fix(spinifexui): stop logging out on signature errors

SignatureDoesNotMatch and IncompleteSignature no longer clear the session:
clock skew and path rewrites also produce them, so the user was logged out
repeatedly over a request problem.

spinifex/services/spinifexui/frontend/src/lib/auth-error.test.ts

@@ -12,10 +12,8 @@ function sdkError(name: string): Error {
 describe("isStaleCredentialsError", () => {
   const authCodes = [
     "InvalidClientTokenId",
-    "SignatureDoesNotMatch",
     "AuthFailure",
     "MissingAuthenticationToken",
-    "IncompleteSignature",
     "UnrecognizedClientException",
     "ExpiredToken",
     "ExpiredTokenException",
@@ -37,6 +35,9 @@ describe("isStaleCredentialsError", () => {
     ["UnauthorizedOperation denial", sdkError("UnauthorizedOperation")],
     ["ValidationError", sdkError("ValidationError")],
     ["InvalidParameterValue", sdkError("InvalidParameterValue")],
+    // Clock skew and path rewrites also produce these; logging out would loop.
+    ["SignatureDoesNotMatch", sdkError("SignatureDoesNotMatch")],
+    ["IncompleteSignature", sdkError("IncompleteSignature")],
     ["NotFound", sdkError("InvalidInstanceID.NotFound")],
     ["plain Error", new Error("boom")],
     ["network failure", new TypeError("Failed to fetch")],

spinifex/services/spinifexui/frontend/src/lib/auth-error.ts

@@ -1,12 +1,10 @@
 // AWS error codes that indicate the credentials themselves are stale or
-// invalid (authentication failures), as opposed to authorization denials
-// (AccessDenied / UnauthorizedOperation) where valid creds lack permission.
+// invalid, as opposed to authorization denials. Signature errors are left out:
+// clock skew and a rewritten request path also cause them.
 const AUTH_ERROR_CODES = new Set([
   "InvalidClientTokenId",
-  "SignatureDoesNotMatch",
   "AuthFailure",
   "MissingAuthenticationToken",
-  "IncompleteSignature",
   "UnrecognizedClientException",
   "ExpiredToken",
   "ExpiredTokenException",