mirror of
https://github.com/openclaw/openclaw.git
synced 2026-05-13 00:10:44 +00:00
* fix(msteams): surface network errors blocking Teams bot JWT validation and outbound replies (#77674) When login.botframework.com or smba.trafficmanager.net egress is blocked, errors previously disappeared completely. JWT validator swallowed network errors and returned false (401 looked identical to a bad credential), and outbound send failures with transport-level codes had no hint pointing to the Connector endpoint. - sdk.ts: rethrow ECONNREFUSED/ENOTFOUND/EHOSTUNREACH/ETIMEDOUT/ECONNRESET from the JWKS key fetch so callers can distinguish firewall blocks from bad credentials; add isJwksNetworkError() helper - monitor.ts: catch rethrown network errors in JWT middleware and log at runtime.error level with an actionable message pointing to login.botframework.com:443; upgrade allowlist resolution failures from runtime.log (optional/silent) to runtime.error - errors.ts: add "network" kind to classifyMSTeamsSendError for transport-level errors (ECONNREFUSED, ENOTFOUND, etc.); add formatMSTeamsSendErrorHint for "network" kind pointing to smba.trafficmanager.net and egress rules - monitor-handler.ts, message-handler.ts: remove spurious ?. from runtime.error calls (RuntimeEnv.error is a required non-optional field) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(msteams): surface blocked botframework egress --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Brad Groux <3053586+BradGroux@users.noreply.github.com>
164 lines
5.3 KiB
TypeScript
164 lines
5.3 KiB
TypeScript
import { describe, expect, it, vi } from "vitest";
|
|
import {
|
|
classifyMSTeamsSendError,
|
|
formatMSTeamsSendErrorHint,
|
|
formatUnknownError,
|
|
isRevokedProxyError,
|
|
} from "./errors.js";
|
|
import { withRevokedProxyFallback } from "./revoked-context.js";
|
|
|
|
describe("msteams errors", () => {
|
|
it("formats unknown errors", () => {
|
|
expect(formatUnknownError("oops")).toBe("oops");
|
|
expect(formatUnknownError(null)).toBe("null");
|
|
});
|
|
|
|
it("classifies auth errors", () => {
|
|
expect(classifyMSTeamsSendError({ statusCode: 401 }).kind).toBe("auth");
|
|
expect(classifyMSTeamsSendError({ statusCode: 403 }).kind).toBe("auth");
|
|
});
|
|
|
|
it("classifies ContentStreamNotAllowed as permanent instead of auth", () => {
|
|
expect(
|
|
classifyMSTeamsSendError({
|
|
statusCode: 403,
|
|
response: {
|
|
body: {
|
|
error: {
|
|
code: "ContentStreamNotAllowed",
|
|
},
|
|
},
|
|
},
|
|
}),
|
|
).toMatchObject({
|
|
kind: "permanent",
|
|
statusCode: 403,
|
|
errorCode: "ContentStreamNotAllowed",
|
|
});
|
|
});
|
|
|
|
it("classifies throttling errors and parses retry-after", () => {
|
|
expect(classifyMSTeamsSendError({ statusCode: 429, retryAfter: "1.5" })).toMatchObject({
|
|
kind: "throttled",
|
|
statusCode: 429,
|
|
retryAfterMs: 1500,
|
|
});
|
|
});
|
|
|
|
it("classifies transient errors", () => {
|
|
expect(classifyMSTeamsSendError({ statusCode: 503 })).toMatchObject({
|
|
kind: "transient",
|
|
statusCode: 503,
|
|
});
|
|
});
|
|
|
|
it("classifies permanent 4xx errors", () => {
|
|
expect(classifyMSTeamsSendError({ statusCode: 400 })).toMatchObject({
|
|
kind: "permanent",
|
|
statusCode: 400,
|
|
});
|
|
});
|
|
|
|
it("provides actionable hints for common cases", () => {
|
|
expect(formatMSTeamsSendErrorHint({ kind: "auth" })).toContain("msteams");
|
|
expect(formatMSTeamsSendErrorHint({ kind: "throttled" })).toContain("throttled");
|
|
expect(
|
|
formatMSTeamsSendErrorHint({
|
|
kind: "permanent",
|
|
errorCode: "ContentStreamNotAllowed",
|
|
}),
|
|
).toContain("expired the content stream");
|
|
});
|
|
|
|
it("classifies transport-level network errors and provides smba egress hint (#77674)", () => {
|
|
const econnrefused = Object.assign(new Error("connect ECONNREFUSED"), { code: "ECONNREFUSED" });
|
|
const enotfound = Object.assign(new Error("getaddrinfo ENOTFOUND smba.trafficmanager.net"), {
|
|
code: "ENOTFOUND",
|
|
});
|
|
const etimedout = Object.assign(new Error("ETIMEDOUT"), { code: "ETIMEDOUT" });
|
|
|
|
expect(classifyMSTeamsSendError(econnrefused)).toMatchObject({
|
|
kind: "network",
|
|
errorCode: "ECONNREFUSED",
|
|
});
|
|
expect(classifyMSTeamsSendError(enotfound)).toMatchObject({
|
|
kind: "network",
|
|
errorCode: "ENOTFOUND",
|
|
});
|
|
expect(classifyMSTeamsSendError(etimedout)).toMatchObject({
|
|
kind: "network",
|
|
errorCode: "ETIMEDOUT",
|
|
});
|
|
|
|
// Hints for network errors must mention smba (Connector endpoint) and egress
|
|
expect(formatMSTeamsSendErrorHint({ kind: "network" })).toContain("smba");
|
|
expect(formatMSTeamsSendErrorHint({ kind: "network" })).toContain("egress");
|
|
});
|
|
|
|
it("still classifies HTTP errors as unknown when no status code and no network code", () => {
|
|
expect(classifyMSTeamsSendError(new Error("unexpected error")).kind).toBe("unknown");
|
|
expect(classifyMSTeamsSendError(null)).toMatchObject({ kind: "unknown" });
|
|
});
|
|
|
|
describe("isRevokedProxyError", () => {
|
|
it("returns true for revoked proxy TypeError", () => {
|
|
expect(
|
|
isRevokedProxyError(new TypeError("Cannot perform 'set' on a proxy that has been revoked")),
|
|
).toBe(true);
|
|
expect(
|
|
isRevokedProxyError(new TypeError("Cannot perform 'get' on a proxy that has been revoked")),
|
|
).toBe(true);
|
|
});
|
|
|
|
it("returns false for non-TypeError errors", () => {
|
|
expect(isRevokedProxyError(new Error("proxy that has been revoked"))).toBe(false);
|
|
});
|
|
|
|
it("returns false for unrelated TypeErrors", () => {
|
|
expect(isRevokedProxyError(new TypeError("undefined is not a function"))).toBe(false);
|
|
});
|
|
|
|
it("returns false for non-error values", () => {
|
|
expect(isRevokedProxyError(null)).toBe(false);
|
|
expect(isRevokedProxyError("proxy that has been revoked")).toBe(false);
|
|
});
|
|
});
|
|
|
|
describe("withRevokedProxyFallback", () => {
|
|
it("returns primary result when no error occurs", async () => {
|
|
await expect(
|
|
withRevokedProxyFallback({
|
|
run: async () => "ok",
|
|
onRevoked: async () => "fallback",
|
|
}),
|
|
).resolves.toBe("ok");
|
|
});
|
|
|
|
it("uses fallback when proxy-revoked TypeError is thrown", async () => {
|
|
const onRevokedLog = vi.fn();
|
|
await expect(
|
|
withRevokedProxyFallback({
|
|
run: async () => {
|
|
throw new TypeError("Cannot perform 'get' on a proxy that has been revoked");
|
|
},
|
|
onRevoked: async () => "fallback",
|
|
onRevokedLog,
|
|
}),
|
|
).resolves.toBe("fallback");
|
|
expect(onRevokedLog).toHaveBeenCalledOnce();
|
|
});
|
|
|
|
it("rethrows non-revoked errors", async () => {
|
|
const err = Object.assign(new Error("boom"), { statusCode: 500 });
|
|
await expect(
|
|
withRevokedProxyFallback({
|
|
run: async () => {
|
|
throw err;
|
|
},
|
|
onRevoked: async () => "fallback",
|
|
}),
|
|
).rejects.toBe(err);
|
|
});
|
|
});
|
|
});
|