Stop repeated probes when server-type detection fails; keep the HTTP response on errors

[VanDelinea]

What this changes

Server-type detection probes /api/v1/healthcheck and /health without authentication. Building on the detection cache in feature/server-detection, this closes three gaps.

1. Nothing slowed the probes down while an endpoint was down or blocked

Only successful detections were cached. When probing failed, nothing was remembered, so every new authorizer probed again at full rate — adding load to an endpoint that was already refusing traffic. This is the situation reported in ADO 734475: an Ansible run against a Platform tenant whose edge starts returning 403 to the probes.

A failed detection now pauses probing for that base_url: 5 seconds, doubling on repeated failures, capped at 60.

Measured against a local endpoint that rejects every probe, 20 authorizer constructions:

	Probe rounds
Released SDK (2.0.1)	20
This branch	1

The pause is deliberately short-lived — a successful detection clears it, it always expires on its own, clear_server_type_cache() clears it, and passing an explicit server_type skips it entirely. A permanent block would turn a brief outage into a lasting one, which is worse than the extra probes. It shares the existing cache's lock and size limit, so it is not a new source of unbounded growth.

2. Errors hid the HTTP response

SecretServerError accepted a response argument and then discarded it. Callers had no way to tell an expired token (401, worth one retry) from a denial or rate limit (403/429, where retrying makes things worse). The response is now kept on the exception, so callers can classify the failure instead of guessing.

3. Some error bodies crashed instead of raising a normal error

A 4xx response whose body was JSON but not in the expected shape — for example {"error": {...}}, or a bare 123 — left an internal variable unset and raised UnboundLocalError or TypeError from inside process(). That bypassed every except SecretServerError handler in calling code, so users saw a raw traceback instead of a clear failure. All paths now raise a proper error with a usable message.

Tests

13 new tests, 26 total in the detection suite. Existing tests are unchanged and still pass; the pre-existing live-credential tests in tests/test_server.py still require credentials, exactly as before.

New coverage: probe throttling, pause expiry and recovery, backoff growth and cap, a success clearing the pause, size bounding, error wording, server_type bypassing the pause, the response contract, and four malformed-body shapes.

Notes for reviewers

• Base branch is feature/server-detection, not main — this stacks on that work rather than competing with it.
• Point 2 matters for the Ansible collection: without the response, its 403/429 handling cannot run, and it falls back to a more conservative rule.
• Related: ADO 734475.

[snyk-io]

⛔ Snyk checks have failed. 4 issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (4)
⛔	Open Source Security	0	4	0	0	4 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.