[alanagoyal]

this pr makes git authentication errors provider-neutral and gives better user guidance based on the specific failure.

before: authentication help always named “Google Identity-Aware Proxy,” regardless of the server’s configuration. permission denials and verifier outages also included full authentication setup instructions, suggesting users should reconfigure credentials even when that wouldn’t resolve the problem.

after:

• permission denied: explains that the identity cannot perform the operation and directs the user to the server administrator.
• verifier unavailable: explains that authentication is temporarily unavailable and asks the user to retry shortly.
• provider identification: oidc errors display the optional server.auth.provider_name, falling back to the configured issuer url. static-token mode names no external provider.

for example, a read-only user attempting to push would now see:

walgit: permission denied for git.acme.com. Your identity is not allowed to perform this operation.
Contact the server administrator.
Identity provider: Acme Okta.

the provider name is display-only. authentication and authorization rules are unchanged, and invalid or expired credentials still return HTTP 401 so git can discard stale credentials and request replacements.

validation: 40 passing end-to-end tests, including provider labels, permission-denied guidance, verifier outages, and credential-refresh behavior. clippy and formatting checks pass.

[0bserver07]

Good catch, main really does tell everyone they're behind Google IAP. One thing: auth_help_message only has one caller and it only runs for Forbidden and Unavailable, so the rewritten fallback branch and client_setup can never run, you could just delete them. A test with a wgt_ token for an email that isn't allowed would also be nice, right now the tests only use a static token so the provider line never gets checked on a real OIDC refusal.

[alanagoyal]

good points, thank you! removed the unreachable fallback and unused helper, and added a test using a valid walgit access token for an email outside the allowlist to check the refusal message and provider label.