This is likely because err on line 43 and 44 is only triggered if there's a network-type error calling the API, but not if the API returns a status code in the 400-599 range.
When the tenant ID cannot be found, App ID returns a 400 status code.
I think the flow should work like this:
If the response status code is 400, log the error and return a 500 error to the client, indicating: Failed to retrieve App ID keys: <App ID error body>
If the status code is 200, assume we received the keys and continue normally.
If the status code is any other value or if the request failed completely, return a 500 error with a message indicating: Failed to retrieve App ID keys: <App ID error body> (or the err in case of a network issue)
This line throws error 500 when the keys cannot be found due to an invalid tenant ID: https://github.com/apache/incubator-openwhisk-apigateway/blob/master/scripts/lua/oauth/app-id.lua#L50
This is likely because
erron line 43 and 44 is only triggered if there's a network-type error calling the API, but not if the API returns a status code in the 400-599 range.When the tenant ID cannot be found, App ID returns a 400 status code.
I think the flow should work like this:
Failed to retrieve App ID keys: <App ID error body>Failed to retrieve App ID keys: <App ID error body>(or theerrin case of a network issue)