Repository navigation
fix(api): return 503 when the content OAuth state store is unavailable - #1126
Merged
Merged
Conversation
ericfitz
added a commit
that referenced
this pull request
Oct 27, 2026
## Summary - Raise `toolchain` in go.mod from go1.27.2 to go1.27.3 (CI picks it up via `go-version-file: go.mod`). - Keep `ARG GO_VERSION` in Dockerfile.server-oracle in step. go1.27.2's `crypto/x509` has GO-2026-6809 (reachable; fixed in go1.27.3), which fails the required govulncheck check on every PR (e.g. #1126). ## Test plan - `make verify` OK with go1.27.3 - local `govulncheck ./...`: 0 vulnerabilities affecting our code 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01MaywXeYsU9NkUvek9t59QP Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
ContentOAuthStateStore now wraps Redis failures in ErrContentOAuthStateUnavailable, which wraps dberrors.ErrTransient, so StoreErrorToRequestError maps them to a documented 503 with an Error body and Retry-After instead of a bare 500. - Authorize: a state-store Put failure returns 503 (was 500, empty body). - Callback: a Consume failure caused by an outage returns 503 instead of 400 invalid_state. - Sweep: the content-token store errors in List, Delete, AdminList, AdminDelete, the picker-token lookup and the Microsoft picker-grant lookup go through StoreErrorToRequestError (transient DB -> 503, otherwise 500 with an Error body). The refresh and Graph "unexpected" branches in the picker handlers keep 500, since they are not backend-unavailability causes. Fixes #1119 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HGyRAvWk53hTercrosrRs9
POST /me/picker_tokens/{provider_id} and POST /me/microsoft/picker_grants
answered every error with an ad-hoc {code, message[, provider_id,
graph_status]} body. The spec documents the Error schema
(additionalProperties: false) for all of those responses, including 503.
- Every error branch now goes through HandleRequestError. The former codes
become details.code values (new errcode Detail constants
picker_not_configured, picker_grants_not_configured, not_linked,
token_refresh_failed, transient_failure, grant_failed; the existing
provider_not_registered). provider_id and graph_status move to
details.context through a new WithDetailContext helper.
- Unauthenticated returns the unauthorized code with WWW-Authenticate;
a missing drive_id/item_id returns invalid_input.
- A RefreshWithLock store error during token refresh went to a bare 500.
It now goes through StoreErrorToRequestError, so a transient DB fault
returns 503. The Graph "unexpected" branch returns 500 with an Error
body.
The tests decode the bodies strictly against the Error type. tmi-ux maps
these endpoints' errors by HTTP status only, so the body change does not
affect it.
Refs #1119
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HGyRAvWk53hTercrosrRs9
ericfitz
force-pushed
the
fix/1119-content-oauth-503
branch
from
October 27, 2026 01:42
2734abc to
6ab1efe
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
details.code); RefreshWithLock store errors are mapped.Test plan
make verifyOK (after rebase on main f7093e6)make test-integration: 97 pass / 0 fail / 9 skip (pre-rebase)Fixes #1119
🤖 Generated with Claude Code
https://claude.ai/code/session_01MaywXeYsU9NkUvek9t59QP