Retry once with a forced credential refresh on upstream 401 - #30
Merged
Conversation
Vertex AI requests can fail with Google's own 401 ("invalid
authentication credentials") even though GCloudInjector.Inject
considered its cached OAuth token locally valid — most likely because
a long-running proxy process's cached token can look unexpired by
wall clock while genuinely being expired server-side after a host
suspend/resume cycle. Previously the only fix was a full `paude stop`
+ `start`, which restarts the proxy process and forces a fresh token.
GCloudInjector gains ForceRefresh(), which discards the cached
credentials and rebuilds them from the original ADC source so the
next token fetch is a real network exchange rather than a reused
token. Store gains MatchInjector() so callers can look up which
injector would handle a request. The proxy's response pipeline now
buffers request bodies for any request handled by a Refresher
injector and, on an upstream 401, calls ForceRefresh and retries the
request exactly once with the newly fetched token before giving up.
This is root-cause-agnostic: whatever caused the local validity
check to disagree with the server, trusting the server's rejection
and retrying with a guaranteed-fresh credential recovers without
requiring a full process restart.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Vertex AI requests can fail with Google's own 401 ("invalid authentication credentials") even though GCloudInjector.Inject considered its cached OAuth token locally valid — most likely because a long-running proxy process's cached token can look unexpired by wall clock while genuinely being expired server-side after a host suspend/resume cycle. Previously the only fix was a full
paude stop+start, which restarts the proxy process and forces a fresh token.GCloudInjector gains ForceRefresh(), which discards the cached credentials and rebuilds them from the original ADC source so the next token fetch is a real network exchange rather than a reused token. Store gains MatchInjector() so callers can look up which injector would handle a request. The proxy's response pipeline now buffers request bodies for any request handled by a Refresher injector and, on an upstream 401, calls ForceRefresh and retries the request exactly once with the newly fetched token before giving up. This is root-cause-agnostic: whatever caused the local validity check to disagree with the server, trusting the server's rejection and retrying with a guaranteed-fresh credential recovers without requiring a full process restart.