fix(auth): complete public error boundary in _create_cognito - #142
Conversation
Wrap construction-time BotoCoreError failures (connectivity, timeout, endpoint resolution) in OtfTransportError, and use a fixed safe message for OtfAuthenticationError instead of raw Cognito exception text. Both preserve the original exception via __cause__. Closes #141
|
Warning Review limit reached
Next review available in: 17 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
📝 WalkthroughWalkthrough
ChangesOtfUser error handling
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8aa3f36084
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Mirror the _create_cognito fix at OtfCognito.check_token(): wrap refresh-time BotoCoreError failures in OtfTransportError, use a fixed safe message for the OtfAuthenticationError fallback instead of raw Cognito text, and log before raising (matching the sibling path). Follow-up to #141
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f6faffb8d1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 68c0862d-4e22-4f74-a92d-10681f9311f9
📒 Files selected for processing (2)
src/otf_api/auth/user.pytests/test_api/test_errors.py
Narrow the BotoCoreError catch in _create_cognito and check_token to only report OtfTransportError for genuine transport failures (ConnectionError, HTTPClientError subclasses). Other BotoCoreError subtypes (ParamValidationError, ProfileNotFound, NoRegionError, etc.) are configuration/validation failures that retrying cannot fix, so they now raise the new OtfConfigurationError instead of being misreported as a transport error. Extract the shared classification logic into raise_for_botocore_error() in auth.py to avoid duplicating it between user.py and auth.py.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e082d61f07
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 28f6ce232a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| raise OtfAuthenticationError(str(e)) from e | ||
| raise OtfAuthenticationError("OTF authentication failed") from e | ||
| except BotoCoreError as e: | ||
| raise_for_botocore_error(e, "authenticating with Cognito") |
There was a problem hiding this comment.
When a botocore connectivity failure occurs during OtfUser construction, this new branch raises OtfTransportError immediately with a botocore exception as its cause. However, docs/guides/error-handling.md still states that transport errors are automatically retried and always wrap httpx; neither is true here because the retry decorator only covers OtfClient.do(), after user construction. Update the public reference to describe the botocore cause and qualify which transport errors are retried.
Useful? React with 👍 / 👎.
Notable Changes
_create_cognitonow handlesBotoCoreError(connectivity, timeout, endpoint resolution) separately fromClientError, wrapping it inOtfTransportErrorinstead of letting it fall through to the genericexcept Exceptionre-raise.ClientErroris a sibling ofBotoCoreError, not a subclass, so the new branch only ever catches non-API construction-time failures.OtfAuthenticationErrorraised fromClientErrornow carries a fixed, safe message ("OTF authentication failed") instead of the raw Cognito exception text, which could leak provider-specific detail. The original exception is still preserved via__cause__for debugging.Closes #141
Summary by CodeRabbit