An invalid or expired Azure DevOps PAT is never reported as AuthFailed and stalls the whole update loop, GitHub polling included

[matt-edmondson]

What's wrong

When Azure DevOps rejects a credential with a 401, the client throws Microsoft.VisualStudio.Services.Common.VssUnauthorizedException. That type derives from VssException, not from VssServiceException. The provider only catches the latter, so this exception gets past both of its handlers:

• EnsureAzureDevOpsClients (BuildMonitor/Providers/AzureDevOps.cs ~L87–100) catches only VssServiceException and UriFormatException. Sessions.Get(...) → CreateSession → connection.GetClient<ProjectHttpClient>() authenticates synchronously, so with a bad PAT it throws VssUnauthorizedException, and that exception escapes EnsureAzureDevOpsClients.
• The 401 handler in MakeAzureDevOpsRequestAsync (~L414), catch (VssServiceResponseException ex) when (ex.HttpStatusCode == Unauthorized), never sees the 401 in this form. OnAuthenticationFailure() is therefore never called.

The remarks in BuildMonitor.Test/AzureDevOpsSessionTests.cs already note that GetClient "throws VssUnauthorizedException" offline, but the provider does not handle it.

Failure scenario

1. The user's ADO PAT expires or is revoked, or they paste a wrong one.
2. UpdateRepositoriesAsync (and UpdateBuildsAsync / UpdateBuildAsync / UpdateRunAsync) throws out of EnsureAzureDevOpsClients. UpdateAsync faults inside its Task.WhenAll and logs "Update loop failed".
3. ProviderRefreshTimer.Restart() and the UpdateBuildsAsync() / UpdateRunsAsync() calls after it are never reached. OnRender starts UpdateAsync again straight away, so the loop runs back-to-back instead of on its interval:
   • discovery re-runs for every provider on every cycle, which burns GitHub rate limit
   • GitHub build and run polling never runs at all
   • a fresh ADO auth attempt is made on every cycle
4. The token is never cleared and the status bar never shows AuthFailed. This lasts until the user notices and fixes the PAT by hand.

How it was verified

• Built against the pinned Microsoft.VisualStudio.Services.Client / Microsoft.TeamFoundationServer.Client 19.225.2.
• typeof(VssUnauthorizedException).BaseType == typeof(VssException), and VssServiceException is not assignable from it.
• new VssConnection(new Uri("https://dev.azure.com/<org>"), new VssBasicCredential("", "bogus")).GetClient<ProjectHttpClient>() throws VssUnauthorizedException: VS30063: You are not authorized… synchronously.

Related

• One persistent GitHub 5xx makes the app re-run discovery and re-poll back-to-back instead of on its interval #299 has the same effect (one exception faults the whole loop), but for GitHub 5xx errors. Hardening UpdateAsync there would limit the damage, but it still would not report the bad PAT as an auth failure.
• Changing Azure DevOps credentials disposes the VssConnection that in-flight requests are still using #298 covers a different ADO exception (ObjectDisposedException after credentials change).

Suggested fix

• Catch VssUnauthorizedException in EnsureAzureDevOpsClients and in MakeAzureDevOpsRequestAsync, and route it to OnAuthenticationFailure() (and to SetStatus(AuthFailed, …) in the first case).
• Consider also catching HttpRequestException in EnsureAzureDevOpsClients. Being offline at startup escapes the same way, though that failure is only transient.

Acceptance criteria

• A test with a session factory that throws VssUnauthorizedException shows that EnsureAzureDevOpsClients returns null, the provider status becomes AuthFailed, and the credentials are cleared.
• With a bad ADO PAT configured, GitHub builds still poll on their normal interval.

[matt-edmondson]

Triage

• Category: Bug
• Priority: High. PATs expire routinely, and one expired PAT faults the whole update loop. When that happens, GitHub polling stops, discovery runs back-to-back and burns rate limit, and the status bar never shows AuthFailed.
• Area / suggested assignee: BuildMonitor/Providers/AzureDevOps.cs (EnsureAzureDevOpsClients, MakeAzureDevOpsRequestAsync). Suggested for the Azure DevOps provider owner (@matt-edmondson).
• Related (not duplicates): One persistent GitHub 5xx makes the app re-run discovery and re-poll back-to-back instead of on its interval #299 has the same loop-faulting effect, triggered by GitHub 5xx errors. Changing Azure DevOps credentials disposes the VssConnection that in-flight requests are still using #298 is a different Azure DevOps exception, thrown after credentials change. Hardening UpdateAsync for One persistent GitHub 5xx makes the app re-run discovery and re-poll back-to-back instead of on its interval #299 would limit the damage here, but it would not make a bad PAT show as AuthFailed, so both fixes are needed.
• In progress: No open PR covers this. Open PRs Build request-outcome test owners through their provider, against an in-memory store #301 and Read tokens as empty when the secret store's type initializer failed #302 touch the secret store and test owners (On Linux without libsecret, every token read throws TypeInitializationException instead of reading as empty #296/GitHubRequestOutcomeTests fail with NullReferenceException on main: #288's tests build an Owner with no BuildProvider after #285 #300), not this path.

Notes: The fix is small: catch VssUnauthorizedException in both places and route it to OnAuthenticationFailure() and SetStatus(AuthFailed, …). It would be worth fixing alongside #299, since together they make the update loop resilient to a single provider failing.

---

Generated by Claude Code