feat(chat): show a quota hint when the server's key is refused (#953)

On the server's own credentials a provider 403 now gets its own code,
server_key_forbidden, with a hint in all four languages: today's free
quota is used up, it resets tomorrow, and users can add their own key
in model settings. The generic "The provider returned an error." line
is left out for this code.

A daily spend cap that blocks a shared key makes every call return 403.
The old hint said the key may lack access to the model or region, which
points users at a setting they cannot change.

A 403 on the user's own key keeps the old hint and the provider's text.

tests/e2e/chat-errors.spec.ts

@@ -75,3 +75,30 @@ test("a provider rate limit is not shown as this site's quota", async ({
     // The site's own tokens-per-minute toast
     await expect(page.getByText("Rate limit reached")).toHaveCount(0)
 })
+
+test("a refused server key shows only the quota hint and a settings button", async ({
+    page,
+}) => {
+    // What the chat route streams when the server's key gets a 403, e.g.
+    // after a daily spend cap blocked it
+    const errorText = JSON.stringify({
+        type: "provider",
+        code: "server_key_forbidden",
+        message: "",
+    })
+    await chatWith(page, {
+        status: 200,
+        contentType: "text/event-stream",
+        body: `data: {"type":"start"}\n\ndata: ${JSON.stringify({ type: "error", errorText })}\n\ndata: [DONE]\n\n`,
+    })
+    await expect(
+        page.getByText("Today's free quota is used up", { exact: false }),
+    ).toBeVisible({ timeout: 15000 })
+    await expect(page.getByText("The provider returned an error")).toHaveCount(
+        0,
+    )
+    await page.getByRole("button", { name: "Open model settings" }).click()
+    await expect(
+        page.getByRole("dialog", { name: "AI Model Configuration" }),
+    ).toBeVisible()
+})

tests/unit/chat-route-errors.test.ts

@@ -139,7 +139,8 @@ describe("provider error texts in the stream", () => {
         )
         const message = await streamedError({})
         expect(message).not.toMatch(/org-operator/)
-        expect(message).toBe("The provider returned an error.")
+        // A 403 on the server's key gets its own hint and no message
+        expect(message).toBe("")
     })
 })
 

tests/unit/llm-errors.test.ts

@@ -215,11 +215,29 @@ describe("streamErrorText", () => {
             "User: arn:aws:sts::123456789012:assumed-role/app/s is not authorized to perform: bedrock:InvokeModel",
         )
         const hidden = JSON.parse(streamErrorText(error, true))
-        expect(hidden.code).toBe("forbidden")
         expect(hidden.message).not.toMatch(/arn:aws|123456789012/)
         expect(JSON.parse(streamErrorText(error)).message).toMatch(
             /not authorized/,
         )
+        const throttled = JSON.parse(
+            streamErrorText(apiError(429, "Too many tokens"), true),
+        )
+        expect(throttled).toEqual({
+            type: "provider",
+            code: "rate_limited",
+            message: "The provider returned an error.",
+        })
+    })
+
+    it("names a 403 on the server's keys, e.g. a spend cap blocked them", () => {
+        const error = apiError(403, "explicit deny in an identity-based policy")
+        expect(JSON.parse(streamErrorText(error, true))).toEqual({
+            type: "provider",
+            code: "server_key_forbidden",
+            message: "",
+        })
+        // On the user's own key it stays a plain refusal
+        expect(JSON.parse(streamErrorText(error)).code).toBe("forbidden")
     })
 
     it("classifies a provider error", () => {