fix(host-service): classify an unreachable cloud API in host.apiToken

Merged
SU
18d ago
+8-1

Problem

host.apiToken reports to Sentry as an INTERNAL_SERVER_ERROR ("fetch failed") whenever the host cannot reach the Superset cloud API — connect timeouts and headers timeouts on the user's network. Around 200 events across a family of issues on this one procedure, all transport failures.

Root cause

host.apiToken calls apiAuth.getHeaders(), which for a JWT host mints a token with fetch to the cloud API. When that fetch fails at the transport level, the undici error (UND_ERR_CONNECT_TIMEOUT, UND_ERR_HEADERS_TIMEOUT, ...) propagates unclassified and the tRPC Sentry middleware reports it as a 500. host.info already classifies the same failure at its call site with rethrowCloudUnreachable / rethrowSessionRejected; apiToken was added later and did not.

Fix

Classify at the call site in readBearer, the same three lines getOrganization uses. No new classifier; the existing one (and its negative tests) already decides what counts as unreachable. The only caller, the CLI's readHostApiToken, treats any error as "no token", so behaviour does not change.

Verification

$ bunx biome check packages/host-service/src/trpc/router/host/host.ts
Checked 1 file in 30ms. No fixes applied.

$ cd packages/host-service && bun run typecheck
$ tsc --noEmit --emitDeclarationOnly false
(no errors)

$ bun test src/trpc/router/host
 30 pass
 0 fail
 48 expect() calls
Ran 30 tests across 2 files.

Refs HOST-SERVICE-9F

Summary by cubic

Classifies network failures in host.apiToken so transport errors against the Superset cloud API report as SERVICE_UNAVAILABLE instead of a 500 INTERNAL_SERVER_ERROR.

apiToken reads the bearer via the auth provider, which mints a JWT over the network. readBearer now wraps that call with the same rethrowCloudUnreachable/rethrowSessionRejected classification that host.info already uses. The only caller treats any error as "no token", so behavior doesn't change.

Summary by CodeRabbit

  • Bug Fixes
    • Improved handling of authentication errors when the cloud service is unreachable or a session is rejected.
    • Unrecognized authentication errors continue to be surfaced instead of being silently ignored.