[jrgutier]

Summary

The web socket monitor only stops reconnecting when the server's close reason is "Unauthenticated". It never reads the close code. When the server rejects a connection with code 4403 (reason "Forbidden"), which arrives about 0.5 s after connection_init, the monitor reconnects indefinitely and gets the same rejection every time. ws_unauthenticated stays False, so the integration's reauth path (_subscribe_retry_delay in coordinator.py, which raises ConfigEntryAuthFailed on ws_unauthenticated) never fires.

Changes

• ws_monitor.py: a FORBIDDEN = 4403 constant and a _forbidden flag, reset in new_connection. When the connection closes, _receive sets the flag if aiohttp's close_code is 4403 and the connection had not been acknowledged yet. unauthenticated is true for the reason "Unauthenticated" or when that flag is set, and the monitor stops whenever unauthenticated is true (it used to compare the reason string only).
• A 4403 on a connection that was already acknowledged still reconnects, as before. 4403 has only been seen before the ack, so there is no evidence that a new login would fix it on a long-lived connection, and a transient close there should not become a reauth prompt.
• 4401 and 4420 are left alone. 4420 (Connection TTL expired) is already handled quietly. 4401 is graphql-transport-ws's response to a message sent before connection_ack, so logging in again would not fix it.
• tests/test_ws_monitor.py: FakeServer.close_code (default 4000, the previous hard-coded value) and FakeServer.ack_before_close, plus two tests:
  • test_forbidden_stops_monitor closes with 4403/"Forbidden" before the ack while the monitor has a subscription, then checks that there was exactly one connection and that ws_unauthenticated is set.
  • test_forbidden_after_ack_reconnects acknowledges the connection and then closes with 4403. It checks that the monitor reconnects and that ws_unauthenticated stays False.

Testing

PYTHONPATH=src pytest -q -p no:cacheprovider && ruff check . && ruff format --check . && mypy src/rivian

234 passed (232 at 67ba96f, plus 2 new). Ruff and mypy are clean. Against the unmodified ws_monitor.py, test_forbidden_stops_monitor fails (it times out while the monitor keeps reconnecting). Without the before-ack check, test_forbidden_after_ack_reconnects fails (it times out because the monitor stops).

Notes

• Our reading of 4403 is unverified. We have seen 4403 Forbidden about 0.5 s after connection_init, and our notes attribute it to a malformed u-sess. That interpretation is claim C6 in our fork's docs/development/WS_CONTENTION.md, and it was never tested live, because provoking 4403 on purpose was ruled out. If 4403 before the ack can also mean something a new login would not fix, this change turns a reconnect loop into a reauth prompt for that case. A 4403 after the ack is left as a reconnect for the same reason.
• test_unauthenticated_stops_monitor passed vacuously. With no subscription, the monitor stops because it has nothing to resume, whatever the close reason. With the "Unauthenticated" check disabled, it still passed. This PR adds the missing add_subscription(monitor) (one line), and with that line the test fails when the check is disabled.
• A 4403 on a reconnect inside the monitor now stops the monitor. The integration only notices on its next subscribe attempt, when ws_unauthenticated is checked, which is the same as an "Unauthenticated" close today.