[newauth] Print warning for .gitcookies file

This will print a warning and disable new auth if .gitcookies file
exists.

This ensures we don't break bots once we default new auth on while
pushing human users away from .gitcookies.

Bug: b/404613530
Change-Id: Ia2d05bb7e5d2bf11e5605a26ef492954acbd9833
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/6367723
Reviewed-by: Josip Sokcevic <sokcevic@chromium.org>
Commit-Queue: Allen Li <ayatane@chromium.org>

git_cl.py

@@ -3902,7 +3902,7 @@ def CMDcreds_check(parser, args):
     """Checks credentials and suggests changes."""
     _, _ = parser.parse_args(args)
 
-    if newauth.Enabled():
+    if newauth.EnabledInConfig():
         cl = Changelist()
         try:
             remote_url = cl.GetRemoteUrl()

newauth.py

@@ -6,12 +6,53 @@
 from __future__ import annotations
 
 import os
+import sys
 
 import scm
 
 
 def Enabled() -> bool:
     """Returns True if new auth stack is enabled."""
+    if not EnabledInConfig():
+        return False
+    if _HasGitcookies():
+        _PrintGitcookiesWarning()
+        return False
+    return True
+
+
+def _HasGitcookies() -> bool:
+    """Returns True if user has gitcookies file."""
+    return os.path.exists(os.path.expanduser('~/.gitcookies'))
+
+
+_warning_printed = False
+
+
+def _PrintGitcookiesWarning() -> None:
+    global _warning_printed
+    if _warning_printed:
+        return
+    _warning_printed = True
+    sys.stderr.write(f'''
+!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Warning !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
+depot_tools will soon stop using the .gitcookies file for authentication.
+
+To silence this warning, please move or delete {os.path.expanduser('~/.gitcookies')},
+or you can run `git cl creds-check` which will help you fix this.
+
+If you encounter any issues, please report them using:
+https://issues.chromium.org/issues/new?component=1456702&template=2076315
+--------------------------------------------------------------------------------
+
+''')
+
+
+def EnabledInConfig() -> bool:
+    """Returns True if new auth stack is enabled.
+
+    Directly checks config and doesn't do gitcookie check.
+    """
     return scm.GIT.GetConfig(os.getcwd(),
                              'depot-tools.usenewauthstack') in ('yes', 'on',
                                                                 'true', '1')