mirror of
https://github.com/coder/coder.git
synced 2026-09-22 05:05:20 +08:00
Susana Ferreira
dba45cede7
## Problem When a key returned 401 or 403, the pool marked it permanently unavailable for the lifetime of that in-memory pool. This is bad UX: a transient auth failure or a briefly-misconfigured key could take a key out of rotation until the operator either restarted Coder or reconfigured the key (even re-saving the same working value). ## Changes - **403 removed from key failover**: it's a per-request authorization failure, not a key-level problem, so it's surfaced to the caller as-is without marking the key or failing over. - **401 now applies a temporary cooldown** (like 429) so the key recovers on its own instead of staying blocked. - When every key is in an auth-failure cooldown, the pool reports a `502` with no `Retry-After`, but the keys still recover automatically once the cooldown elapses. Closes https://linear.app/codercom/issue/AIGOV-421/ai-gateway-a-quarantined-centralized-key-never-recovers-without-a Closes https://linear.app/codercom/issue/AIGOV-533/403s-misclassifying-keys-as-permanently-down-in-ai-gateway > [!NOTE] > Initially generated by Claude Opus 4.7, modified and reviewed by @ssncferreira
79 lines
2.8 KiB
Go
79 lines
2.8 KiB
Go
package aibridge
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"strings"
|
|
|
|
"github.com/coder/coder/v2/aibridge/circuitbreaker"
|
|
"github.com/coder/coder/v2/aibridge/keypool"
|
|
"github.com/coder/coder/v2/aibridge/recorder"
|
|
)
|
|
|
|
// maxRecordedErrorMessageBytes caps the raw upstream error message persisted on
|
|
// the interception record to avoid storing unbounded provider payloads.
|
|
const maxRecordedErrorMessageBytes = 1024
|
|
|
|
// errorCategorizer categorizes a provider's own terminal errors. It is
|
|
// implemented by provider.Provider.
|
|
type errorCategorizer interface {
|
|
CategorizeError(err error) *recorder.ErrorType
|
|
}
|
|
|
|
// categorizeInterceptionError maps a terminal interception error to a recorder
|
|
// error type and a truncated raw message. It returns the empty ErrorType and an
|
|
// empty message when err is nil (the interception succeeded).
|
|
//
|
|
// Provider-agnostic failures (circuit breaker, key-pool exhaustion) are handled
|
|
// here; anything provider-specific is delegated to the provider, which owns the
|
|
// knowledge of its SDK errors and response envelopes.
|
|
func categorizeInterceptionError(c errorCategorizer, err error) (recorder.ErrorType, string) {
|
|
if err == nil {
|
|
return "", ""
|
|
}
|
|
msg := err.Error()
|
|
if len(msg) > maxRecordedErrorMessageBytes {
|
|
msg = strings.ToValidUTF8(msg[:maxRecordedErrorMessageBytes], "")
|
|
}
|
|
|
|
// Go context errors. These originate in the gateway or the caller, not
|
|
// upstream, so they are classified before any provider delegation.
|
|
switch {
|
|
case errors.Is(err, context.DeadlineExceeded):
|
|
return recorder.ErrorTypeTimeout, msg
|
|
case errors.Is(err, context.Canceled):
|
|
// The caller went away before the interception completed. This is not
|
|
// an upstream failure, but the interception did not succeed either, so
|
|
// it is recorded as unknown rather than dropped.
|
|
return recorder.ErrorTypeUnknown, msg
|
|
}
|
|
|
|
// Circuit breaker. It responds with 503 Service Unavailable when open, but
|
|
// returns a sentinel error that carries no HTTP status of its own.
|
|
if errors.Is(err, circuitbreaker.ErrCircuitOpen) {
|
|
return recorder.ErrorTypeServerError, msg
|
|
}
|
|
|
|
// Centralized key-pool failover. Checked before delegating because the pool
|
|
// masks the client response (e.g. permanent failures become 502), which
|
|
// would otherwise hide the cause.
|
|
var keyPoolErr *keypool.Error
|
|
if errors.As(err, &keyPoolErr) {
|
|
switch keyPoolErr.Kind {
|
|
case keypool.ErrorKindRateLimited:
|
|
return recorder.ErrorTypeRateLimited, msg
|
|
case keypool.ErrorKindPermanent, keypool.ErrorKindUnauthorized:
|
|
return recorder.ErrorTypeUnauthorized, msg
|
|
default:
|
|
return recorder.ErrorTypeUnknown, msg
|
|
}
|
|
}
|
|
|
|
// Anything provider-specific is delegated to the provider, which owns the
|
|
// knowledge of its SDK errors and response envelopes.
|
|
if cat := c.CategorizeError(err); cat != nil {
|
|
return *cat, msg
|
|
}
|
|
return recorder.ErrorTypeUnknown, msg
|
|
}
|