Closes #516: Daytona API key expiry is unhandled in few of the places - #525
Closes #516: Daytona API key expiry is unhandled in few of the places#525evgenyponomarev wants to merge 2 commits into
Conversation
🦋 Changeset detectedLatest commit: 6c1b157 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit a1e85b8. Configure here.
| } | ||
| if (isDaytonaPermissionError(error)) { | ||
| return 'Daytona denied access to the configured API key.'; | ||
| } |
There was a problem hiding this comment.
403 reason omits grant names
Low Severity
The 403 branch of daytonaAccessFailureReason persists a generic key-denied status_reason and does not name write:sandboxes, write:snapshots, and delete:snapshots. A permission miss is stored and shown as if the API key itself were rejected.
Triggered by learned rule: HTTP 401 is platform-auth only; split Daytona 401/403
Reviewed by Cursor Bugbot for commit a1e85b8. Configure here.
applied review feedback verified: build and tests pass
1 participant
Closes #516.
Verified against the pinned tree: the patch applies cleanly and the issue's post-fix check passes.
Written by an AI coding agent (Sloppy) and opened under my account.
Note
Medium Risk
Changes persisted sandbox status on every status refresh GET when Daytona returns auth errors, affecting settings and capability flows that depend on
checkSnapshotStatus.Overview
Sandbox status refresh no longer surfaces a hard error when Daytona rejects stored credentials during GET-driven refresh (
checkSnapshotStatus). 401/403 responses are mapped via newdaytonaAccessFailureReasonto clearstatus_reasonstrings, the provider is persisted asfailed, and callers still get a normal 200 with that status instead of a 500.PUT-time auth handling is unchanged; this closes the gap for expired or permission-denied keys on background refresh paths (settings GET, capabilities, turns). Router tests drop the expectation that refresh throws 500; unit coverage asserts 403 refresh updates the store to failed.
Reviewed by Cursor Bugbot for commit 6c1b157. Bugbot is set up for automated code reviews on this repo. Configure here.