fix(auth): preserve scope response on refresh failure

steipete · steipete · commit ac67db3a4dc4 · 2026-07-01T14:31:29.000+01:00
diff --git a/internal/googleapi/transport.go b/internal/googleapi/transport.go
@@ -150,12 +150,14 @@ func (t *RetryTransport) RoundTrip(req *http.Request) (*http.Response, error) {
 			if insufficientScopes {
 				slog.Debug("insufficient scopes response, refreshing auth token and retrying")
 
-				drainAndClose(resp.Body)
-
 				if err := t.RefreshAuth(req.Context()); err != nil {
-					return nil, fmt.Errorf("refresh auth after insufficient scopes response: %w", err)
+					slog.Debug("could not refresh auth after insufficient scopes response", "err", err)
+
+					return resp, nil
 				}
 
+				drainAndClose(resp.Body)
+
 				retriedAuth = true
 
 				continue
diff --git a/internal/googleapi/transport_more_test.go b/internal/googleapi/transport_more_test.go
@@ -15,7 +15,10 @@ import (
 
 type roundTripFunc func(*http.Request) (*http.Response, error)
 
-var errUnexpectedRequestBody = errors.New("unexpected request body")
+var (
+	errUnexpectedRequestBody = errors.New("unexpected request body")
+	errRefreshFailed         = errors.New("refresh failed")
+)
 
 func (f roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
 	return f(req)
@@ -300,6 +303,59 @@ func TestRetryTransportRefreshesAuthOnceForInsufficientScope403(t *testing.T) {
 	}
 }
 
+func TestRetryTransportPreservesInsufficientScope403WhenAuthRefreshFails(t *testing.T) {
+	const body = `{"error":{"errors":[{"reason":"insufficientPermissions"}],"message":"Insufficient Permission","code":403}}`
+
+	refreshes := 0
+	calls := 0
+	base := roundTripFunc(func(req *http.Request) (*http.Response, error) {
+		calls++
+
+		return newTestResponse(http.StatusForbidden, body), nil
+	})
+
+	rt := &RetryTransport{
+		Base: base,
+		RefreshAuth: func(context.Context) error {
+			refreshes++
+
+			return errRefreshFailed
+		},
+	}
+
+	req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, "http://example.com", nil)
+	if err != nil {
+		t.Fatalf("new request: %v", err)
+	}
+
+	resp, err := rt.RoundTrip(req)
+	if err != nil {
+		t.Fatalf("round trip: %v", err)
+	}
+
+	gotBody, err := io.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatalf("read response body: %v", err)
+	}
+	_ = resp.Body.Close()
+
+	if resp.StatusCode != http.StatusForbidden {
+		t.Fatalf("status = %d, want %d", resp.StatusCode, http.StatusForbidden)
+	}
+
+	if string(gotBody) != body {
+		t.Fatalf("response body = %q, want %q", gotBody, body)
+	}
+
+	if calls != 1 {
+		t.Fatalf("calls = %d, want 1", calls)
+	}
+
+	if refreshes != 1 {
+		t.Fatalf("refreshes = %d, want 1", refreshes)
+	}
+}
+
 func TestRetryTransportDoesNotRefreshAuthForOrdinary403(t *testing.T) {
 	refreshes := 0
 	calls := 0
