better sftp server error reporting

[David Allouche]

Many users have difficulties using the bzr branch hosting service on Lanuchpad. The most common problems in order, are:

 1. did not specify launchpad user name correctly, either ommitting the login part or specifying the login part and the owner part incorrectly.
 2. using a system where the ssh key registered on launchpad is not available
 3. not being a member of the team owning the branch

It would be good if the sftp server could give useful error messages to let user diagnose and correct those common problems themselves.

[David Allouche (ddaa)]

Maybe the sftp auth code on the server could be more helpful. Some examples:

 * "No such Launchpad account: foo"
 * "Launchpad user foo does not have a registered ssh key: https://launchpad.net/~foo"
 * "You ssh key does not match any key registered for Launchpad user foo: https://launchpad.net/~foo"

The permission error for branch access should also be improved (as previously mentioned on bug 33223.

 * "You cannot write to branch ~foo/bar/baz because you are not foo: https://launchpad.net/~foo"
 * "You cannot write to branch ~foo/bar/baz because you are not a member of foo: https://launchpad.net/~foo"

[David Allouche (ddaa)]

This is getting in the way of people trying launchpad branch hosting for the first time. We see a user asking about this on IRC about once a week. Presumably a lot of users hit the same problems and silently give up.

[Jonathan Lange (jml)]

This is really two bugs: improved error messages for authentication problems and improved error messages for permission problems.

I've filed bug #93606 to take care of the latter. From henceforth, this bug is about authentication problems.

[Jonathan Lange (jml)]

The authserver doesn't distinguish between "no such user" and "no keys for user", so the SFTP server can't make the distinction. A separate branch is required to extend the authserver, then another one to make the SFTP use the extension.

[Andrew Bennetts (spiv)]

The authserver can: call getUser. The getSSHKeys XML-RPC method doesn't distinguish, but the broader authserver does :)

So, if the SFTP server tried a getUser call after getSSHKeys returns no results, it would be able to distinguish between "no such user" and "no keys for user".

It might not be particularly elegant, but I think it'll be good enough.

[Jonathan Lange (jml)]

Well called Andrew. I've made the change as you suggested and put it up for review.