fix(credentials): tell an interrupted Databricks token reply apart from an oversized one

Author: waleedlatif1

apps/sim/lib/credentials/databricks-service-account.server.test.ts

@@ -198,6 +198,23 @@ describe('getting a Databricks token for a run', () => {
     })
   })
 
+  it('reports a token reply cut off mid-body as the provider being unavailable, not a bad credential', async () => {
+    const body = new ReadableStream<Uint8Array>({
+      start(controller) {
+        controller.enqueue(new TextEncoder().encode('{"error":"invalid_cl'))
+        controller.error(new Error('socket hang up'))
+      },
+    })
+    fetch.mockResolvedValue(
+      new Response(body, { status: 401, headers: { 'Content-Type': 'application/json' } })
+    )
+
+    await expect(resolveDatabricksCredentialToken('cred-1')).rejects.toMatchObject({
+      code: 'provider_unavailable',
+      logDetail: { reason: 'Databricks token response could not be read' },
+    })
+  })
+
   it('reports a token reply without a token as the provider misbehaving, not a bad credential', async () => {
     fetch.mockResolvedValue(jsonResponse({}, 200))
 

apps/sim/lib/credentials/databricks-service-account.server.ts

@@ -5,7 +5,7 @@ import { eq } from 'drizzle-orm'
 import { z } from 'zod'
 import { decryptSecret, encryptSecret } from '@/lib/core/security/encryption'
 import { validateDatabricksWorkspaceHost } from '@/lib/core/security/input-validation'
-import { readResponseJsonWithLimit } from '@/lib/core/utils/stream-limits'
+import { isPayloadSizeLimitError, readResponseJsonWithLimit } from '@/lib/core/utils/stream-limits'
 import { parseServiceAccountConfig } from '@/lib/credentials/service-account-config'
 import {
   providerFailureCode,
@@ -151,10 +151,15 @@ async function requestWorkspaceToken(
     label: 'Databricks token response',
   }).catch((error: unknown) => {
     if (error instanceof SyntaxError) return {}
-    throw new DatabricksCredentialError(
-      'Databricks token response exceeded the size limit',
-      response.status
-    )
+    signal?.throwIfAborted()
+    if (isPayloadSizeLimitError(error)) {
+      throw new DatabricksCredentialError(
+        'Databricks token response exceeded the size limit',
+        response.status
+      )
+    }
+    // An interrupted body says nothing about the credential, whatever the status line was.
+    throw new DatabricksCredentialError('Databricks token response could not be read', 502)
   })) as {
     access_token?: unknown
     error_description?: unknown