{"record":{"id":"927039cff9e7b297","repo":"pnpm/pnpm","slug":"stars-unauthorized","errorCode":"STARS_UNAUTHORIZED","errorMessage":"You must be logged in to list your starred packages","messagePattern":"You must be logged in to list your starred packages","errorType":"exception","errorClass":"PnpmError","httpStatus":null,"severity":"error","filePath":"pnpm11/registry-access/commands/src/star/stars.ts","lineNumber":30,"sourceCode":"export const commandNames = ['stars']\n\nexport function help (): string {\n  return renderHelp({\n    description: 'Lists all packages starred by a specific user.',\n    url: docsUrl('stars'),\n    usages: ['pnpm stars [<user>]'],\n  })\n}\n\nexport async function handler (opts: StarOptions, params: string[]): Promise<string> {\n  const registryUrl = normalizeRegistryUrl(opts.registriesByScope?.default ?? 'https://registry.npmjs.org/')\n  const fetchFromRegistry = createFetchFromRegistry(opts)\n  const authHeader = getAuthHeaderForRegistry(opts.configByUri, registryUrl)\n\n  let username = params[0]\n  if (!username) {\n    if (!authHeader) {\n      throw new PnpmError('STARS_UNAUTHORIZED', 'You must be logged in to list your starred packages')\n    }\n    username = await fetchWhoami(registryUrl, fetchFromRegistry, authHeader)\n  }\n\n  if (!params[0]) {\n    const starUrl = new URL('./-/user/v1/star', registryUrl).href\n    const response = await fetchFromRegistry(starUrl, {\n      authHeaderValue: authHeader,\n    })\n    if (response.ok) {\n      const starsData = await response.json() as string[] | Record<string, unknown>\n      if (Array.isArray(starsData)) return starsData.join('\\n')\n      if (typeof starsData === 'object' && starsData !== null) {\n        return Object.keys(starsData).join('\\n')\n      }\n    }\n  }\n","sourceCodeStart":12,"sourceCodeEnd":48,"githubUrl":"https://github.com/pnpm/pnpm/blob/6261b7f388016d57ca6b90340342411cd1d0d00f/pnpm11/registry-access/commands/src/star/stars.ts#L12-L48","documentation":"`pnpm stars` with no username argument must resolve your identity via whoami, which requires credentials; when getAuthHeaderForRegistry finds no token for the default registry, the handler throws STARS_UNAUTHORIZED client-side before any HTTP request. Passing an explicit username skips whoami entirely, so listing another user's stars needs no login.","triggerScenarios":"`pnpm stars` on a machine with no token for the default registry; a private default registry that was never logged into; CI containers without credentials asking for the caller's own stars.","commonSituations":"Fresh environments; users who authenticate only per-scope for publishing; scripts running `pnpm stars` without checking login state first.","solutions":["Pass a username explicitly: `pnpm stars <user>` — no authentication needed for other users' stars","Or log in first: `pnpm login` (add --registry=<url> if your default registry is private), then `pnpm stars`","Verify the token is picked up with `pnpm whoami` before scripting `pnpm stars`"],"exampleFix":"# before\npnpm stars            # not logged in -> STARS_UNAUTHORIZED\n\n# after\npnpm stars isaacs     # explicit user: no login required","handlingStrategy":"validation","validationCode":"import { getAuthHeaderForRegistry } from '...' // registry-access star common\n\nconst registryUrl = normalizeRegistryUrl(opts.registriesByScope?.default ?? 'https://registry.npmjs.org/')\nif (!params[0] && !getAuthHeaderForRegistry(opts.configByUri, registryUrl)) {\n  throw new Error('Pass a username (`pnpm stars <user>`) or log in first (`pnpm login`)')\n}\nawait starsHandler(opts, params)","typeGuard":"import util from 'node:util'\nimport { PnpmError } from '@pnpm/error'\n\nfunction isStarsUnauthorized (err: unknown): err is PnpmError {\n  return util.types.isNativeError(err) && (err as PnpmError).code === 'STARS_UNAUTHORIZED'\n}","tryCatchPattern":"catch (err) {\n  if (isStarsUnauthorized(err)) {\n    // client-side check: nothing was sent — prompt login, or ask for an explicit username\n    const user = await promptUsername()\n    return await starsHandler(opts, [user]) // explicit user needs no auth\n  }\n  throw err\n}","preventionTips":["In scripts, always pass an explicit username to `pnpm stars` so it never needs credentials","Gate own-stars listings behind a `pnpm whoami` check","Configure tokens per registry so getAuthHeaderForRegistry finds them for the default registry"],"tags":["registry","stars","auth","credentials"],"backgroundTag":"registry-authentication-failed","analyzedSha":"6261b7f388016d57ca6b90340342411cd1d0d00f","analyzedAt":"2026-08-17T18:30:54.750Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}