internal/devbox: fix warning when user refuses cache setup (#2095)

Don't add extra substituters when the user answers "no" to the
confirmation prompt for configuring Nix caches. This stops Nix from
printing warnings such as:

warning: ignoring untrusted substituter 's3://mycache', you are not a
trusted user.
Run man nix.conf for more information on the substituters configuration
option.

Also print a message saying that `devbox cache configure` can be used to
configure the cache after answering no.

Author: gcurtis

internal/devbox/packages.go

@@ -9,7 +9,6 @@ import (
 	"io"
 	"io/fs"
 	"os"
-	"os/user"
 	"path/filepath"
 	"runtime/trace"
 	"slices"
@@ -25,10 +24,10 @@ import (
 	"go.jetpack.io/devbox/internal/devpkg"
 	"go.jetpack.io/devbox/internal/devpkg/pkgtype"
 	"go.jetpack.io/devbox/internal/lock"
-	"go.jetpack.io/devbox/internal/redact"
+	"go.jetpack.io/devbox/internal/setup"
 	"go.jetpack.io/devbox/internal/shellgen"
 	"go.jetpack.io/devbox/internal/telemetry"
-	nixv1alpha1 "go.jetpack.io/pkg/api/gen/priv/nix/v1alpha1"
+	"go.jetpack.io/pkg/auth"
 
 	"go.jetpack.io/devbox/internal/boxcli/usererr"
 	"go.jetpack.io/devbox/internal/debug"
@@ -461,42 +460,9 @@ func (d *Devbox) installNixPackagesToStore(ctx context.Context, mode installMode
 		Flags:  flags,
 		Writer: d.stderr,
 	}
-	caches, err := nixcache.CachedReadCaches(ctx)
+	err = d.appendExtraSubstituters(ctx, args)
 	if err != nil {
-		debug.Log("error getting nix cache URI, assuming user doesn't have access: %v", err)
-	}
-
-	args.ExtraSubstituters = lo.Map(
-		caches, func(c *nixv1alpha1.NixBinCache, _ int) string {
-			return c.GetUri()
-		})
-
-	// TODO (Landau): handle errors that are not auth.ErrNotLoggedIn
-	// Only lookup credentials if we have a cache to use
-	if len(args.ExtraSubstituters) > 0 {
-		creds, err := nixcache.CachedCredentials(ctx)
-		if err == nil {
-			args.Env = creds.Env()
-		}
-
-		u, err := user.Current()
-		if err != nil {
-			err = redact.Errorf("lookup current user: %v", err)
-			debug.Log("error configuring cache: %v", err)
-		}
-		err = nixcache.Configure(ctx, u.Username)
-		if err != nil {
-			debug.Log("error configuring cache: %v", err)
-
-			var daemonErr *nix.DaemonError
-			if errors.As(err, &daemonErr) {
-				// Error here to give the user a chance to restart the daemon.
-				return usererr.New("Devbox configured Nix to use a new cache. Please restart the Nix daemon and re-run Devbox.")
-			}
-			// Other errors indicate we couldn't update nix.conf, so just warn and continue
-			// by building from source if necessary.
-			ux.Fwarning(d.stderr, "Devbox was unable to configure Nix to use your organization's private cache. Some packages might be built from source.\n")
-		}
+		return err
 	}
 
 	packageNames := lo.Map(
@@ -540,6 +506,54 @@ func (d *Devbox) installNixPackagesToStore(ctx context.Context, mode installMode
 	return nil
 }
 
+func (d *Devbox) appendExtraSubstituters(ctx context.Context, args *nix.BuildArgs) error {
+	creds, err := nixcache.CachedCredentials(ctx)
+	if errors.Is(err, auth.ErrNotLoggedIn) {
+		return nil
+	}
+	if err != nil {
+		ux.Fwarning(d.stderr, "Devbox was unable to authenticate with the Jetify Nix cache. Some packages might be built from source.\n")
+		return nil //nolint:nilerr
+	}
+
+	caches, err := nixcache.CachedReadCaches(ctx)
+	if err != nil {
+		debug.Log("error getting list of caches from the Jetify API, assuming the user doesn't have access to any: %v", err)
+		return nil
+	}
+	if len(caches) == 0 {
+		return nil
+	}
+
+	err = nixcache.Configure(ctx)
+	if errors.Is(err, setup.ErrAlreadyRefused) {
+		debug.Log("user previously refused to configure nix cache, not re-prompting")
+		return nil
+	}
+	if errors.Is(err, setup.ErrUserRefused) {
+		ux.Finfo(d.stderr, "Skipping cache setup. Run `devbox cache configure` to enable the cache at a later time.\n")
+		return nil
+	}
+	var daemonErr *nix.DaemonError
+	if errors.As(err, &daemonErr) {
+		// Error here to give the user a chance to restart the daemon.
+		return usererr.New("Devbox configured Nix to use a new cache. Please restart the Nix daemon and re-run Devbox.")
+	}
+	// Other errors indicate we couldn't update nix.conf, so just warn and
+	// continue by building from source if necessary.
+	if err != nil {
+		debug.Log("error configuring nix cache: %v", err)
+		ux.Fwarning(d.stderr, "Devbox was unable to configure Nix to use the Jetify Nix cache. Some packages might be built from source.\n")
+		return nil
+	}
+
+	for _, cache := range caches {
+		args.ExtraSubstituters = append(args.ExtraSubstituters, cache.GetUri())
+	}
+	args.Env = append(args.Env, creds.Env()...)
+	return nil
+}
+
 func (d *Devbox) packagesToInstallInStore(ctx context.Context, mode installMode) ([]*devpkg.Package, error) {
 	defer debug.FunctionTimer().End()
 	// First, get and prepare all the packages that must be installed in this project

internal/devbox/providers/nixcache/setup.go

@@ -21,8 +21,12 @@ import (
 	"go.jetpack.io/devbox/internal/ux"
 )
 
-func Configure(ctx context.Context, username string) error {
-	return configure(ctx, username, false)
+func Configure(ctx context.Context) error {
+	u, err := user.Current()
+	if err != nil {
+		return redact.Errorf("nixcache: lookup current user: %v", err)
+	}
+	return configure(ctx, u.Username, false)
 }
 
 func ConfigureReprompt(ctx context.Context, username string) error {
@@ -39,8 +43,8 @@ func configure(ctx context.Context, username string, reprompt bool) error {
 	const sudoPrompt = "You're logged into a Devbox account that now has access to a Nix cache. " +
 		"Allow Devbox to configure Nix to use the new cache (requires sudo)?"
 	err := setup.ConfirmRun(ctx, key, task, sudoPrompt)
-	if err != nil && !errors.Is(err, setup.ErrUserRefused) {
-		return redact.Errorf("nixcache: run setup: %v", err)
+	if err != nil {
+		return redact.Errorf("nixcache: run setup: %w", err)
 	}
 	return nil
 }
@@ -88,6 +92,13 @@ func (s *setupTask) Run(ctx context.Context) error {
 		return err
 	}
 
+	// Update the AWS config before configuring and restarting the Nix
+	// daemon.
+	err = s.updateAWSConfig()
+	if err != nil {
+		return redact.Errorf("update root aws config: %v", err)
+	}
+
 	trusted := false
 	cfg, err := nix.CurrentConfig(ctx)
 	if err == nil {
@@ -101,11 +112,6 @@ func (s *setupTask) Run(ctx context.Context) error {
 			return redact.Errorf("update nix config: %v", err)
 		}
 	}
-
-	err = s.updateAWSConfig()
-	if err != nil {
-		return redact.Errorf("update root aws config: %v", err)
-	}
 	return nil
 }