fix: record last_err on get_resource_policy / get_user_by_email failures

Address Copilot review: both methods returned None on an HTTP error without
retaining the failing Response, so a caller could not tell a real HTTP error
from a genuine "no policy" / "no such user" (both None). Record self._last_err
on the non-200 path in each, matching the last_err bookkeeping the rest of this
PR relies on. Also stop logging a plain 404 miss at error level in
get_user_by_email, and drop the raw email address from the error message.

Tests extended to assert last_err is set (and carries the status code) on both
failure paths.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: jr-rk

dspace_rest_client/client.py

@@ -1396,9 +1396,15 @@ def get_resource_policy(self, bundle_uuid):
         """
         url = f'{self.API_ENDPOINT}/authz/resourcepolicies/search/resource?uuid={bundle_uuid}&embed=eperson&embed=group'
         r = self.api_get(url)
+        # record the failing response so a caller can tell an HTTP error apart
+        # from a genuine "no policy" (empty list) result - both return None
+        if r.status_code != 200:
+            self._last_err = r
+            _logger.error(f'Error fetching resource policy [{bundle_uuid}]: {r.status_code}')
+            return None
         r_json = parse_json(r)
-        # guard against a failed request (r_json is None) and against an empty
-        # policy list - both must be a clean None, not a TypeError/IndexError
+        # guard against an unparseable body and against an empty policy list -
+        # both are a clean None, not a TypeError/IndexError
         if r_json and '_embedded' in r_json and 'resourcepolicies' in r_json['_embedded']:
             policies = r_json['_embedded']['resourcepolicies']
             if policies:
@@ -1497,9 +1503,13 @@ def get_user_by_email(self, email):
             response = self.api_get(url, params=params)
             # a miss returns 404 (with a JSON error body): building a User from
             # that yields a truthy, uuid-less object that passes `if user:` and
-            # fails much later. Treat any non-200 as "no such user" -> None.
+            # fails much later. Treat any non-200 as "no such user" -> None, but
+            # record last_err so callers keep the HTTP-error diagnostics, and
+            # don't log a plain 404 miss at error level (nor the raw email).
             if response.status_code != 200:
-                _logger.error(f"No user for email {email}: {response.status_code}")
+                self._last_err = response
+                if response.status_code != 404:
+                    _logger.error(f"Error retrieving user by email: HTTP {response.status_code}")
                 return None
             user_data = parse_json(response)
             if not user_data:

tests/test_clarin_read.py

@@ -61,12 +61,16 @@ def test_empty_list_returns_none(self):
             self.assertIsNone(c.get_resource_policy(BUNDLE_UUID))
 
     @pytest.mark.dtq_only
-    def test_non_200_returns_none(self):
-        """D3: a failed request must be None, not a NoneType subscript crash."""
+    def test_non_200_returns_none_and_records_last_err(self):
+        """D3: a failed request must be None, not a NoneType subscript crash -
+        and last_err is recorded so a caller can tell an HTTP error apart from a
+        genuine empty result (both return None)."""
         c = make_client()
         with requests_mock.Mocker() as m:
             m.get(self.URL, status_code=500, text="upstream boom")
             self.assertIsNone(c.get_resource_policy(BUNDLE_UUID))
+            self.assertIsNotNone(c.last_err)
+            self.assertEqual(c.last_err.status_code, 500)
 
 
 class TestGetBundleByName(unittest.TestCase):
@@ -192,6 +196,9 @@ def test_404_returns_none(self):
             u = c.get_user_by_email("nobody@nowhere")
             self.assertIsNone(u)
             self.assertFalse(bool(u))
+            # the failing response is retained for callers, even for a 404 miss
+            self.assertIsNotNone(c.last_err)
+            self.assertEqual(c.last_err.status_code, 404)
 
 
 class TestGetClarinAllowances(unittest.TestCase):