mirror of
https://github.com/QuantumNous/new-api.git
synced 2026-09-07 10:07:07 +00:00
CaIon
1721144221
When the dashboard token refresh endpoint returned 429 (shared critical rate limit) the frontend classified it as out_of_sync, cleared local auth state, and redirected to /sign-in. The rate limit itself is working as intended; the bug is that a temporary rejection was treated as a terminal auth failure. - Treat 429 refresh responses as transient errors on the frontend, keeping the session retryable instead of clearing it. Only explicit 401 or confirmed session mismatch/race exhaustion clears auth state. - Return Retry-After on all rate-limited responses (remaining TTL on Redis, window duration on the in-memory limiter) so clients can back off. - Log the underlying error with request context when auth session errors map to 500 AUTH_INTERNAL_ERROR, and replace fmt.Println with request-scoped logging in the Redis rate limiter error paths. Fixes #6361