From 55538edfa68d07b2cdcfb8710c97d8c124b60144 Mon Sep 17 00:00:00 2001 From: Pigbibi Date: Fri, 9 Oct 2026 16:21:02 +0800 Subject: [PATCH] Log QRS HTTP status and safe error token on AFS sync_rejected. Publish currently collapses every non-200 QRS response into sync_rejected. Print status= and a bounded alphanumeric error= token so the next invoke shows the exact console reject reason without dumping secrets or bodies. --- .github/workflows/invoke-cloud-run.yml | 2 +- application/account_facts_publisher.py | 17 ++++++++++++++++- 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/.github/workflows/invoke-cloud-run.yml b/.github/workflows/invoke-cloud-run.yml index 849b8a7..dc648d9 100644 --- a/.github/workflows/invoke-cloud-run.yml +++ b/.github/workflows/invoke-cloud-run.yml @@ -513,7 +513,7 @@ jobs: if [ "${attempt_seen}" = "true" ]; then if [ "${{ steps.service.outputs.path }}" = "/account-facts-sync" ]; then - filter="resource.type=\"cloud_run_revision\" AND resource.labels.service_name=\"${CLOUD_RUN_SERVICE}\" AND timestamp>=\"${started_at}\" AND (httpRequest.requestUrl:\"/account-facts-sync\" OR textPayload:\"account_facts\" OR textPayload:\"account_facts_sync\" OR textPayload:\"reason=\" OR textPayload:\"exc_type=\" OR textPayload:\"Firstrade\" OR textPayload:\"unauthorized\" OR jsonPayload.message:\"account_facts\")" + filter="resource.type=\"cloud_run_revision\" AND resource.labels.service_name=\"${CLOUD_RUN_SERVICE}\" AND timestamp>=\"${started_at}\" AND (httpRequest.requestUrl:\"/account-facts-sync\" OR textPayload:\"account_facts\" OR textPayload:\"account_facts_sync\" OR textPayload:\"qrs_reject\" OR textPayload:\"reason=\" OR textPayload:\"exc_type=\" OR textPayload:\"Firstrade\" OR textPayload:\"unauthorized\" OR jsonPayload.message:\"account_facts\")" gcloud logging read "${filter}" --project="${GCP_PROJECT_ID}" --limit=40 --format=json > /tmp/afs-logs.json || true python3 - <<'PY' import json diff --git a/application/account_facts_publisher.py b/application/account_facts_publisher.py index 5e24af5..5be61e8 100644 --- a/application/account_facts_publisher.py +++ b/application/account_facts_publisher.py @@ -294,7 +294,22 @@ def publish_firstrade_account_snapshot( ) except Exception: raise AccountFactsPublishError("sync_unavailable") from None - if getattr(response, "status_code", None) != 200: + status_code = getattr(response, "status_code", None) + if status_code != 200: + qrs_error = "" + try: + body = response.json() + except Exception: + body = None + if isinstance(body, dict): + err = body.get("error") + if isinstance(err, str) and 0 < len(err) <= 96 and err.isascii() and err.replace("_", "").isalnum(): + qrs_error = err + # Safe diagnostics only: HTTP status + fixed QRS error token (no body dump). + print( + f"account_facts_sync qrs_reject status={status_code} error={qrs_error or ''}", + flush=True, + ) raise AccountFactsPublishError("sync_rejected") response_body = getattr(response, "content", None) if isinstance(response_body, (bytes, bytearray)) and len(response_body) > 8192: