fix(backend): return 401 for expired tokens in ValidateProjectContext #599
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
ValidateProjectContextmiddlewareValidateProjectContextresponse paths (401 expired, 401 no token, 403 denied, 500 server error, 400 invalid name, 200 allowed)Context
When runner pods have long-running sessions, their ServiceAccount tokens can expire. The K8s API returns
Unauthorizedon the SSAR call, but the middleware was catching all errors as a generic 500. This prevents the runner from detecting token expiration and refreshing.Replaces #446 which was 112 commits behind main and included unrelated changes.
Note: The operator/runner-side token volume mount and reload logic from #446 still needs to be re-implemented against current main (the
runner-shellcomponent was removed). Filed as a separate concern.Fixes #445
Test plan
ValidateProjectContextunit tests passgofmt,go vetclean🤖 Generated with Claude Code