[RaphaelFakhri]

What does this PR do?

Fixes #261.

When the channel authorization or user authentication endpoint responds with a status of 400 or above, HttpURLConnection.getInputStream() throws (FileNotFoundException for 404, IOException: Server returned HTTP response code: 403 ... for other codes). The response body the server sent is lost, and the status check that follows the read never runs for these codes. The resulting AuthorizationFailureException or AuthenticationFailureException only carries the URL and status, not the reason the server gave.

This change in BaseHttpAuthClient:

• Reads the status code first and reads the body from getErrorStream() for statuses of 400 and above.
• Uses the response body as the exception message, as it already does for other non-2xx statuses.
• Falls back to Server returned HTTP response code: <status> when the error response has no body.

Successful responses are handled as before. New tests in HttpChannelAuthorizerTest and HttpUserAuthenticatorTest start a local HttpServer that returns 403 with a JSON body and check that the exception message is that body. Both tests fail on master and pass with this change.

CHANGELOG

• [FIXED] When the auth endpoint returns a status of 400 or above, the AuthorizationFailureException or AuthenticationFailureException message now contains the response body instead of only the URL (FileNotFoundException thrown when server responds with 400 or above #261).

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 92.30769% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 76.26%. Comparing base (d0a7ea8) to head (e8a9cb4).
⚠️ Report is 30 commits behind head on master.

Files with missing lines	Patch %	Lines
...ava/com/pusher/client/util/BaseHttpAuthClient.java	92.30%	0 Missing and 1 partial ⚠️
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@             Coverage Diff              @@
##             master     #382      +/-   ##
============================================
+ Coverage     74.65%   76.26%   +1.60%     
- Complexity      363      379      +16     
============================================
  Files            48       48              
  Lines          1965     1976      +11     
  Branches        145      151       +6     
============================================
+ Hits           1467     1507      +40     
+ Misses          433      405      -28     
+ Partials         65       64       -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Keith-wright]

Thanks, this looks good, and the response body is the missing piece for debugging auth failures. One request before we merge.

Today, for an error status, the message has the status and URL but not the body:

java.io.IOException: Server returned HTTP response code: 403 for URL: https://example.com/pusher/auth

With this change, it has the body but loses the status and URL:

{"error":"forbidden"}

Could the message keep all three? For example:

Server returned HTTP response code: 403 for URL: https://example.com/pusher/auth: {"error":"forbidden"}

The fallback when the body is empty could include the URL the same way, so the two messages match.

[RaphaelFakhri]

Done in e8a9cb4. The message now keeps the status and URL, and appends the body when there is one:

Server returned HTTP response code: 403 for URL: https://example.com/pusher/auth: {"error":"forbidden"}

With an empty body, it ends after the URL:

Server returned HTTP response code: 403 for URL: https://example.com/pusher/auth

The existing tests now check the full message, and a new test in HttpChannelAuthorizerTest and HttpUserAuthenticatorTest covers the empty-body case. Without the change, those four tests fail. With it, both classes pass (12 tests, JDK 11).

[Keith-wright]

Thanks for the quick turnaround, and for adding the empty-body tests.