Timeout error (aws#5289)

* fix: Treat TimeoutError as a NetworkError

Problem:

When we attempt to refresh an SSO session, we sometimes saw
a TimeoutError in our telemetry as the reason for refresh failure.

Solution:

We treat the TimeoutError as a network error.
See isSocketTimeoutError() docstring for more details.

Signed-off-by: Nikolas Komonen <[email protected]>

* refactor: sso client retry

- After some disccusion with the identity team it may not be necessary
  to retry on InvalidGrant. See comment for more info
- Removed the previous comment regarding other possible exceptions. After
  going through them, their docstrings point to malformed request arguments,
  so retrying probably will not help.
- Reduced requestTimeout so we do not block on very slow responses.

Signed-off-by: Nikolas Komonen <[email protected]>

---------

Signed-off-by: Nikolas Komonen <[email protected]>

Author: nkomonen-amazon

packages/core/src/auth/sso/clients.ts

@@ -102,17 +102,9 @@ export class OidcClient {
                 return true
             }
 
-            // Sessions may "expire" earlier than expected due to network faults.
-            // TODO: add more cases from node_modules/@aws-sdk/client-sso-oidc/dist-types/models/models_0.d.ts
-            // ExpiredTokenException
-            // InternalServerException
-            // InvalidClientException
-            // InvalidRequestException
-            // SlowDownException
-            // UnsupportedGrantTypeException
-            // InvalidRequestRegionException
-            // InvalidRedirectUriException
-            // InvalidRedirectUriException
+            // As part of SIM IDE-10703, there was an assumption that retrying on InvalidGrantException
+            // may be useful. This may not be the case anymore and if more research is done, this may not be needed.
+            // TODO: setup some telemetry to see if there are any successes on a subsequent retry for this case.
             return err.name === 'InvalidGrantException'
         }
         const client = new SSOOIDC({
@@ -124,7 +116,9 @@ export class OidcClient {
             ),
             customUserAgent: getUserAgent({ includePlatform: true, includeClientId: true }),
             requestHandler: {
-                requestTimeout: 30_000,
+                // This field may have a bug: https://github.com/aws/aws-sdk-js-v3/issues/6271
+                // If the bug is real but is fixed, then we can probably remove this field and just have no timeout by default
+                requestTimeout: 5000,
             },
         })
 

packages/core/src/shared/errors.ts

@@ -768,7 +768,11 @@ export class PermissionsError extends ToolkitError {
 }
 
 export function isNetworkError(err?: unknown): err is Error & { code: string } {
-    if (isVSCodeProxyError(err)) {
+    if (!(err instanceof Error)) {
+        return false
+    }
+
+    if (isVSCodeProxyError(err) || isSocketTimeoutError(err)) {
         return true
     }
 
@@ -798,10 +802,18 @@ export function isNetworkError(err?: unknown): err is Error & { code: string } {
  *
  * Setting ID: http.proxy
  */
-function isVSCodeProxyError(err?: unknown): boolean {
-    if (!(err instanceof Error)) {
-        return false
-    }
-
+function isVSCodeProxyError(err: Error): boolean {
     return err.name === 'Error' && err.message.startsWith('Failed to establish a socket connection to proxies')
 }
+
+/**
+ * When making SSO OIDC calls, we were seeing errors in telemetry and narrowing it down brings us to:
+ * https://github.com/smithy-lang/smithy-typescript/blob/6aac850af4b5b07b3941854d21e3b0158aefcacb/packages/node-http-handler/src/set-socket-timeout.ts#L7
+ * This looks to be thrown during http requests, so we'll consider it a network error.
+ *
+ * The scenario where we are actually getting the error though might actually be a bug:
+ * https://github.com/aws/aws-sdk-js-v3/issues/6271
+ */
+function isSocketTimeoutError(err: Error): boolean {
+    return err.name === 'TimeoutError' && err.message.includes('Connection timed out after')
+}