Take AWS error message only if details exists in refreshToken failure (#4611)

Author: wularr

.changes/next-release/bugfix-0a41e319-c7eb-413f-b43f-367b3d6379c1.json

@@ -0,0 +1,4 @@
+{
+  "type" : "bugfix",
+  "description" : "Fix refresh token failure due to null aws error details"
+}

plugins/core/jetbrains-community/src/software/aws/toolkits/jetbrains/core/credentials/sso/SsoAccessTokenProvider.kt

@@ -406,7 +406,7 @@ class SsoAccessTokenProvider(
                 else -> null
             }
             val message = when (e) {
-                is AwsServiceException -> e.awsErrorDetails().errorMessage()
+                is AwsServiceException -> e.awsErrorDetails()?.errorMessage() ?: "Unknown error"
                 else -> e.message ?: "Unknown error"
             }
             sendFailedRefreshCredentialsMetricIfNeeded(

plugins/core/jetbrains-community/tst/software/aws/toolkits/jetbrains/core/credentials/sso/SsoAccessTokenProviderTest.kt

@@ -24,6 +24,7 @@ import org.mockito.kotlin.mock
 import org.mockito.kotlin.stub
 import org.mockito.kotlin.times
 import org.mockito.kotlin.verify
+import software.amazon.awssdk.awscore.exception.AwsServiceException
 import software.amazon.awssdk.services.ssooidc.SsoOidcClient
 import software.amazon.awssdk.services.ssooidc.model.AuthorizationPendingException
 import software.amazon.awssdk.services.ssooidc.model.CreateTokenRequest
@@ -300,6 +301,31 @@ class SsoAccessTokenProviderTest {
         verify(ssoCache).saveAccessToken(argThat<DeviceGrantAccessTokenCacheKey> { startUrl == ssoUrl }, eq(refreshedToken))
     }
 
+    @Test
+    fun `refresh access token error handling does not fail if AWS error details are missing`() {
+        val expirationClientRegistration = clock.instant().plusSeconds(120)
+        setupCacheStub(expirationClientRegistration)
+
+        val accessToken = DeviceAuthorizationGrantToken(ssoUrl, ssoRegion, "dummyToken", "refreshToken", clock.instant())
+        ssoCache.stub {
+            on(
+                ssoCache.loadAccessToken(argThat<DeviceGrantAccessTokenCacheKey> { startUrl == ssoUrl })
+            ).thenReturn(
+                accessToken
+            )
+        }
+
+        ssoOidcClient.stub {
+            on(
+                ssoOidcClient.createToken(refreshTokenRequest())
+            )
+                .thenThrow(AwsServiceException.builder().build())
+        }
+
+        assertThatThrownBy { runBlocking { sut.refreshToken(sut.accessToken()) } }
+            .isInstanceOf(AwsServiceException::class.java)
+    }
+
     @Test
     fun `PKCE refresh access token saves PKCE token`() {
         setPkceTrue()