Narrow token retry to 429 and 503 only

Only retry token acquisition on HTTP 429 (rate limited) and 503
(service unavailable). Other 5xx errors are not retried to avoid
masking persistent server-side failures.

Co-authored-by: Isaac
Signed-off-by: Ubuntu <renaud.hartert@databricks.com>

Author: renaudhartert-db

config/experimental/auth/retrying_token_source.go

@@ -55,7 +55,7 @@ type httpStatusCoder interface {
 // OAuth2 token endpoint errors, and transient network errors.
 func isRetriableTokenError(err error) bool {
 	if code := httpStatusCode(err); code != 0 {
-		return code == 429 || code >= 500
+		return code == 429 || code == 503
 	}
 	var urlErr *url.Error
 	if errors.As(err, &urlErr) {

config/experimental/auth/retrying_token_source_test.go

@@ -51,9 +51,9 @@ func TestRetryingTokenSource(t *testing.T) {
 			wantCalls: 2,
 		},
 		{
-			name: "retry on http 500 then succeed",
+			name: "retry on http 503 then succeed",
 			callErrors: []error{
-				&testHTTPError{code: 500, message: "server error"},
+				&testHTTPError{code: 503, message: "service unavailable"},
 				nil,
 			},
 			wantToken: true,
@@ -143,7 +143,7 @@ func TestIsRetriableTokenError(t *testing.T) {
 		{
 			name: "http 500",
 			err:  &testHTTPError{code: 500},
-			want: true,
+			want: false,
 		},
 		{
 			name: "http 503",
@@ -168,7 +168,7 @@ func TestIsRetriableTokenError(t *testing.T) {
 		{
 			name: "oauth2 retrieve error 500",
 			err:  &oauth2.RetrieveError{Response: &http.Response{StatusCode: 500}},
-			want: true,
+			want: false,
 		},
 		{
 			name: "oauth2 retrieve error 400",