From a24ff314a58186f6988c4c71d9db51dd0bd81a63 Mon Sep 17 00:00:00 2001
From: Rudy Celekli <rudy@gradiahq.com>
Date: Mon, 12 Oct 2026 21:11:23 -0400
Subject: [PATCH] fix(app): preserve temporary provider failures in key
 validation

---
 apps/app/src/app/api/provider-keys/route.ts            |  2 +-
 .../api/provider-keys/unavailable-regression.test.ts   | 10 ++++++++++
 2 files changed, 11 insertions(+), 1 deletion(-)
 create mode 100644 apps/app/src/app/api/provider-keys/unavailable-regression.test.ts

diff --git a/apps/app/src/app/api/provider-keys/route.ts b/apps/app/src/app/api/provider-keys/route.ts
index 4839b5b..7d17933 100644
--- a/apps/app/src/app/api/provider-keys/route.ts
+++ b/apps/app/src/app/api/provider-keys/route.ts
@@ -33,7 +33,7 @@ export async function POST(request: Request) {
     if (response.ok && data?.ok === true) return reply({ ok: true }, 200);
     // Never relay arbitrary provider bodies: they can contain sensitive data.
     const error = typeof data?.code === "string" ? errors[data.code] : undefined;
-    return reply({ error: error ?? "The agent could not validate your keys. Please try again." }, 400);
+    return reply({ error: error ?? "The agent could not validate your keys. Please try again." }, data?.code === "provider_unavailable" ? 503 : 400);
   } catch {
     return reply({ error: "Could not reach the agent to validate your keys. Please try again." }, 502);
   }
diff --git a/apps/app/src/app/api/provider-keys/unavailable-regression.test.ts b/apps/app/src/app/api/provider-keys/unavailable-regression.test.ts
new file mode 100644
index 0000000..39ce352
--- /dev/null
+++ b/apps/app/src/app/api/provider-keys/unavailable-regression.test.ts
@@ -0,0 +1,10 @@
+// @vitest-environment node
+import { afterEach, it, expect, vi } from "vitest";
+import { POST } from "./route";
+afterEach(()=>vi.unstubAllGlobals());
+it("keeps a temporary upstream outage distinct from invalid keys", async () => {
+  vi.stubGlobal("fetch",vi.fn().mockResolvedValue(Response.json({ok:false,code:"provider_unavailable",detail:"secret"},{status:503})));
+  const r = await POST(new Request("http://localhost/api/provider-keys",{method:"POST",headers:{"x-openai-api-key":"test-openai","x-jev-api-key":"test-jev"}}));
+  expect(r.status).toBe(503); expect(await r.text()).not.toContain("secret");
+  expect(r.headers.get("cache-control")).toBe("no-store");
+});