GeezerVison

Linked Issue

Related to #7048. This does not fix it.

On a 401, the pipeline manager gives the reason in the error_description of its WWW-Authenticate header, and the body is empty. The client error read only the body, so it said "credential rejected (invalid or expired token / API key)" for every refusal.

In the two most recent reports in #7048 (runs 39514151001 and 41968241434), the token refresher log shows a refresh every 90 seconds with no misses. So the server refused tokens that had not expired. The client logs cannot show why.

The 401 error message now has a Reason: line with that description. On the next failure, the CI log will show which check refused the token.

Describe Manual Test Plan

New unit tests in python/tests/unit/test_401_reason.py. The escaped-quote test fails when errors.py is reverted. All of tests/unit passes.

Checklist

• Unit tests added/updated
• Integration tests added/updated
• Documentation updated
• Changelog updated

Breaking Changes?

Mark if you think the answer is yes for any of these components:

• OpenAPI / REST HTTP API / feldera-types / manager (What is a breaking change?)
• Feldera SQL (Syntax, Semantics)
• feldera-sqllib (incl. dependencies fxp, etc.) (What is a breaking change?)
• Python SDK (What is a breaking change?)
• fda (CLI arguments)
• Adapters (including configuration)
• Storage Format / Checkpoints
• Others (specify)

Describe Incompatible Changes

None. Only the text of 401 error messages changes.