{"record":{"id":"46665c10a2a40c01","repo":"git-ecosystem/git-credential-manager","slug":"unexpected-authenticationmodes-returned-from-promp","errorCode":null,"errorMessage":"Unexpected AuthenticationModes returned from prompt","messagePattern":"Unexpected AuthenticationModes returned from prompt","errorType":"exception","errorClass":"ArgumentOutOfRangeException","httpStatus":null,"severity":"error","filePath":"src/Atlassian.Bitbucket/BitbucketHostProvider.cs","lineNumber":187,"sourceCode":"                if (result is null || result.AuthenticationMode == AuthenticationModes.None)\n                {\n                    var message = \"User cancelled credential prompt\";\n                    _context.Trace.WriteLine(message);\n                    throw new Trace2Exception(_context.Trace2, message);\n                }\n\n                switch (result.AuthenticationMode)\n                {\n                    case AuthenticationModes.Basic:\n                        // Return the valid credential\n                        return result.Credential;\n\n                    case AuthenticationModes.OAuth:\n                        // If the user wants to use OAuth fall through to interactive auth\n                        break;\n\n                    default:\n                        throw new ArgumentOutOfRangeException(\n                            $\"Unexpected {nameof(AuthenticationModes)} returned from prompt\");\n                }\n\n                // Fall through to the start of the interactive OAuth authentication flow\n            }\n            else\n            {\n                _context.Trace.WriteLineSecrets(\"Found stored refresh token: {0}\", new object[] { refreshToken });\n\n                try\n                {\n                    return await GetOAuthCredentialsViaRefreshFlow(request, refreshToken);\n                }\n                catch (OAuth2Exception ex)\n                {\n                    var message = \"Failed to refresh existing OAuth credential using refresh token\";\n                    _context.Trace.WriteLine(message);\n                    _context.Trace.WriteException(ex);","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/git-ecosystem/git-credential-manager/blob/e8ce762cd04b4100ae637b5fbf39ef9d0a96561e/src/Atlassian.Bitbucket/BitbucketHostProvider.cs#L169-L205","documentation":"After the prompt, GetRefreshedCredentials switches on the returned AuthenticationMode; only Basic and OAuth are handled. Any other mode reaching this switch indicates an internal contract violation between the authentication component and the host provider, so ArgumentOutOfRangeException 'Unexpected AuthenticationModes returned from prompt' is thrown.","triggerScenarios":"GetCredentialsAsync returns a CredentialsPromptResult whose AuthenticationMode is neither Basic nor OAuth nor None (e.g. Browser or combined flags) — typically from a mismatched/modified auth component or plugin.","commonSituations":"Custom forks or patched GCM builds adding modes; version skew between the provider and BitbucketAuthentication assemblies; manual construction of CredentialsPromptResult in tests/tools.","solutions":["Use official, matching GCM binaries (reinstall) so provider and auth component agree on supported modes","Only pass AuthenticationModes.Basic | AuthenticationModes.OAuth in the modes set for Bitbucket.org","Remove custom patches/plugins altering the prompt result"],"exampleFix":"// before\nvar result = await auth.GetCredentialsAsync(uri, null, AuthenticationModes.Gcm);\n// after\nvar result = await auth.GetCredentialsAsync(uri, null, AuthenticationModes.Basic | AuthenticationModes.OAuth);","handlingStrategy":"try-catch","validationCode":"if ((modes & ~(AuthenticationModes.Basic | AuthenticationModes.OAuth)) != 0)\n    throw new InvalidOperationException(\"Only Basic/OAuth supported for Bitbucket prompts\");","typeGuard":"bool IsPromptableMode(AuthenticationModes m) => m is AuthenticationModes.Basic or AuthenticationModes.OAuth;","tryCatchPattern":"try { var cred = await provider.GetCredentialAsync(input); }\ncatch (ArgumentOutOfRangeException ex) { trace.Error(ex); return null; }","preventionTips":["Use unmodified official GCM builds","Restrict the requested modes to Basic and OAuth","Keep provider and authentication assemblies version-matched"],"tags":["argument-out-of-range","internal-invariant","authentication","enum"],"backgroundTag":"internal-invariant-violation","analyzedSha":"e8ce762cd04b4100ae637b5fbf39ef9d0a96561e","analyzedAt":"2026-09-11T17:15:08.753Z","contentChangedAt":"2026-09-11T17:15:08.753Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}