fix(auth): improve IdC connection lifespan #3501

Problem:
Networking issues cause connections to appear invalidated because we can't refresh the access token.
But the refresh token may still be valid.

Solution:
Assume that the connection is still valid if we see a networking issue.
Callers will receive an exception when attempting to fetch a token without an internet connection.

Author: JadenSimon

.changes/next-release/Bug Fix-2679f992-963a-454e-b2a4-1f8a61e9c5ed.json

@@ -0,0 +1,4 @@
+{
+	"type": "Bug Fix",
+	"description": "auth: IAM Identity Center connections expire sooner than expected"
+}

src/credentials/auth.ts

@@ -18,7 +18,7 @@ import { Commands } from '../shared/vscode/commands2'
 import { createQuickPick, DataQuickPickItem, showQuickPick } from '../shared/ui/pickerPrompter'
 import { isValidResponse } from '../shared/wizards/wizard'
 import { CancellationError, Timeout } from '../shared/utilities/timeoutUtils'
-import { errorCode, formatError, isAwsError, ToolkitError, UnknownError } from '../shared/errors'
+import { errorCode, formatError, isAwsError, isNetworkError, ToolkitError, UnknownError } from '../shared/errors'
 import { getCache } from './sso/cache'
 import { createFactoryFunction, isNonNullable, Mutable } from '../shared/utilities/tsUtils'
 import { builderIdStartUrl, SsoToken } from './sso/model'
@@ -877,6 +877,13 @@ export class Auth implements AuthService, ConnectionManager {
     private readonly getToken = keyedDebounce(this._getToken.bind(this))
     private async _getToken(id: Connection['id'], provider: SsoAccessTokenProvider): Promise<SsoToken> {
         const token = await provider.getToken().catch(err => {
+            // Bubble-up networking issues so we don't treat the session as invalid
+            if (isNetworkError(err)) {
+                throw new ToolkitError('Failed to refresh connection due to networking issues', {
+                    cause: err,
+                })
+            }
+
             this.#validationErrors.set(id, err)
         })
 

src/credentials/sso/ssoAccessTokenProvider.ts

@@ -15,7 +15,14 @@ import { hasProps, hasStringProps, RequiredProps, selectFrom } from '../../share
 import { CancellationError, sleep } from '../../shared/utilities/timeoutUtils'
 import { OidcClient } from './clients'
 import { loadOr } from '../../shared/utilities/cacheUtils'
-import { getRequestId, getTelemetryReason, getTelemetryResult, isClientFault, ToolkitError } from '../../shared/errors'
+import {
+    getRequestId,
+    getTelemetryReason,
+    getTelemetryResult,
+    isClientFault,
+    isNetworkError,
+    ToolkitError,
+} from '../../shared/errors'
 import { getLogger } from '../../shared/logger'
 import { AwsRefreshCredentials, telemetry } from '../../shared/telemetry/telemetry'
 import { getIdeProperties, isCloud9 } from '../../shared/extensionUtilities'
@@ -123,17 +130,19 @@ export class SsoAccessTokenProvider {
 
             return refreshed
         } catch (err) {
-            telemetry.aws_refreshCredentials.emit({
-                result: getTelemetryResult(err),
-                reason: getTelemetryReason(err),
-                requestId: getRequestId(err),
-                sessionDuration: getSessionDuration(this.tokenCacheKey),
-                credentialType: 'bearerToken',
-                credentialSourceId: this.profile.startUrl === builderIdStartUrl ? 'awsId' : 'iamIdentityCenter',
-            } as AwsRefreshCredentials)
-
-            if (err instanceof SSOOIDCServiceException && isClientFault(err)) {
-                await this.cache.token.clear(this.tokenCacheKey)
+            if (!isNetworkError(err)) {
+                telemetry.aws_refreshCredentials.emit({
+                    result: getTelemetryResult(err),
+                    reason: getTelemetryReason(err),
+                    requestId: getRequestId(err),
+                    sessionDuration: getSessionDuration(this.tokenCacheKey),
+                    credentialType: 'bearerToken',
+                    credentialSourceId: this.profile.startUrl === builderIdStartUrl ? 'awsId' : 'iamIdentityCenter',
+                } as AwsRefreshCredentials)
+
+                if (err instanceof SSOOIDCServiceException && isClientFault(err)) {
+                    await this.cache.token.clear(this.tokenCacheKey)
+                }
             }
 
             throw err

src/shared/errors.ts

@@ -9,7 +9,7 @@ import { ServiceException } from '@aws-sdk/smithy-client'
 import { isThrottlingError, isTransientError } from '@aws-sdk/service-error-classification'
 import { Result } from './telemetry/telemetry'
 import { CancellationError } from './utilities/timeoutUtils'
-import { hasKey, isNonNullable } from './utilities/tsUtils'
+import { isNonNullable } from './utilities/tsUtils'
 import type * as fs from 'fs'
 import type * as os from 'os'
 
@@ -371,7 +371,7 @@ export function isAwsError(error: unknown): error is AWSError {
     return error instanceof Error && hasCode(error) && hasTime(error)
 }
 
-function hasCode(error: Error): error is typeof error & { code: string } {
+function hasCode<T>(error: T): error is T & { code: string } {
     return typeof (error as { code?: unknown }).code === 'string'
 }
 
@@ -403,7 +403,7 @@ export function getRequestId(error: unknown): string | undefined {
 export function isFileNotFoundError(err: unknown): boolean {
     if (err instanceof vscode.FileSystemError) {
         return err.code === vscode.FileSystemError.FileNotFound().code
-    } else if (isNonNullable(err) && typeof err === 'object' && hasKey(err, 'code')) {
+    } else if (hasCode(err)) {
         return err.code === 'ENOENT'
     }
 
@@ -417,7 +417,7 @@ export function isNoPermissionsError(err: unknown): boolean {
             // The code _should_ be `NoPermissions`, maybe this is a bug?
             (err.code === 'Unknown' && err.message.includes('EACCES: permission denied'))
         )
-    } else if (isNonNullable(err) && typeof err === 'object' && hasKey(err, 'code')) {
+    } else if (hasCode(err)) {
         return err.code === 'EACCES'
     }
 
@@ -494,3 +494,11 @@ export class PermissionsError extends ToolkitError {
         this.actual = actual
     }
 }
+
+export function isNetworkError(err?: unknown) {
+    if (!hasCode(err)) {
+        return false
+    }
+
+    return ['ENOTFOUND', 'EAI_AGAIN', 'ECONNRESET', 'ECONNREFUSED', 'ETIMEDOUT'].includes(err.code)
+}

src/test/credentials/auth.test.ts

@@ -236,6 +236,16 @@ describe('Auth', function () {
             assert.ok(err2 instanceof ToolkitError)
             assert.strictEqual(err2.cause, err1)
         })
+
+        it('bubbles up networking issues instead of invalidating the connection', async function () {
+            const expected = new ToolkitError('test', { code: 'ETIMEDOUT' })
+            const conn = await auth.createConnection(ssoProfile)
+            auth.getTestTokenProvider(conn)?.getToken.rejects(expected)
+            const actual = await conn.getToken().catch(e => e)
+            assert.ok(actual instanceof ToolkitError)
+            assert.strictEqual(actual.cause, expected)
+            assert.strictEqual(auth.getConnectionState(conn), 'valid')
+        })
     })
 
     describe('Linked Connections', function () {