cpflow 5.1.1 → 5.3.0

data/lib/command/setup_app.rb

@@ -1,13 +1,14 @@
 # frozen_string_literal: true
 
 module Command
-  class SetupApp < Base
+  class SetupApp < Base # rubocop:disable Metrics/ClassLength
     NAME = "setup-app"
     OPTIONS = [
       app_option(required: true),
       skip_secret_access_binding_option,
       skip_secrets_setup_option,
-      skip_post_creation_hook_option
+      skip_post_creation_hook_option,
+      refresh_templates_option
     ].freeze
     DESCRIPTION = "Creates an app and all its workloads"
     LONG_DESCRIPTION = <<~DESC
@@ -23,18 +24,21 @@ module Command
       - Runs a post-creation hook after the app is created if `hooks.post_creation` is specified in the `.controlplane/controlplane.yml` file
       - If the hook exits with a non-zero code, the command will stop executing and also exit with a non-zero code
       - Use `--skip-post-creation-hook` to skip the hook if specified in `controlplane.yml`
+      - Use `--refresh-templates` to apply configured templates noninteractively to an existing app while preserving each workload's configured app image even when workloads are unready or use mixed image versions, skipping existing secret resources entirely, repairing secrets access bindings, and skipping the post-creation hook
     DESC
     VALIDATIONS = %w[config templates].freeze
 
-    def call # rubocop:disable Metrics/CyclomaticComplexity, Metrics/MethodLength
+    def call # rubocop:disable Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
       templates = config[:setup_app_templates]
+      refresh_templates = config.options[:refresh_templates]
 
       app = cp.fetch_gvc
-      if app
+      if app && !refresh_templates
         raise "App '#{config.app}' already exists. If you want to update this app, " \
               "either run 'cpflow delete -a #{config.app}' and then re-run this command, " \
               "or run 'cpflow apply-template #{templates.join(' ')} -a #{config.app}'."
       end
+      raise "App '#{config.app}' does not exist, so its templates cannot be refreshed." if !app && refresh_templates
 
       skip_secrets_setup = skip_secrets_setup?
 
@@ -45,11 +49,12 @@ module Command
 
       args = []
       args.push("--add-app-identity") unless skip_secrets_setup
+      args.push("--yes", "--preserve-existing-runtime") if refresh_templates
       run_cpflow_command("apply-template", *templates, "-a", config.app, *args)
 
       bind_identity_to_policy unless skip_secrets_setup
       bind_shared_secret_policy_grants(shared_secret_policy_grant_pairs) unless skip_secrets_setup
-      run_post_creation_hook unless config.options[:skip_post_creation_hook]
+      run_post_creation_hook unless refresh_templates || config.options[:skip_post_creation_hook]
     end
 
     private

data/lib/core/config.rb

@@ -166,6 +166,28 @@ class Config # rubocop:disable Metrics/ClassLength
     current&.dig(:use_digest_image_ref) == true
   end
 
+  def deploy_order
+    return nil unless current&.key?(:deploy_order)
+
+    @deploy_order ||= normalize_deploy_order(
+      current.fetch(:deploy_order),
+      app_workloads_for_deploy_order!(current, app),
+      app
+    )
+  end
+
+  def validate_deploy_orders!
+    apps.each do |app_name, app_options|
+      next unless app_options.key?(:deploy_order)
+
+      normalize_deploy_order(
+        app_options.fetch(:deploy_order),
+        app_workloads_for_deploy_order!(app_options, app_name),
+        app_name
+      )
+    end
+  end
+
   private
 
   def ensure_current_config!
@@ -252,6 +274,78 @@ class Config # rubocop:disable Metrics/ClassLength
     end
   end
 
+  def app_workloads_for_deploy_order!(app_options, app_name)
+    app_workloads = app_options[:app_workloads]
+    return app_workloads if app_workloads.is_a?(Array)
+
+    raise "deploy_order for app '#{app_name}' requires app_workloads to be an array."
+  end
+
+  def normalize_deploy_order(raw_deploy_order, app_workloads, app_name)
+    ensure_deploy_order_array!(raw_deploy_order, app_name)
+    context = {
+      app_workload_names: app_workloads.map(&:to_s),
+      seen_workloads: {},
+      app_name: app_name
+    }
+
+    raw_deploy_order.map.with_index do |group, index|
+      normalize_deploy_order_group(group, index, context)
+    end
+  end
+
+  def ensure_deploy_order_array!(raw_deploy_order, app_name)
+    raise "deploy_order for app '#{app_name}' must be an array of workload groups." unless raw_deploy_order.is_a?(Array)
+    return unless raw_deploy_order.empty?
+
+    raise "deploy_order for app '#{app_name}' must include at least one workload group."
+  end
+
+  def normalize_deploy_order_group(group, index, context)
+    group_number = index + 1
+    ensure_deploy_order_group_array!(group, group_number, context.fetch(:app_name))
+
+    group.map.with_index do |workload, workload_index|
+      normalize_deploy_order_workload(workload, group_number, workload_index, context)
+    end
+  end
+
+  def ensure_deploy_order_group_array!(group, group_number, app_name)
+    unless group.is_a?(Array)
+      raise "deploy_order group ##{group_number} for app '#{app_name}' must be an array of workload names."
+    end
+    return unless group.empty?
+
+    raise "deploy_order group ##{group_number} for app '#{app_name}' must include at least one workload."
+  end
+
+  def normalize_deploy_order_workload(workload, group_number, workload_index, context)
+    app_name = context.fetch(:app_name)
+    unless workload.is_a?(String) && !workload.strip.empty?
+      raise "deploy_order group ##{group_number} entry ##{workload_index + 1} " \
+            "for app '#{app_name}' must be a workload name."
+    end
+
+    workload_name = workload.strip
+    ensure_deploy_order_workload_configured!(workload_name, context.fetch(:app_workload_names), app_name)
+    ensure_deploy_order_workload_unique!(workload_name, context.fetch(:seen_workloads), app_name)
+    workload_name
+  end
+
+  def ensure_deploy_order_workload_configured!(workload_name, app_workload_names, app_name)
+    return if app_workload_names.include?(workload_name)
+
+    raise "deploy_order workload '#{workload_name}' must be listed in app_workloads for app '#{app_name}'."
+  end
+
+  def ensure_deploy_order_workload_unique!(workload_name, seen_workloads, app_name)
+    if seen_workloads[workload_name]
+      raise "deploy_order workload '#{workload_name}' must appear only once for app '#{app_name}'."
+    end
+
+    seen_workloads[workload_name] = true
+  end
+
   def ensure_app!
     return if app
 

data/lib/core/controlplane.rb

@@ -177,6 +177,28 @@ class Controlplane # rubocop:disable Metrics/ClassLength
     api.workload_get(workload: workload, gvc: gvc, org: org)
   end
 
+  def fetch_workload_with_status(workload)
+    result = workload_status_result(workload)
+
+    unless result[:success]
+      Shell.warn("Failed to fetch status for '#{workload}': #{result[:error_output].to_s.strip}")
+      return
+    end
+
+    JSON.parse(result[:output])
+  rescue JSON::ParserError => e
+    Shell.warn("Failed to parse status for '#{workload}': #{e.message}")
+    nil
+  end
+
+  def workload_status_result(workload)
+    # The direct API response omits computed fields such as status.readyLatest.
+    args = ["cpln", "workload", "get", workload, "--gvc", gvc, "--org", org, "-o", "json"]
+    Shell.debug("CMD", Shellwords.join(args))
+    Shell.cmd(*args, separate_stderr: true)
+  end
+  private :workload_status_result
+
   def fetch_workload!(workload)
     workload_data = fetch_workload(workload)
     return workload_data if workload_data
@@ -279,9 +301,14 @@ class Controlplane # rubocop:disable Metrics/ClassLength
   end
 
   def workload_exec(workload, replica, location:, container: nil, command: nil)
-    cmd = "cpln workload exec #{workload} #{gvc_org} --replica #{replica} --location #{location} -it"
-    cmd += " --container #{container}" if container
-    cmd += " -- #{command}"
+    cmd = [
+      "cpln", "workload", "exec", workload,
+      "--gvc", gvc, "--org", org,
+      "--replica", replica, "--location", location, "-it"
+    ]
+    cmd.push("--container", container) if container
+    cmd << "--"
+    cmd.concat(Array(command))
     perform(cmd, output_mode: :all)
   end
 
@@ -383,6 +410,10 @@ class Controlplane # rubocop:disable Metrics/ClassLength
     api.fetch_secret(org: org, secret: secret)
   end
 
+  def reveal_secret(secret)
+    api.reveal_secret(org: org, secret: secret)
+  end
+
   # identities
 
   def fetch_identity(identity, a_gvc = gvc)
@@ -509,6 +540,7 @@ class Controlplane # rubocop:disable Metrics/ClassLength
   # or the return value of `Shell.should_hide_output?`.
   def build_command(cmd, output_mode: nil) # rubocop:disable Metrics/MethodLength
     output_mode ||= determine_command_output_mode
+    raise "Array commands require output mode 'all'." if cmd.is_a?(Array) && %i[errors_only none].include?(output_mode)
 
     case output_mode
     when :all
@@ -535,7 +567,8 @@ class Controlplane # rubocop:disable Metrics/ClassLength
   def perform(cmd, output_mode: nil, sensitive_data_pattern: nil)
     cmd = build_command(cmd, output_mode: output_mode)
 
-    Shell.debug("CMD", cmd, sensitive_data_pattern: sensitive_data_pattern)
+    debug_cmd = cmd.is_a?(Array) ? Shellwords.join(cmd) : cmd
+    Shell.debug("CMD", debug_cmd, sensitive_data_pattern: sensitive_data_pattern)
 
     kernel_system_with_pid_handling(cmd)
   end
@@ -544,7 +577,7 @@ class Controlplane # rubocop:disable Metrics/ClassLength
   # Returns true on zero exit, false on non-zero exit, nil when the process was signal-killed.
   # SystemCallError (e.g. cpln binary missing) propagates — startup checks ensure this is unreachable in practice.
   def kernel_system_with_pid_handling(cmd)
-    pid = Process.spawn(cmd)
+    pid = cmd.is_a?(Array) ? Process.spawn(*cmd) : Process.spawn(cmd)
     $child_pids << pid # rubocop:disable Style/GlobalVars
 
     _, status = Process.wait2(pid)

data/lib/core/controlplane_api.rb

@@ -122,6 +122,14 @@ class ControlplaneApi # rubocop:disable Metrics/ClassLength
     api_json("/org/#{org}/secret/#{secret}", method: :get)
   end
 
+  def reveal_secret(org:, secret:)
+    api_json(
+      "/org/#{org}/secret/#{secret}/-reveal",
+      method: :get,
+      request_policy: ControlplaneApiDirect::BEST_EFFORT_SENSITIVE_REQUEST_POLICY
+    )
+  end
+
   def delete_secret(org:, secret:)
     api_json("/org/#{org}/secret/#{secret}", method: :delete)
   end

data/lib/core/controlplane_api_direct.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-class ControlplaneApiDirect
+class ControlplaneApiDirect # rubocop:disable Metrics/ClassLength
   class RedactedDebugOutput
     SAFE_HEADERS = %w[Content-Type Content-Length Accept Host Date Cache-Control Connection].freeze
     HEADER_REGEX = /^([A-Za-z-]+): (.+)$/
@@ -40,6 +40,9 @@ class ControlplaneApiDirect
     end
   end
 
+  # Raised when fetching the API token via `cpln profile token` fails.
+  class TokenRefreshError < StandardError; end
+
   API_METHODS = {
     get: Net::HTTP::Get,
     patch: Net::HTTP::Patch,
@@ -51,40 +54,200 @@ class ControlplaneApiDirect
 
   API_TOKEN_EXPIRY_SECONDS = 300
 
-  class << self
-    attr_accessor :trace
+  # GET alone retries 5xx responses or transport failures after the request may
+  # have reached the server. Every method may retry an explicit 429 response.
+  # DELETE stays out of this set because after other errors the client cannot
+  # know whether deletion applied server-side.
+  IDEMPOTENT_METHODS = %i[get].freeze
+
+  # Bounded so a retried connect failure fits within the retry deadline.
+  OPEN_TIMEOUT_SECONDS = 10
+  BEST_EFFORT_TIMEOUT_SECONDS = 5
+  RequestPolicy = Struct.new(:sensitive, :retry_transient, :timeout, keyword_init: true) do
+    def initialize(sensitive:, retry_transient:, timeout:)
+      super
+      freeze
+    end
   end
+  DEFAULT_REQUEST_POLICY = RequestPolicy.new(sensitive: false, retry_transient: true, timeout: nil)
+  BEST_EFFORT_SENSITIVE_REQUEST_POLICY = RequestPolicy.new(
+    sensitive: true,
+    retry_transient: false,
+    timeout: BEST_EFFORT_TIMEOUT_SECONDS
+  )
+
+  # Thread-safe API token cache. A single instance is shared process-wide by
+  # default (see `default_token_provider`) so each `ControlplaneApiDirect.new`
+  # per API call reuses the cached token; tests inject a fresh instance.
+  class ApiToken
+    def initialize
+      @mutex = Mutex.new
+      @data = nil
+    end
 
-  def call(url, method:, host: :api, body: nil) # rubocop:disable Metrics/MethodLength, Metrics/CyclomaticComplexity
-    trace = ControlplaneApiDirect.trace
-    uri = URI("#{api_host(host)}#{url}")
-    request = API_METHODS[method].new(uri)
-    request["Content-Type"] = "application/json"
+    def fetch
+      @mutex.synchronize do
+        @data = load_token if @data.nil?
+        refresh! if expiring_soon?
+        @data
+      end
+    end
 
-    refresh_api_token if should_refresh_api_token?
+    def reset
+      @mutex.synchronize { @data = nil }
+    end
 
-    request["Authorization"] = authorization_header
-    request.body = body.to_json if body
+    private
 
-    Shell.debug(method.upcase, "#{uri} #{body&.to_json}")
+    def load_token
+      token = ENV.fetch("CPLN_TOKEN", nil)
+      return validate!(token: token, comes_from_profile: false) if token
 
-    http = Net::HTTP.new(uri.hostname, uri.port)
-    http.use_ssl = uri.scheme == "https"
-    http.set_debug_output(RedactedDebugOutput.new) if trace
+      validate!(token: fetch_profile_token, comes_from_profile: true)
+    end
 
-    response = http.start { |ht| ht.request(request) }
+    def refresh!
+      @data = validate!(token: fetch_profile_token, comes_from_profile: true)
+    end
 
-    case response
-    when Net::HTTPOK
-      JSON.parse(response.body)
-    when Net::HTTPAccepted
+    def fetch_profile_token
+      result = Shell.cmd("cpln", "profile", "token")
+      unless result[:success]
+        raise TokenRefreshError,
+              "Failed to fetch the API token via 'cpln profile token'. " \
+              "Please re-run 'cpln profile login' or set the CPLN_TOKEN env variable."
+      end
+
+      result[:output].chomp
+    end
+
+    def validate!(data)
+      token = data[:token]
+      # Allow any token that does not contain line breaks. Scoped service-account
+      # tokens include punctuation such as '/', '+', ':', and '=', so format
+      # validation is deferred to the Control Plane API.
+      return data if token && !token.empty? && !token.match?(/[\r\n]/)
+
+      raise "Unknown API token format. " \
+            "Please re-run 'cpln profile login' or set the correct CPLN_TOKEN env variable."
+    end
+
+    # Returns `true` when a profile-sourced JWT expires within 5 minutes.
+    def expiring_soon?
+      return false unless @data[:comes_from_profile]
+
+      payload, = JWT.decode(@data[:token], nil, false, algorithms: [])
+      return false unless payload.is_a?(Hash) && payload["exp"]
+
+      payload["exp"].to_i - Time.now.to_i <= API_TOKEN_EXPIRY_SECONDS
+    rescue JWT::DecodeError
+      false
+    end
+  end
+
+  # Retry policy for transient failures: tracks attempts, enforces the attempt
+  # and elapsed-time caps, and sleeps between tries (capped `Retry-After` when
+  # the server provides one, exponential backoff with jitter otherwise).
+  # The deadline is checked only before starting a new attempt: no new attempt
+  # begins after `MAX_TOTAL_RETRY_SECONDS`, but an in-flight attempt may run
+  # past it (bounded by the per-attempt open/read timeouts).
+  class Retrier
+    MAX_ATTEMPTS = 3
+    MAX_TOTAL_RETRY_SECONDS = 120
+    BASE_RETRY_DELAY_SECONDS = 0.5
+    MAX_RETRY_DELAY_SECONDS = 10
+    TRANSIENT_NETWORK_ERRORS = [
+      Net::OpenTimeout, Net::ReadTimeout,
+      Errno::ECONNRESET, Errno::ECONNREFUSED, Errno::EPIPE, Errno::ETIMEDOUT,
+      EOFError, OpenSSL::SSL::SSLError, SocketError
+    ].freeze
+
+    def initialize(sleeper:)
+      @sleeper = sleeper
+      @attempts_made = 1
+      @deadline = Retrier.monotonic_time + MAX_TOTAL_RETRY_SECONDS
+    end
+
+    def self.monotonic_time
+      Process.clock_gettime(Process::CLOCK_MONOTONIC)
+    end
+
+    # Retries 429 responses for every method, but limits 5xx retries to
+    # idempotent requests.
+    def retry_response?(response, idempotent)
+      retriable = response.is_a?(Net::HTTPTooManyRequests) ||
+                  (idempotent && response.is_a?(Net::HTTPServerError))
+      return false unless retriable
+
+      retry?(retry_after: response["Retry-After"])
+    end
+
+    # Whether to retry a transient network error. Non-idempotent requests only
+    # retry when the failure happened before the request may have hit the wire.
+    def retry_exception?(idempotent, request_sent)
+      return false if request_sent && !idempotent
+
+      retry?
+    end
+
+    private
+
+    # When another attempt is allowed, sleeps through the delay and returns `true`.
+    def retry?(retry_after: nil)
+      return false if @attempts_made >= MAX_ATTEMPTS || Retrier.monotonic_time >= @deadline
+
+      @sleeper.call(next_delay(retry_after))
+      @attempts_made += 1
       true
-    when Net::HTTPNotFound
-      nil
-    when Net::HTTPForbidden
-      raise ForbiddenError.new(url: url, response: response)
-    else
-      raise("#{response} #{response.body}")
+    end
+
+    def next_delay(retry_after)
+      seconds = parse_retry_after(retry_after)
+      return seconds if seconds
+
+      backoff = [BASE_RETRY_DELAY_SECONDS * (2**(@attempts_made - 1)), MAX_RETRY_DELAY_SECONDS].min
+      (backoff / 2) + (rand * backoff / 2)
+    end
+
+    # Supports the delta-seconds form of `Retry-After`, capped so a slow or
+    # misconfigured server cannot stall the CLI.
+    def parse_retry_after(value)
+      return nil unless value.to_s.match?(/\A\d+\z/)
+
+      [Integer(value, 10), MAX_RETRY_DELAY_SECONDS].min
+    end
+  end
+
+  class << self
+    attr_accessor :trace
+    attr_reader :default_token_provider
+
+    # Preserved seam: `Controlplane#profile_switch` invalidates the cached
+    # token when the CPLN profile changes.
+    def reset_api_token = default_token_provider.reset
+  end
+
+  @default_token_provider = ApiToken.new
+
+  def initialize(token_provider: ControlplaneApiDirect.default_token_provider, sleeper: nil)
+    @token_provider = token_provider
+    @sleeper = sleeper || ->(seconds) { Kernel.sleep(seconds) }
+  end
+
+  def call(url, method:, host: :api, body: nil, request_policy: DEFAULT_REQUEST_POLICY)
+    uri = URI("#{api_host(host)}#{url}")
+    # Token fetch and request construction happen outside the transient rescue
+    # in attempt_request so their failures (e.g. TokenRefreshError from the
+    # `cpln` shell-out) are never misclassified as retryable network errors.
+    request = build_request(uri, method, body)
+    retrier = Retrier.new(sleeper: @sleeper)
+
+    debug_body = request_policy.sensitive && body ? "[REDACTED]" : body&.to_json
+    Shell.debug(method.upcase, "#{uri} #{debug_body}")
+
+    loop do
+      response = attempt_request(uri, request, method, retrier, request_policy)
+      return handle_response(response, url, request_policy) if response
     end
   end
 
@@ -104,54 +267,85 @@ class ControlplaneApiDirect
     "Bearer #{token}"
   end
 
-  # rubocop:disable Style/ClassVars
-  def api_token # rubocop:disable Metrics/MethodLength
-    return @@api_token if defined?(@@api_token)
-
-    @@api_token = {
-      token: ENV.fetch("CPLN_TOKEN", nil),
-      comes_from_profile: false
-    }
-    if @@api_token[:token].nil?
-      @@api_token = {
-        token: Shell.cmd("cpln", "profile", "token")[:output].chomp,
-        comes_from_profile: true
-      }
-    end
-    token = @@api_token[:token]
-    # Allow any token that does not contain line breaks. Scoped service-account
-    # tokens include punctuation such as '/', '+', ':', and '=', so format
-    # validation is deferred to the Control Plane API.
-    return @@api_token if token && !token.empty? && !token.match?(/[\r\n]/)
+  def api_token = @token_provider.fetch
 
-    raise "Unknown API token format. " \
-          "Please re-run 'cpln profile login' or set the correct CPLN_TOKEN env variable."
+  def self.parse_org(url)
+    url.match(%r{^/org/([^/]+)})&.[](1)
   end
 
-  # Returns `true` when the token is about to expire in 5 minutes
-  def should_refresh_api_token?
-    return false unless api_token[:comes_from_profile]
+  private
 
-    payload, = JWT.decode(api_token[:token], nil, false, algorithms: [])
-    return false unless payload.is_a?(Hash) && payload["exp"]
+  # Returns the response, or `nil` when the attempt failed transiently and the
+  # retrier approved (and already slept before) another attempt. Only the
+  # transport phase (connect + request) is covered by the transient rescue.
+  def attempt_request(uri, request, method, retrier, request_policy)
+    request_sent = false
+    idempotent = IDEMPOTENT_METHODS.include?(method)
+    response = transport_request(uri, request, request_policy) { request_sent = true }
+    return response unless request_policy.retry_transient && retrier.retry_response?(response, idempotent)
 
-    difference_in_seconds = payload["exp"].to_i - Time.now.to_i
+    nil
+  rescue *Retrier::TRANSIENT_NETWORK_ERRORS
+    raise unless request_policy.retry_transient && retrier.retry_exception?(idempotent, request_sent)
 
-    difference_in_seconds <= API_TOKEN_EXPIRY_SECONDS
-  rescue JWT::DecodeError
-    false
+    nil
   end
 
-  def refresh_api_token
-    @@api_token[:token] = Shell.cmd("cpln", "profile", "token")[:output].chomp
+  def transport_request(uri, request, request_policy)
+    http = build_http(uri, request_policy)
+    http.start
+    # Set request_sent before `http.request` deliberately: a reset before bytes
+    # are written is indistinguishable from one after a partial write, so treat
+    # both as sent conservatively.
+    yield
+    begin
+      http.request(request)
+    ensure
+      http.finish if http.started?
+    end
   end
 
-  def self.reset_api_token
-    remove_class_variable(:@@api_token) if defined?(@@api_token)
+  def build_request(uri, method, body)
+    request = API_METHODS[method].new(uri)
+    request["Content-Type"] = "application/json"
+    request["Authorization"] = authorization_header
+    request.body = body.to_json if body
+    request
   end
-  # rubocop:enable Style/ClassVars
 
-  def self.parse_org(url)
-    url.match(%r{^/org/([^/]+)})&.[](1)
+  def build_http(uri, request_policy)
+    http = Net::HTTP.new(uri.hostname, uri.port)
+    http.use_ssl = uri.scheme == "https"
+    # Net::HTTP transparently re-sends requests it deems idempotent once on
+    # mid-flight failures; disable so the Retrier owns the entire retry policy.
+    http.max_retries = 0
+    http.open_timeout = request_policy.timeout || OPEN_TIMEOUT_SECONDS
+    http.read_timeout = request_policy.timeout if request_policy.timeout
+    http.set_debug_output(RedactedDebugOutput.new) if ControlplaneApiDirect.trace && !request_policy.sensitive
+    http
+  end
+
+  def handle_response(response, url, request_policy)
+    case response
+    when Net::HTTPOK then parse_response_body(response, request_policy)
+    when Net::HTTPAccepted then true
+    when Net::HTTPNotFound then nil
+    when Net::HTTPForbidden then raise(ForbiddenError.new(url: url, response: response))
+    else raise(response_error_message(response, request_policy))
+    end
+  end
+
+  def parse_response_body(response, request_policy)
+    JSON.parse(response.body)
+  rescue JSON::ParserError
+    raise unless request_policy.sensitive
+
+    raise JSON::ParserError, "Control Plane API returned invalid JSON for a sensitive request.", cause: nil
+  end
+
+  def response_error_message(response, request_policy)
+    return response.to_s if request_policy.sensitive
+
+    "#{response} #{response.body}"
   end
 end