From ab45ea84ad1fec368455823dc1fd8a7bcaf2a3e6 Mon Sep 17 00:00:00 2001
From: Julian Sommer <115516918+juliansommer@users.noreply.github.com>
Date: Tue, 13 Oct 2026 14:00:41 +1000
Subject: [PATCH] fix(spinifexui): stop logging out on signature errors

SignatureDoesNotMatch and IncompleteSignature no longer clear the session:
clock skew and path rewrites also produce them, so the user was logged out
repeatedly over a request problem.
---
 .../services/spinifexui/frontend/src/lib/auth-error.test.ts | 5 +++--
 spinifex/services/spinifexui/frontend/src/lib/auth-error.ts | 6 ++----
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/spinifex/services/spinifexui/frontend/src/lib/auth-error.test.ts b/spinifex/services/spinifexui/frontend/src/lib/auth-error.test.ts
index b761a1980..af82582fa 100644
--- a/spinifex/services/spinifexui/frontend/src/lib/auth-error.test.ts
+++ b/spinifex/services/spinifexui/frontend/src/lib/auth-error.test.ts
@@ -12,10 +12,8 @@ function sdkError(name: string): Error {
 describe("isStaleCredentialsError", () => {
   const authCodes = [
     "InvalidClientTokenId",
-    "SignatureDoesNotMatch",
     "AuthFailure",
     "MissingAuthenticationToken",
-    "IncompleteSignature",
     "UnrecognizedClientException",
     "ExpiredToken",
     "ExpiredTokenException",
@@ -37,6 +35,9 @@ describe("isStaleCredentialsError", () => {
     ["UnauthorizedOperation denial", sdkError("UnauthorizedOperation")],
     ["ValidationError", sdkError("ValidationError")],
     ["InvalidParameterValue", sdkError("InvalidParameterValue")],
+    // Clock skew and path rewrites also produce these; logging out would loop.
+    ["SignatureDoesNotMatch", sdkError("SignatureDoesNotMatch")],
+    ["IncompleteSignature", sdkError("IncompleteSignature")],
     ["NotFound", sdkError("InvalidInstanceID.NotFound")],
     ["plain Error", new Error("boom")],
     ["network failure", new TypeError("Failed to fetch")],
diff --git a/spinifex/services/spinifexui/frontend/src/lib/auth-error.ts b/spinifex/services/spinifexui/frontend/src/lib/auth-error.ts
index 9f4ed1631..99a19385c 100644
--- a/spinifex/services/spinifexui/frontend/src/lib/auth-error.ts
+++ b/spinifex/services/spinifexui/frontend/src/lib/auth-error.ts
@@ -1,12 +1,10 @@
 // AWS error codes that indicate the credentials themselves are stale or
-// invalid (authentication failures), as opposed to authorization denials
-// (AccessDenied / UnauthorizedOperation) where valid creds lack permission.
+// invalid, as opposed to authorization denials. Signature errors are left out:
+// clock skew and a rewritten request path also cause them.
 const AUTH_ERROR_CODES = new Set([
   "InvalidClientTokenId",
-  "SignatureDoesNotMatch",
   "AuthFailure",
   "MissingAuthenticationToken",
-  "IncompleteSignature",
   "UnrecognizedClientException",
   "ExpiredToken",
   "ExpiredTokenException",