fix(github): read pull requests when GitHub refuses a requested reviewer

A GitHub App that may read a pull request but not one of its requested
reviewers gets a FORBIDDEN error at
reviewRequests.nodes.<n>.requestedReviewer, and that one error failed the
whole detail and review-thread reads, so watching stopped after eight
failures. Both reads now ask again for no reviewer requests when that is
the only refusal; any other error still fails them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: ScottN-PV

packages/source-control-github/src/server/GitHubApi.test.ts

@@ -233,6 +233,43 @@ describe("GitHubApi", () => {
     }).pipe(Effect.provide(layer));
   });
 
+  it.effect("names each refused field of a partial GraphQL answer", () => {
+    const reviewerPath = [
+      "repository",
+      "pullRequest",
+      "reviewRequests",
+      "nodes",
+      0,
+      "requestedReviewer",
+    ];
+    const { layer } = harness(() =>
+      json({
+        data: { repository: { pullRequest: { number: 7, reviewRequests: { nodes: [null] } } } },
+        errors: [
+          {
+            type: "FORBIDDEN",
+            path: reviewerPath,
+            extensions: { saml_failure: false, ip_allow_list_failure: false },
+            message: "Resource not accessible by integration",
+          },
+          { message: "Something went wrong", path: "repository" },
+        ],
+      }),
+    );
+    return Effect.gen(function* () {
+      const api = yield* GitHubApi.GitHubApi;
+      const error = yield* Effect.flip(
+        api.graphql({ host: "github.com", operation: "detail", query: "query { viewer { id } }" }),
+      );
+      expect(error._tag).toBe("GitHubApiResponseError");
+      // An error with no type or an unreadable path is kept, so a caller cannot miss it.
+      expect(error).toHaveProperty("graphqlErrors", [
+        { type: "FORBIDDEN", path: reviewerPath },
+        { type: undefined, path: undefined },
+      ]);
+    }).pipe(Effect.provide(layer));
+  });
+
   it.effect(
     "reads a NOT_FOUND answer with another error as a failure, not a missing resource",
     () => {

packages/source-control-github/src/server/GitHubApi.ts

@@ -75,10 +75,20 @@ export class GitHubApiNotFoundError extends Schema.TaggedError<GitHubApiNotFound
   }
 }
 
+/** The field a GraphQL error refers to, as keys and list indexes from the top of the answer. */
+const GraphQlErrorPath = Schema.Array(Schema.Union([Schema.String, Schema.Int]));
+const isGraphQlErrorPath = Schema.is(GraphQlErrorPath);
+
+const GraphQlError = Schema.Struct({
+  type: Schema.optional(Schema.String),
+  path: Schema.optional(GraphQlErrorPath),
+});
+
 /**
  * GitHub answered with a failure that is none of the above. `githubErrors` carries GitHub's own
  * error messages, from a GraphQL `errors` list or a REST `message`/`errors` body: they name the
  * field and the reason ("A pull request already exists for acme:feature"), never a token.
+ * `graphqlErrors` has one entry per GraphQL error, so a caller can tell which fields were refused.
  */
 export class GitHubApiResponseError extends Schema.TaggedError<GitHubApiResponseError>()(
   "GitHubApiResponseError",
@@ -87,6 +97,7 @@ export class GitHubApiResponseError extends Schema.TaggedError<GitHubApiResponse
     operation: Schema.String,
     status: Schema.Int,
     githubErrors: Schema.optionalKey(Schema.Array(Schema.String)),
+    graphqlErrors: Schema.optionalKey(Schema.Array(GraphQlError)),
   },
 ) {
   override get message(): string {
@@ -229,6 +240,8 @@ const decodeGraphQlErrors = Schema.decodeUnknownOption(
         Schema.Struct({
           type: Schema.optional(Schema.String),
           message: Schema.optional(Schema.String),
+          // Read loosely: an unexpected path must not stop the error itself from being seen.
+          path: Schema.optional(Schema.Unknown),
         }),
       ),
     }),
@@ -281,7 +294,10 @@ type Answer = Data.TaggedEnum<{
   RateLimited: {};
   Unauthorized: {};
   NotFound: {};
-  Failed: { readonly messages: ReadonlyArray<string> | undefined };
+  Failed: {
+    readonly messages: ReadonlyArray<string> | undefined;
+    readonly graphqlErrors?: ReadonlyArray<typeof GraphQlError.Type>;
+  };
 }>;
 const Answer = Data.taggedEnum<Answer>();
 
@@ -326,7 +342,15 @@ function classify(input: {
   ) {
     return Answer.NotFound();
   }
-  if (errors !== undefined) return Answer.Failed({ messages });
+  if (errors !== undefined) {
+    return Answer.Failed({
+      messages,
+      graphqlErrors: errors.map(({ type, path }) => ({
+        type,
+        path: isGraphQlErrorPath(path) ? path : undefined,
+      })),
+    });
+  }
   if ((status >= 200 && status < 300) || (status === 304 && input.acceptNotModified)) {
     return Answer.Ok();
   }
@@ -486,12 +510,13 @@ export const make = Effect.gen(function* () {
               .invalidate(host)
               .pipe(Effect.andThen(Effect.fail(new GitHubApiAuthenticationError(context)))),
           NotFound: () => Effect.fail(new GitHubApiNotFoundError(context)),
-          Failed: ({ messages }) =>
+          Failed: ({ messages, graphqlErrors }) =>
             Effect.fail(
               new GitHubApiResponseError({
                 ...context,
                 status,
                 ...(messages === undefined ? {} : { githubErrors: messages }),
+                ...(graphqlErrors === undefined ? {} : { graphqlErrors }),
               }),
             ),
         },