Merge remote-tracking branch 'origin/codex/batch13-workos-vault-errors' into codex/effect-lint-integration

Rhys Sullivan committed 6 months ago

Commit 14687972 parents f8e48b1 1e26fe22 files · +42 −22Browse files

Unified · Split

2 files

packages/plugins/workos-vault/src/sdk/client.ts +20 −15
packages/plugins/workos-vault/src/sdk/secret-store.ts +22 −7

packages/plugins/workos-vault/src/sdk/client.ts+20−15

   NotFoundException,
   WorkOS as WorkOSClient,
 } from "@workos-inc/node/worker";
-import { Data, Effect, Result } from "effect";
+import { Data, Effect, Option, Result, Schema } from "effect";
 export interface WorkOSVaultObjectMetadata {
   readonly context: Record<string, unknown>;
   readonly value?: string;
 }
-// Minimal shape carrying an HTTP-style status code. Production WorkOS errors
+const WORKOS_KEK_NOT_READY_MESSAGE =
-// (`GenericServerException`/`NotFoundException`) and test fakes both populate
+  "KEK was created but is not yet ready. This request can be retried.";
-// a numeric `status`, so the boundary normalises against this named type
-// rather than probing arbitrary unknown shapes.
-interface ErrorWithStatus extends Error {
-  readonly status: number;
-}
-const isErrorWithStatus = (cause: unknown): cause is ErrorWithStatus =>
+const CauseWithStatusSchema = Schema.Struct({
-  cause instanceof Error && typeof (cause as ErrorWithStatus).status === "number";
+  status: Schema.Number,
+});
 const statusFromWorkOSCause = (cause: unknown): number | undefined => {
   if (cause instanceof GenericServerException || cause instanceof NotFoundException) {
     return cause.status;
   }
-  if (isErrorWithStatus(cause)) return cause.status;
+  return Option.match(Schema.decodeUnknownOption(CauseWithStatusSchema)(cause), {
-  return undefined;
+    onNone: () => undefined,
+    onSome: (decoded) => decoded.status,
+  });
 };
-const messageFromWorkOSCause = (cause: unknown): string =>
+const isKekNotReadyWorkOSCause = (cause: unknown): boolean =>
-  cause instanceof Error ? cause.message : typeof cause === "string" ? cause : "";
+  cause instanceof GenericServerException &&
+  // oxlint-disable-next-line executor/no-unknown-error-message -- boundary: WorkOS only exposes this retryable Vault condition through its SDK exception message
+  cause.message.endsWith(WORKOS_KEK_NOT_READY_MESSAGE);
 export class WorkOSVaultClientError extends Data.TaggedError("WorkOSVaultClientError")<{
   readonly cause: unknown;
   readonly message: string;
   readonly operation: string;
+  readonly retryKind?: "kek_not_ready";
   readonly status?: number;
 }> {
   constructor(options: {
     readonly cause: unknown;
     readonly message?: string;
     readonly operation: string;
+    readonly retryKind?: "kek_not_ready";
     readonly status?: number;
   }) {
     super({
       cause: options.cause,
-      message: options.message ?? messageFromWorkOSCause(options.cause),
+      message: options.message ?? `WorkOS Vault ${options.operation} failed`,
       operation: options.operation,
+      retryKind:
+        options.retryKind ??
+        (isKekNotReadyWorkOSCause(options.cause) ? "kek_not_ready" : undefined),
       status: options.status ?? statusFromWorkOSCause(options.cause),
     });
   }

packages/plugins/workos-vault/src/sdk/secret-store.ts+22−7

   error.status === status;
 const isKekNotReadyError = (error: WorkOSVaultClientError): boolean =>
-  error.message.includes("KEK was created but is not yet ready");
+  error.retryKind === "kek_not_ready";
 // Default context builder. Each semantic piece of a scope id lives in
 // its own vault-context key so WorkOS's KEK matcher sees individual
     return true;
   });
-const formatVaultError = (error: WorkOSVaultClientError): StorageError =>
-  new StorageError({ message: error.message, cause: error.cause });
 // ---------------------------------------------------------------------------
 // makeWorkOSVaultSecretProvider — builds a SecretProvider backed by
 // WorkOS Vault for values and the plugin's own metadata table for
         const meta = yield* store.get(id, scope);
         if (!meta) return null;
         const object = yield* loadSecretObject(client, prefix, scope, id).pipe(
-          Effect.mapError(formatVaultError),
+          Effect.mapError(
+            (error) =>
+              new StorageError({
+                message: "WorkOS Vault secret read failed",
+                cause: error,
+              }),
+          ),
         );
         if (!object || !object.value) return null;
         return object.value;
       Effect.gen(function* () {
         const existing = yield* store.get(id, scope);
         yield* upsertSecretValue(client, prefix, scope, id, value, contextForScope).pipe(
-          Effect.mapError(formatVaultError),
+          Effect.mapError(
+            (error) =>
+              new StorageError({
+                message: "WorkOS Vault secret write failed",
+                cause: error,
+              }),
+          ),
         );
         yield* store.upsert({
           id,
         const meta = yield* store.get(id, scope);
         if (!meta) return false;
         yield* deleteSecretValue(client, prefix, scope, id).pipe(
-          Effect.mapError(formatVaultError),
+          Effect.mapError(
+            (error) =>
+              new StorageError({
+                message: "WorkOS Vault secret delete failed",
+                cause: error,
+              }),
+          ),
         );
         yield* store.remove(id, scope);
         return true;