Fix Octopus Direct: refresh JWT on HTTP 401/403 (intelligent go slots)

[Copilot]

When the Octopus API returns a bare HTTP 401/403 (no GraphQL body), async_graphql_query would silently return None without refreshing the JWT. The existing refresh logic only triggered on Kraken GraphQL error codes in the response body — a transport-level auth failure bypassed it entirely, causing every subsequent poll (e.g. intelligent go dispatch slots) to fail identically until an add-on restart.

Changes

• octopus.py — async_graphql_query: Check response.status for 401/403 before reading the body. On the first attempt, clear the token, force a refresh, and retry once — mirroring the existing GraphQL-body error-code path:

if response.status in [401, 403] and _retry_count == 0:
    self.graphql_token = None
    retry_token = await self.async_refresh_token()
    if retry_token is None:
        ...
        return None
    return await self.async_graphql_query(..., _retry_count=1, ...)

• test_octopus_rate_limit.py: Added Tests 10 and 10b covering the HTTP-status-level auth-error path (both 401 and 403 trigger refresh+retry; failed refresh returns None and increments failures_total). Also moved the test summary block outside the for/else so it covers all tests.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• gitlab.com
  • Triggering command: /usr/lib/git-core/git-remote-https /usr/lib/git-core/git-remote-https origin REDACTED (dns block)
• https://api.github.com/repos/springfall2008/batpred/contents/apps/predbat
  • Triggering command: /home/REDACTED/work/batpred/batpred/coverage/venv/bin/python3 python3 ../apps/predbat/unit_test.py --test octopus_rate_limit (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

Fixes Octopus Direct GraphQL polling getting stuck after transport-level auth failures by refreshing the JWT on bare HTTP 401/403 responses and retrying once.

Changes:

• Update OctopusAPI.async_graphql_query to detect HTTP 401/403 before reading/parsing the response body, then force token refresh + single retry.
• Add regression tests covering the new HTTP-status auth failure path (401 and 403) and the “refresh fails” case; adjust test summary placement to always run.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
apps/predbat/octopus.py	Adds HTTP-status-level auth failure handling (401/403) with forced refresh + single retry in async_graphql_query.
apps/predbat/tests/test_octopus_rate_limit.py	Adds new tests (10/10b) for 401/403 refresh+retry behavior and ensures the summary executes for all outcomes.

[Copilot]

The new 401/403 retry path awaits the recursive retry call while still inside the async with client.post(...) as response: block. That means the original response isn't released back to the aiohttp connection pool until after the retry finishes, which can temporarily tie up a connection slot (and can become problematic if connector limits are low). Consider releasing/closing the response (or deferring the retry until after the async with exits) before awaiting the retry request.