fix(oracle-fusion): classify rejected redirects

Author: BillLeoutsakosvl346

apps/sim/lib/internal/oracle-fusion/client.test.ts

@@ -166,6 +166,17 @@ describe('requestOracleFusionJson', () => {
     expect(String(error)).not.toContain(BASIC)
   })
 
+  it('classifies redirects rejected by the pinned transport without exposing details', async () => {
+    mockSecureFetch.mockRejectedValueOnce(new Error('Too many redirects (max: 0)'))
+    const error = await requestOracleFusionJson(CREDENTIAL, {
+      family: 'hcm',
+      path: 'workers',
+    }).catch((caught: unknown) => caught)
+    expect(error).toMatchObject({ message: 'Oracle Fusion returned a redirect', status: 502 })
+    expect(String(error)).not.toContain(ORIGIN)
+    expect(String(error)).not.toContain(BASIC)
+  })
+
   it('preserves unsafe integral JSON tokens as decimal strings', async () => {
     mockSecureFetch.mockResolvedValueOnce(
       response(

apps/sim/lib/internal/oracle-fusion/client.ts

@@ -185,6 +185,11 @@ function statusMessage(status: number): string {
   return `Oracle Fusion request failed with HTTP ${status}`
 }
 
+/** `maxRedirects: 0` rejects a response with Location before returning its status. */
+function isRejectedRedirect(error: unknown): boolean {
+  return error instanceof Error && error.message === 'Too many redirects (max: 0)'
+}
+
 /** Executes one bounded, DNS-pinned GET against a fixed Oracle product API family. */
 export async function requestOracleFusionJson(
   credential: OracleFusionResolvedCredential,
@@ -220,6 +225,9 @@ export async function requestOracleFusionJson(
       response = await fetchAttempt(url, validation.resolvedIP, credential.accessToken, signal)
     } catch (error) {
       signal?.throwIfAborted()
+      if (isRejectedRedirect(error)) {
+        throw new OracleFusionProviderError('Oracle Fusion returned a redirect', 502)
+      }
       if (isPayloadSizeLimitError(error)) {
         throw new OracleFusionProviderError('Oracle Fusion response exceeded 5 MiB', 502)
       }