stacklok / toolhive / 25759192859

66%

Build Type

push

github

Committed by web-flow

Commit Message

Retry OAuth token refresh on infrastructure 4xx (#5170)

The OAuth token refresh endpoint returns 4xx for infrastructure
events (WAF/firewall blocks, rate limits, transient bad-config
deploys) as well as for OAuth protocol failures. Today every 4xx
is treated as a permanent auth failure, killing the workload
until manual re-authentication. A momentary VPN flap that routes
a refresh request through a non-allowlisted IP is enough to
leave the workload dead.

Treat 4xx responses that lack a structured RFC 6749 error code
as transient; only 4xx with a populated error code
(invalid_grant, invalid_client, etc.) remains permanent. 429 is
always transient per HTTP standard.

Fixes #5169

Signed-off-by: Greg Katz <gkatz@indeed.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Coverage Stats

24 of 24 new or added lines in 1 file covered. (100.0%)

2 existing lines in 1 file now uncovered.

64457 of 98755 relevant lines covered (65.27%)

62.41 hits per line