@cartanova/qgrid-cli 2.9.2 → 2.9.5

package/bundle/src/utils/providers/openai/openai-quota.test.ts

@@ -186,4 +186,36 @@ describe("readOpenAIQuotaUsage", () => {
       }),
     ).resolves.toEqual({ kind: "lookup_failed", reason: "OpenAI quota lookup failed: HTTP 503" });
   });
+
+  it("does not refresh a cancelled 401 lookup", async () => {
+    const controller = new AbortController();
+    const refreshCredentials = vi.fn();
+    const result = await readOpenAIQuotaUsage({
+      credentials: { accessToken: "old", accountId: "acct" },
+      signal: controller.signal,
+      refreshCredentials,
+      fetch: async () => {
+        controller.abort(new Error("cancelled"));
+        return new Response("", { status: 401 });
+      },
+    });
+    expect(result).toEqual({ kind: "lookup_failed", reason: "cancelled" });
+    expect(refreshCredentials).not.toHaveBeenCalled();
+  });
+
+  it("does not retry when cancelled while refreshing", async () => {
+    const controller = new AbortController();
+    const fetchMock = vi.fn().mockResolvedValue(new Response("", { status: 401 }));
+    const result = await readOpenAIQuotaUsage({
+      credentials: { accessToken: "old", accountId: "acct" },
+      signal: controller.signal,
+      fetch: fetchMock,
+      refreshCredentials: async () => {
+        controller.abort(new Error("cancelled"));
+        return { accessToken: "new", accountId: "acct" };
+      },
+    });
+    expect(result).toEqual({ kind: "lookup_failed", reason: "cancelled" });
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
 });

package/bundle/src/utils/providers/openai/openai-quota.ts

@@ -23,19 +23,26 @@ export type OpenAIQuotaUsageResult =
 
 export interface OpenAIQuotaHttpOptions {
   credentials: Pick<OpenAICredentials, "accessToken" | "accountId">;
+  refreshCredentials?: () => Promise<Pick<OpenAICredentials, "accessToken" | "accountId">>;
   fetch?: typeof fetch;
   signal?: AbortSignal;
 }
 
 async function readDirect(options: OpenAIQuotaHttpOptions): Promise<OpenAIRateLimitsWithMeta> {
-  const response = await (options.fetch ?? fetch)(CHATGPT_WHAM_USAGE_URL, {
-    method: "GET",
-    headers: buildCodexIdentityHeaders(
-      options.credentials.accessToken,
-      options.credentials.accountId,
-    ),
-    ...(options.signal ? { signal: options.signal } : {}),
-  });
+  const read = (credentials: OpenAIQuotaHttpOptions["credentials"]) =>
+    (options.fetch ?? fetch)(CHATGPT_WHAM_USAGE_URL, {
+      method: "GET",
+      headers: buildCodexIdentityHeaders(credentials.accessToken, credentials.accountId),
+      ...(options.signal ? { signal: options.signal } : {}),
+    });
+  let response = await read(options.credentials);
+  if (response.status === 401 && options.refreshCredentials) {
+    await response.body?.cancel();
+    options.signal?.throwIfAborted();
+    const credentials = await options.refreshCredentials();
+    options.signal?.throwIfAborted();
+    response = await read(credentials);
+  }
   if (!response.ok) throw new Error(`OpenAI quota lookup failed: HTTP ${response.status}`);
   const body = (await response.json()) as Record<string, unknown>;
   const data = normalizeWhamUsage(body);

package/bundle/src/utils/providers/openai/openai-refresh.test.ts

@@ -126,4 +126,22 @@ describe("OpenAI refresh", () => {
       "openai:refresh_token_reused",
     );
   });
+
+  it("recognizes nested permanent error codes without exposing the provider body", async () => {
+    findOneMock.mockResolvedValue(token(12));
+    vi.stubGlobal("fetch", vi.fn().mockResolvedValue(new Response(JSON.stringify({
+      error: { code: "refresh_token_invalidated", message: "private provider detail" },
+    }), { status: 401 })));
+    await expect(handleChatgptAuthTokensRefresh(12)).rejects.toThrow(
+      "OpenAI refresh failed: 401 refresh_token_invalidated",
+    );
+    expect(deactivateMock).toHaveBeenCalledWith(expect.objectContaining({ id: 12 }), "openai:refresh_token_invalidated");
+  });
+
+  it.each([429, 500, 503])("does not deactivate a token on transient refresh HTTP %s", async (status) => {
+    findOneMock.mockResolvedValue(token(status));
+    vi.stubGlobal("fetch", vi.fn().mockResolvedValue(new Response("upstream failure", { status })));
+    await expect(handleChatgptAuthTokensRefresh(status)).rejects.toThrow(`OpenAI refresh failed: ${status} unknown`);
+    expect(deactivateMock).not.toHaveBeenCalled();
+  });
 });

package/bundle/src/utils/providers/openai/openai-refresh.ts

@@ -1,7 +1,7 @@
 /**
  * OpenAI chatgptAuthTokens refresh handler.
  *
- * - direct HTTPS/WS transport가 401 refresh를 소유하고 저장된 refresh token으로 갱신함
+ * - direct transport와 quota 조회의 401에서 같은 refresh 경로를 사용함
  * - qgrid 가 DB 의 refresh_token 으로 새 access_token 을 발급받아 응답
  * - per-token inflight promise 로 concurrent refresh dedup
  * - rotation 감지: 새 refresh_token 있으면 DB 즉시 업데이트
@@ -104,11 +104,18 @@ async function doRefresh(tokenId: number): Promise<RefreshResult> {
     // 위 3개는 모두 영구 실패. 재등록 외 복구 불가.
     let errorCode: string | undefined;
     try {
-      errorCode = (JSON.parse(body) as { error?: string }).error;
+      const error = (JSON.parse(body) as { error?: unknown }).error;
+      const code =
+        typeof error === "string"
+          ? error
+          : error && typeof error === "object" && "code" in error
+            ? error.code
+            : undefined;
+      if (typeof code === "string" && /^[a-z_]{1,80}$/.test(code)) errorCode = code;
     } catch {}
     logger.error(
       `OpenAI refresh FAILED token=${token.name}(id=${tokenId}) status=${resp.status} ` +
-        `code=${errorCode ?? "?"} body=${body}`,
+        `code=${errorCode ?? "unknown"}`,
     );
     // 영구 실패는 errorCode 로만 판정한다 — status 를 함께 요구하면 provider 가
     // 상태코드를 바꿀 때 판정이 조용히 멎는다.
@@ -118,7 +125,7 @@ async function doRefresh(tokenId: number): Promise<RefreshResult> {
         `openai:${errorCode}`,
       );
     }
-    throw new Error(`OpenAI refresh failed: ${resp.status} ${body}`);
+    throw new Error(`OpenAI refresh failed: ${resp.status} ${errorCode ?? "unknown"}`);
   }
 
   const data = (await resp.json()) as {

package/bundle/src/utils/slack-notify.test.ts

@@ -19,6 +19,20 @@ const noSettings = () => undefined;
 const WORKING_HOURS = seoul("2026-08-05T14:00:00");
 
 describe("notifySlack", () => {
+  it.each([
+    ["not_in_channel", () => Promise.resolve(new Response(JSON.stringify({ ok: false, error: "not_in_channel" })))],
+    ["HTTP 503", () => Promise.resolve(new Response("unavailable", { status: 503 }))],
+    ["network", () => Promise.reject(new Error("private network detail"))],
+  ] as const)("reports %s to manual send callers", async (_name, response) => {
+    vi.spyOn(globalThis, "fetch").mockImplementation(response);
+    await expect(notify({ title: "hello", urgent: true, throwOnFailure: true })).rejects.toThrow("Slack");
+  });
+
+  it("reports missing configuration to manual send callers", async () => {
+    settingMock.mockReturnValue(undefined);
+    await expect(notify({ title: "hello", urgent: true, throwOnFailure: true })).rejects.toThrow("Slack");
+  });
+
   beforeEach(() => {
     settingMock.mockImplementation((key: string) =>
       key === "slack.botToken" ? "xoxb-test" : key === "slack.channelId" ? "C123" : undefined,

package/bundle/src/utils/slack-notify.ts

@@ -15,6 +15,8 @@ const logger = getLogger(["qgrid", "slack"]);
 const SLACK_POST_MESSAGE_URL = "https://slack.com/api/chat.postMessage";
 const SLACK_TIMEOUT_MS = 5_000;
 
+export class SlackNotificationError extends Error {}
+
 /** 상태를 색으로 먼저 읽히게 하는 attachment 색상 바. */
 export const SLACK_COLOR = {
   good: "#2eb886",
@@ -34,6 +36,8 @@ export type SlackNotification = {
    * 커지는 사건에만 쓴다 — 남용하면 조용 시간 자체가 무의미해진다.
    */
   urgent?: boolean;
+  /** Manual sends must report delivery failures; background notifications remain fail-open. */
+  throwOnFailure?: boolean;
   /** 조용 시간 판정 기준 시각. 테스트에서 시계를 고정할 때만 넘긴다. */
   now?: Date;
 };
@@ -47,6 +51,9 @@ export async function notifySlack(
   const { title, subject, context, color, urgent, now } = notification;
   if (!botToken || !channel) {
     logger.debug(`slack not configured, skipping notification: ${title} ${subject ?? ""}`);
+    if (notification.throwOnFailure) {
+      throw new SlackNotificationError("Slack 봇 토큰과 채널 ID를 설정해 주세요");
+    }
     return;
   }
 
@@ -99,10 +106,19 @@ export async function notifySlack(
     // bot 미초대(not_in_channel)·잘못된 채널 등 가장 흔한 오설정은 HTTP 200 + ok:false 로 온다.
     // status 만 보면 조용히 성공 처리돼 알림이 통째로 사라진다.
     const body = (await res.json().catch(() => null)) as { ok?: boolean; error?: string } | null;
-    if (!body?.ok) {
-      logger.warn(`slack notification rejected: ${body?.error ?? `http ${res.status}`}`);
+    if (!res.ok || body?.ok !== true) {
+      const code =
+        typeof body?.error === "string" && /^[a-z_]{1,80}$/.test(body.error)
+          ? body.error
+          : `HTTP ${res.status}`;
+      throw new SlackNotificationError(`Slack 알림 발송 실패: ${code}`);
     }
   } catch (e) {
-    logger.warn(`slack notification failed: ${(e as Error).message}`);
+    const error =
+      e instanceof SlackNotificationError
+        ? e
+        : new SlackNotificationError("Slack 알림 발송 실패: 네트워크 오류 또는 응답 시간 초과");
+    logger.warn(error.message);
+    if (notification.throwOnFailure) throw error;
   }
 }