRequest) (target, e
 		}
 		// The message must not reveal which account the token belongs to.
 		if !services.MatchAccount(t.User, actual) {
-			return t, clierr.Wrap(clierr.Authentication, errors.New("GITEA_TOKEN does not belong to the selected account; supply its matching --user or remove the environment token to use stored credentials"))
+			return t, clierr.Wrap(clierr.Authentication, errEnvironmentAccount)
 		}
 		if t.User == "" {
 			t.UserSource = "GITEA_TOKEN authenticated account"