fix(http): stop labeling resource-endpoint 400s as credential errors

[asachs01]

Summary

• Fixes 400 responses from non-token endpoints are mislabeled as credential errors #78 — a 400 from a resource endpoint (e.g. POST /Actions) was thrown as HaloPsaAuthenticationError with the message "Bad request - invalid credentials or parameters", even though skipAuth is never true outside HttpClient (the OAuth token endpoint is fetched directly by AuthManager, never through HttpClient), so every 400 reaching that branch is from an already-authenticated resource call — a bad token fails as 401, not 400.
• Added HaloPsaBadRequestError for this case; the message now names the endpoint and says nothing about credentials. HaloPsaAuthenticationError keeps its 401 role plus the token endpoint's own legitimate 400 (unaffected — that's thrown separately in auth.ts).
• We hit this in production via halopsa-mcp: a POST /Actions call missing outcome (not marked required in ActionCreateData, though HaloPSA's server apparently wants it) surfaced as an "invalid credentials" error and sent a customer down a permissions-troubleshooting path for a plain payload validation issue.

Test plan

• New unit tests: a non-validation-shaped 400 → HaloPsaBadRequestError, not HaloPsaAuthenticationError, message has no "credentials" wording; a validation-shaped 400 still → HaloPsaValidationError (was previously untested)
• Full suite: npm test — 271/271 passing
• npm run lint — clean
• npm run build — clean

🤖 Generated with Claude Code

https://claude.ai/code/session_01JgXg1NhHo6DvvAqoPowppi

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• Bug Fixes

  • Corrected handling of HTTP 400 responses so resource-request errors are no longer incorrectly reported as authentication failures.
  • Validation-related 400 responses continue to be reported as validation errors.

• New Features

  • Added the public HaloPsaBadRequestError for unrecognized or malformed resource-request responses, including relevant request details.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 206fcf21-219e-4357-b5c8-5d8842f935da

📥 Commits

Reviewing files that changed from the base of the PR and between e5b8e97 and 6bbbff2.

📒 Files selected for processing (4)

• src/errors.ts
• src/http.ts
• src/index.ts
• tests/unit/http.test.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The HTTP client now classifies non-validation 400 responses from resource endpoints as HaloPsaBadRequestError. Authentication errors remain associated with 401 responses and OAuth token endpoint 400 responses. Validation-shaped 400 responses remain HaloPsaValidationError.

Changes

Resource 400 error handling

Layer / File(s)	Summary
Bad request error contract and export src/errors.ts, src/index.ts	Adds the public HaloPsaBadRequestError class and exports it. Authentication documentation now distinguishes OAuth token endpoint 400 responses from resource endpoint 400 responses.
HTTP 400 classification and regression coverage src/http.ts, tests/unit/http.test.ts	Resource-level 400 responses without recognized validation fields now raise HaloPsaBadRequestError. Validation-shaped 400 responses continue to raise HaloPsaValidationError with parsed details.

Estimated code review effort: 2 (Simple) | ~15 minutes

Merge Risk: ⚪ Minimal · up to 6bbbf

Resource-endpoint 400 responses now use a neutral bad-request error while validation and authentication handling remain distinct. The updated behavior and regression coverage are ready to merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: resource-endpoint 400 responses no longer receive credential-error classification.
Linked Issues check	✅ Passed	The changes satisfy issue #78. Non-validation-shaped 400 responses from resource endpoints now use HaloPsaBadRequestError, while validation-shaped responses remain HaloPsaValidationError. Token-endpoi…
Out of Scope Changes check	✅ Passed	The added error class, public export, HTTP classification changes, and regression tests directly support the linked issue and stated objectives. No unrelated changes are identified.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 4…

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/400-bad-request-not-auth-error

---

_{Comment @coderabbitai help to get the list of available commands.}