Skip to content

feat(client-contract): add client codes for unsafe keys, headers, base URLs, transport and oversized bodies - #16

Merged
jm-rivera merged 1 commit into
devfrom
feat/client-codes-hardening
Oct 23, 2026
Merged

jm-rivera merged 1 commit into
devfrom
feat/client-codes-hardening

Conversation

@jm-rivera

Copy link
Copy Markdown
Contributor

The SDK clients are about to refuse several inputs and responses they accept today: a key holding characters outside visible ASCII, a header value holding a control character, a base URL that is empty, not absolute http(s) or carries userinfo, a key that would travel over plain http to a host that is not loopback, a credentials file that exists but cannot be read, and a decoded response body past its size cap. client-codes.json gains a row for each, so both clients raise them under a precise code: key_invalid and credentials_file_unreadable (AuthenticationError), header_invalid, insecure_transport and base_url_invalid (InvalidRequestError), and response_too_large (ServerError). None is retryable. The README's client-codes paragraph names them, and the CHANGELOG counts 23 codes.

Testing: uv run tools/validate_client_contract.py reports 23 client codes and a valid contract, tools/tests gives 517 passed, and python/client-contract gives 78 passed with ruff and ty clean.

…e URLs, transport and oversized bodies

key_invalid, credentials_file_unreadable, header_invalid, insecure_transport, base_url_invalid and response_too_large let the clients refuse an unsafe key, header value or base URL, a key over plain http to a remote host, an unreadable credentials file and a decoded body past its cap, each under its own code. None is retryable.
@jm-rivera
jm-rivera merged commit d8a8271 into dev Oct 23, 2026
19 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant