Repository navigation
Fail fast on auth errors instead of polling - #578
Conversation
Since 1.10.0 an OIDC client whose stream can't connect falls back to polling. A missing token is not a 401, so polling never stops, and its ref'd interval keeps short-lived processes (scripts, test files) from exiting. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Polling gave up on a 401 but kept retrying a missing OIDC token forever, so a client without credentials kept scripts and test files running. Treat a token failure like a 401 instead of unref'ing the interval. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
luismeyer
changed the title
| try { | ||
| return await getVercelOidcToken(); | ||
| } catch (error) { | ||
| throw new OidcTokenError(error); |
There was a problem hiding this comment.
Shouldn't we also verify that it is an actual token auth issue, and not some random 500 or a network issue? Because in those cases we'd still want to retry, or not?
There was a problem hiding this comment.
Good catch, you're right. getVercelOidcToken refreshes a missing or expired token over the network (OAuth discovery, the token refresh, and POST /v1/projects/:id/token), so a 500 or a network error there would also have ended up as OidcTokenError and stopped retries.
Fixed in 4c989b3. @vercel/oidc flattens every failure into one message with no cause, so OidcTokenError is now raised only for the messages that mean there are no credentials at all: project not linked (vc link), CLI not logged in (vercel login), or the token header missing on the edge. Anything else, like a failed refresh, is thrown as a plain error and retried as before. Tests for both sides are in controller/auth.test.ts.
A failed token refresh can be transient, so keep retrying it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Since 1.10.0, a client whose stream gives up falls back to polling. Polling stopped on a 401 but retried a missing OIDC token forever. With no credentials (scripts and test files outside Vercel), the ref'd interval kept the process alive, so
node --testhung until CI killed it (vercel/api's cse-agent tests).The stream and polling use the same credential, so an auth failure on one means the other fails the same way. Auth failures (a 401, or a missing OIDC token) now end the source chain right away:
degraded, where reads revalidate over HTTP on demand.exhaustednow carries the 401/token error as its reason.stream: false): the first poll's auth failure stops the interval and degrades the client.fetchDatafileno longer retries a missing OIDC token.unauthorizedflag covers missing tokens too, so initialization skips the final blocking fetch and usage tracking doesn't send events that can't authenticate.Implementation: OIDC failures throw a typed
OidcTokenError(same message, original error ascause), andisAuthError()checks for either case. Retry exhaustion without an auth error still falls back to polling, as before.Tests: tests that pinned the old poll-after-auth-failure behavior now assert the fast fail. New tests cover a missing token on the stream, a missing token with polling as primary, and no token retry in
fetchDatafile. The 401 fast-fail now makes 2 requests instead of 3.Verified against vercel/api:
agents/cse/agent/lib/model-config.test.tshangs on 1.10.2 and finishes in ~0.2s with this build.🤖 Generated with Claude Code