variables Go API should not return "not found" for permission denied except for Peek

[rahadiangg]

Nomad version

Nomad v1.9.1
BuildDate 2024-10-21T09:00:50Z
Revision d9ec23f

Operating system and Environment details

Nomad CLI on MacOS M1

Issue

the nomad var command returns misleading error when getting variable with wrong nomad token

Reproduction steps

1. Set env NOMAD_ADRR with nomad address
2. Set env NOMAD_TOKEN with wrong token
3. Get variables

nomad var get nomad/jobs/my-app

4. Got errror Variable not found

Expected Result

Return 403 Permission denied like when do nomad var list

Error retrieving vars: Unexpected response code: 403 (Permission denied)

Actual Result

Error Variable not found

[tgross]

Hi @rahadiangg! I was able to reproduce this but it looks like it's intentional, although perhaps for an unfortunate reason. As far as the server is concerned, it's sending a Permission Denied error with a 403 error code:

    2024-12-17T11:31:27.919-0500 [DEBUG] http: request failed: method=GET path=/v1/var/nomad/jobs/web?namespace=prod error="Permission denied" code=403

But the api package that the CLI uses is then taking that value and mangling it. This is specifically to support the Peek API used by consul-template as described here https://github.com/hashicorp/nomad/blob/v1.9.3/api/variables.go#L225. But it looks like this internal function is not quite correct for all consumers. It would be a minor breaking API change to correct the exit code at this point. I'll mark this for fixing in the next LTS release... hopefully we can land this as a quick fix in Nomad 1.10.0.

Marking for roadmapping.