fix: repair pool credential handling and connection selection

backend/src/errors/mod.rs

@@ -88,6 +88,11 @@ pub enum AppError {
     #[error("Bad request: {0}")]
     BadRequest(String),
 
+    /// Known unusable stored credential, distinct from malformed requests or
+    /// infrastructure failures. Keep the established public bad-request contract.
+    #[error("Bad request: {0}")]
+    CredentialUnavailable(String),
+
     #[error("{context} request body exceeds the configured limit of {max_bytes} bytes")]
     RequestBodyTooLarge { max_bytes: usize, context: String },
 
@@ -708,7 +713,9 @@ pub enum AppError {
 impl AppError {
     fn status_code(&self) -> StatusCode {
         match self {
-            Self::BadRequest(_) | Self::ValidationError(_) => StatusCode::BAD_REQUEST,
+            Self::BadRequest(_) | Self::CredentialUnavailable(_) | Self::ValidationError(_) => {
+                StatusCode::BAD_REQUEST
+            }
             Self::RequestBodyTooLarge { .. } => StatusCode::PAYLOAD_TOO_LARGE,
             Self::Unauthorized(_) | Self::AuthenticationFailed(_) | Self::TokenExpired => {
                 StatusCode::UNAUTHORIZED
@@ -919,7 +926,7 @@ impl AppError {
 
     pub(crate) fn error_code(&self) -> u32 {
         match self {
-            Self::BadRequest(_) => 1000,
+            Self::BadRequest(_) | Self::CredentialUnavailable(_) => 1000,
             Self::RequestBodyTooLarge { .. } => 11700,
             Self::Unauthorized(_) => 1001,
             Self::Forbidden(_) => 1002,
@@ -1168,7 +1175,7 @@ impl AppError {
 
     pub(crate) fn error_key(&self) -> &str {
         match self {
-            Self::BadRequest(_) => "bad_request",
+            Self::BadRequest(_) | Self::CredentialUnavailable(_) => "bad_request",
             Self::RequestBodyTooLarge { .. } => "request_body_too_large",
             Self::Unauthorized(_) => "unauthorized",
             Self::Forbidden(_) => "forbidden",
@@ -1501,6 +1508,23 @@ mod tests {
         assert!(payload["message"].as_str().unwrap().contains("2048 bytes"));
     }
 
+    #[tokio::test]
+    async fn credential_unavailable_preserves_bad_request_wire_contract() {
+        let error = AppError::CredentialUnavailable("API key is failed".into());
+        assert_eq!(error.oauth_error_code(), "invalid_request");
+        let response = error.into_response();
+        assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+        let payload: Value =
+            serde_json::from_slice(&to_bytes(response.into_body(), 4096).await.unwrap()).unwrap();
+        let previous =
+            serde_json::to_value(AppError::BadRequest("API key is failed".into()).response_body())
+                .unwrap();
+        assert_eq!(payload, previous);
+        assert_eq!(payload["error_code"], 1000);
+        assert_eq!(payload["error"], "bad_request");
+        assert_eq!(payload["message"], "Bad request: API key is failed");
+    }
+
     #[test]
     fn status_codes() {
         assert_eq!(

backend/src/handlers/proxy.rs

@@ -46,7 +46,7 @@ use crate::telemetry::{TelemetryContext, TelemetryEvent, emit_event};
 /// the `return Err(...)` sites in this file.
 fn proxy_error_telemetry_fields(err: &AppError) -> (u16, u32) {
     match err {
-        AppError::BadRequest(_) => (400, 1000),
+        AppError::BadRequest(_) | AppError::CredentialUnavailable(_) => (400, 1000),
         AppError::Unauthorized(_) => (401, 1001),
         AppError::Forbidden(_) => (403, 1002),
         AppError::NotFound(_) => (404, 1003),
@@ -9430,7 +9430,12 @@ mod tests {
     fn proxy_error_telemetry_fields_maps_common_errors() {
         use super::proxy_error_telemetry_fields;
         use crate::errors::AppError;
-
+        assert_eq!(
+            proxy_error_telemetry_fields(&AppError::CredentialUnavailable(
+                "API key is failed".into()
+            )),
+            (400, 1000),
+        );
         assert_eq!(
             proxy_error_telemetry_fields(&AppError::BadRequest("x".into())),
             (400, 1000)