Replace string-based network error matching with typed checks

Use errors.Is(syscall.ECONNRESET), errors.Is(syscall.ECONNREFUSED),
and net.Error.Timeout() instead of substring matching on error messages.
String matching is brittle: error text is not covered by Go's
compatibility promise and differs across platforms.

Remove duplicate "tls handshake timeout" test case (identical to
"i/o timeout") and update all network error tests to use real error
chains (net.OpError -> os.SyscallError -> syscall.Errno).

Co-authored-by: Isaac
Signed-off-by: Ubuntu <renaud.hartert@databricks.com>

Author: renaudhartert-db

config/experimental/auth/retry.go

@@ -3,10 +3,10 @@ package auth
 import (
 	"context"
 	"errors"
+	"net"
 	"net/http"
-	"net/url"
 	"slices"
-	"strings"
+	"syscall"
 	"time"
 
 	"github.com/databricks/databricks-sdk-go/experimental/api"
@@ -66,16 +66,7 @@ func isRetriableTokenError(err error) bool {
 	if code := httpStatusCode(err); code != 0 {
 		return slices.Contains(retriableCodes, code)
 	}
-	var urlErr *url.Error
-	if errors.As(err, &urlErr) {
-		msg := urlErr.Error()
-		for _, s := range transientNetworkErrors {
-			if strings.Contains(msg, s) {
-				return true
-			}
-		}
-	}
-	return false
+	return isTransientNetworkError(err)
 }
 
 // httpStatusCode extracts the HTTP status code from an error, if available.
@@ -93,12 +84,18 @@ func httpStatusCode(err error) int {
 	return 0
 }
 
-// transientNetworkErrors is the list of error substrings that indicate a
-// transient network failure. These mirror the checks in
-// httpclient/errors.go isRetriableUrlError.
-var transientNetworkErrors = []string{
-	"connection reset by peer",
-	"TLS handshake timeout",
-	"connection refused",
-	"i/o timeout",
+// isTransientNetworkError reports whether err represents a transient network
+// condition that is likely to resolve on retry.
+func isTransientNetworkError(err error) bool {
+	if errors.Is(err, syscall.ECONNRESET) {
+		return true
+	}
+	if errors.Is(err, syscall.ECONNREFUSED) {
+		return true
+	}
+	var netErr net.Error
+	if errors.As(err, &netErr) && netErr.Timeout() {
+		return true
+	}
+	return false
 }

config/experimental/auth/retry_test.go

@@ -4,13 +4,23 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"net"
 	"net/http"
 	"net/url"
+	"os"
+	"syscall"
 	"testing"
 
 	"golang.org/x/oauth2"
 )
 
+// timeoutError is a test error that implements net.Error with Timeout() == true.
+type timeoutError struct{}
+
+func (e timeoutError) Error() string   { return "i/o timeout" }
+func (e timeoutError) Timeout() bool   { return true }
+func (e timeoutError) Temporary() bool { return false }
+
 // testHTTPError is a test error that implements the httpStatusCoder interface,
 // mirroring httpclient.HttpError without importing it.
 type testHTTPError struct {
@@ -69,7 +79,10 @@ func TestRetryingTokenSource(t *testing.T) {
 		{
 			name: "retry on transient network error",
 			callErrors: []error{
-				&url.Error{Op: "Post", URL: "https://host/token", Err: fmt.Errorf("connection reset by peer")},
+				&url.Error{Op: "Post", URL: "https://host/token", Err: &net.OpError{
+					Op: "read", Net: "tcp",
+					Err: &os.SyscallError{Syscall: "read", Err: syscall.ECONNRESET},
+				}},
 				nil,
 			},
 			wantToken:    token,
@@ -179,22 +192,26 @@ func TestIsRetriableTokenError(t *testing.T) {
 		},
 		{
 			name: "connection reset",
-			err:  &url.Error{Op: "Post", URL: "https://host/token", Err: fmt.Errorf("connection reset by peer")},
-			want: true,
-		},
-		{
-			name: "tls handshake timeout",
-			err:  &url.Error{Op: "Post", URL: "https://host/token", Err: fmt.Errorf("TLS handshake timeout")},
+			err: &url.Error{Op: "Post", URL: "https://host/token", Err: &net.OpError{
+				Op: "read", Net: "tcp",
+				Err: &os.SyscallError{Syscall: "read", Err: syscall.ECONNRESET},
+			}},
 			want: true,
 		},
 		{
 			name: "connection refused",
-			err:  &url.Error{Op: "Post", URL: "https://host/token", Err: fmt.Errorf("connection refused")},
+			err: &url.Error{Op: "Post", URL: "https://host/token", Err: &net.OpError{
+				Op: "dial", Net: "tcp",
+				Err: &os.SyscallError{Syscall: "connect", Err: syscall.ECONNREFUSED},
+			}},
 			want: true,
 		},
 		{
 			name: "i/o timeout",
-			err:  &url.Error{Op: "Post", URL: "https://host/token", Err: fmt.Errorf("i/o timeout")},
+			err: &url.Error{Op: "Post", URL: "https://host/token", Err: &net.OpError{
+				Op: "read", Net: "tcp",
+				Err: timeoutError{},
+			}},
 			want: true,
 		},
 		{