mirror of
https://github.com/pchuan98/codex.git
synced 2026-07-01 00:31:56 +08:00
Celia ChenandGitHub
e65e480e0d
## Why Amazon Bedrock returns a `401 Unauthorized` response containing `Signature expired:` when an AWS credential, including a short-lived `AWS_BEARER_TOKEN_BEDROCK`, has expired. Codex currently surfaces that response as a generic `unexpected status` error, which does not explain how to recover. Environment-provided bearer tokens cannot be refreshed automatically, so the error should direct users to refresh their AWS credentials or replace or remove the environment token and restart Codex. This classification belongs to the Amazon Bedrock provider so similar responses from other providers retain their existing behavior. ## What changed - Add a synchronous `ModelProvider::map_api_error` hook that defaults to the existing provider-neutral API error mapping, and route model request, stream, WebSocket, and terminal unauthorized errors through the active provider. - Override the hook for Amazon Bedrock. After preserving the structured status, body, URL, and request metadata, recognize `401` responses containing `Signature expired:` and attach actionable credential guidance. - Keep `codex-protocol` provider-neutral by representing the guidance as an optional `user_message`. Error rendering prefers this message while continuing to append the URL, request ID, Cloudflare ray, and authorization diagnostics. - Add model-provider coverage for expired signatures and negative cases, core coverage for provider dispatch after unauthorized recovery, and a TUI snapshot for the rendered error. ## Testing Tested with a real request with expired bedrock key: <img width="962" height="126" alt="Screenshot 2026-06-22 at 3 56 51 PM" src="https://github.com/user-attachments/assets/7e21cc7c-798e-4662-8467-7f304a2f2b59" />
78 lines
2.4 KiB
Rust
78 lines
2.4 KiB
Rust
use codex_api::ApiError;
|
|
use codex_api::TransportError;
|
|
use codex_protocol::error::CodexErr;
|
|
use http::HeaderMap;
|
|
use http::HeaderValue;
|
|
use http::StatusCode;
|
|
use pretty_assertions::assert_eq;
|
|
|
|
use super::error::BEDROCK_EXPIRED_SIGNATURE_MESSAGE;
|
|
use super::error::map_api_error;
|
|
|
|
const BEDROCK_RESPONSES_URL: &str = "https://bedrock-mantle.us-east-2.api.aws/openai/v1/responses";
|
|
|
|
fn http_error(status: StatusCode, body: &str) -> ApiError {
|
|
let mut headers = HeaderMap::new();
|
|
headers.insert("x-request-id", HeaderValue::from_static("req-bedrock"));
|
|
ApiError::Transport(TransportError::Http {
|
|
status,
|
|
url: Some(BEDROCK_RESPONSES_URL.to_string()),
|
|
headers: Some(headers),
|
|
body: Some(body.to_string()),
|
|
})
|
|
}
|
|
|
|
#[test]
|
|
fn expired_signature_has_actionable_guidance() {
|
|
let error = map_api_error(http_error(
|
|
StatusCode::UNAUTHORIZED,
|
|
"Signature expired: 20260609T133205Z is now earlier than 20260614T062525Z",
|
|
));
|
|
|
|
let CodexErr::UnexpectedStatus(response) = &error else {
|
|
panic!("expected unexpected status error, got {error:?}");
|
|
};
|
|
assert_eq!(
|
|
response.user_message.as_deref(),
|
|
Some(BEDROCK_EXPIRED_SIGNATURE_MESSAGE)
|
|
);
|
|
assert_eq!(
|
|
error.to_string(),
|
|
format!(
|
|
"{BEDROCK_EXPIRED_SIGNATURE_MESSAGE}, url: {BEDROCK_RESPONSES_URL}, request id: req-bedrock"
|
|
)
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn other_unauthorized_errors_remain_generic() {
|
|
let error = map_api_error(http_error(
|
|
StatusCode::UNAUTHORIZED,
|
|
"The security token included in the request is invalid",
|
|
));
|
|
|
|
let CodexErr::UnexpectedStatus(response) = &error else {
|
|
panic!("expected unexpected status error, got {error:?}");
|
|
};
|
|
assert_eq!(response.user_message, None);
|
|
assert_eq!(
|
|
error.to_string(),
|
|
format!(
|
|
"unexpected status 401 Unauthorized: The security token included in the request is invalid, url: {BEDROCK_RESPONSES_URL}, request id: req-bedrock"
|
|
)
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn signature_errors_with_other_statuses_remain_generic() {
|
|
let error = map_api_error(http_error(
|
|
StatusCode::FORBIDDEN,
|
|
"Signature expired: old is now earlier than new",
|
|
));
|
|
|
|
let CodexErr::UnexpectedStatus(response) = &error else {
|
|
panic!("expected unexpected status error, got {error:?}");
|
|
};
|
|
assert_eq!(response.user_message, None);
|
|
}
|