[config/configgrpc] Return PerRPCCredentials error instead of swallowing it

getGrpcDialOptions returned the outer (nil) err rather than perr when a
client auth extension's PerRPCCredentials() failed, so the error was
silently swallowed and the gRPC client was built without the intended
per-RPC credentials instead of failing.

Return perr, and add a test exercising the failure path via
extensionauthtest.NewErr, which was previously untested (every auth
test used NewNopClient, whose PerRPCCredentials returns a nil error).

Assisted-by: Claude Opus 4.8
Signed-off-by: Pavel Lazureykis <pavel@lazureykis.dev>

Author: lazureykis

.chloggen/fix-configgrpc-perrpc-auth-swallow.yaml

@@ -0,0 +1,28 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: bug_fix
+
+# The name of the component, or a single word describing the area of concern, (e.g. receiver/otlp)
+component: pkg/config/configgrpc
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Return the error when a gRPC client auth extension's PerRPCCredentials() fails instead of silently swallowing it
+
+# One or more tracking issues or pull requests related to the change
+issues: [99999]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext: |
+  Previously a failure from the configured client auth extension's PerRPCCredentials() was
+  discarded and getGrpcDialOptions returned a nil error, so the gRPC client was built without
+  the intended per-RPC credentials instead of failing.
+
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: [user]

config/configgrpc/configgrpc.go

@@ -436,7 +436,7 @@ func (cc *ClientConfig) getGrpcDialOptions(
 
 		perRPCCredentials, perr := grpcAuthenticator.PerRPCCredentials()
 		if perr != nil {
-			return nil, err
+			return nil, perr
 		}
 		opts = append(opts, grpc.WithPerRPCCredentials(perRPCCredentials))
 	}

config/configgrpc/configgrpc_test.go

@@ -263,6 +263,20 @@ func TestAllGrpcClientSettings(t *testing.T) {
 	}
 }
 
+func TestGetGRPCDialOptionsPerRPCCredentialsError(t *testing.T) {
+	cc := ClientConfig{
+		Endpoint: "localhost:1234",
+		TLS:      configtls.ClientConfig{Insecure: true},
+		Auth:     configoptional.Some(configauth.Config{AuthenticatorID: testAuthID}),
+	}
+	extensions := map[component.ID]component.Component{
+		testAuthID: extensionauthtest.NewErr(errors.New("per-rpc credentials failure")),
+	}
+	_, err := cc.getGrpcDialOptions(context.Background(), extensions, componenttest.NewNopTelemetrySettings(), []ToClientConnOption{})
+	require.Error(t, err)
+	assert.ErrorContains(t, err, "per-rpc credentials failure")
+}
+
 func TestSanitizeEndpoint(t *testing.T) {
 	cfg := NewDefaultClientConfig()
 	cfg.Endpoint = "dns://authority/backend.example.com:4317"