Skip to content

Comments

Propagate 403s errors from control plane#401

Open
knjiang wants to merge 2 commits intomainfrom
ken/add-403s
Open

Propagate 403s errors from control plane#401
knjiang wants to merge 2 commits intomainfrom
ken/add-403s

Conversation

@knjiang
Copy link
Contributor

@knjiang knjiang commented Feb 20, 2026

No description provided.

@vercel
Copy link

vercel bot commented Feb 20, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
ai-proxy Ready Ready Preview, Comment Feb 20, 2026 8:18pm

Request Review

@knjiang knjiang changed the title Propagate 403s Propagate 403s errors from control plane Feb 20, 2026
Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1d548a3b61

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +253 to 255
if (response.status === 400 || response.status === 403) {
throw new Error(
`Failed to lookup api key: ${response.status}: ${responseText}`,

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Preserve 403 status when rethrowing lookup failures

This branch now throws a plain Error for /api/secret 403 responses, but EdgeProxyV1 catches all thrown errors and always returns HTTP 400 (packages/proxy/edge/index.ts, around lines 407-410), so the new 403 path is still not actually propagated to clients. In requests with invalid/forbidden Braintrust credentials, callers that rely on receiving 403 will instead see 400, which misclassifies auth failures and can break client-side handling.

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant