fix: read the auth token from response headers before trailers

[lukekim]

This fixes the failing tests

Initially I thought this was only a diagnostics improvement and that CI needed a credential rotation. That was wrong, and the evidence is direct: the TPCH cloud tests pass on this branch and fail on #22, same repo, same secrets, same runner.

The credential was never broken. The eager trailer read threw before the token in the response headers could be used, so every authenticated connection died regardless of whether the key was valid.

branch	TestTpchQ1..Q10	totals
#22 (without this fix)	Failed	125 passed, 33 failed
#23 (this branch)	Passed	125 passed, 0 failed, 23 skipped

The 23 skips are the ADBC-driver tests, which skip for their own unrelated reasons.

What

AuthenticateAsync passed stream.GetTrailers() as an argument:

var token = GetAuthToken(headers, stream.GetTrailers());

Arguments are evaluated eagerly, so the trailers are read before the handshake has completed. gRPC only exposes trailers once a call finishes, so any failing handshake throws:

System.InvalidOperationException : Can't get the call trailers because the call has not completed successfully.
   at Spice.Flight.SpiceFlightClient.AuthenticateAsync() ... line 169

That exception replaces the gRPC status that says what actually went wrong.

The token is now read from response headers first; trailers are consulted only if the headers carry none, and failing to read them is caught rather than propagated. The resulting SpiceException names the likely cause and carries the originating RpcException as InnerException. Adds an internal SpiceException constructor accepting an inner exception.

Why it matters

This is repo-wide and long-standing, not specific to any branch:

• trunk's own pr run has been failing with this exact error since 2026-07-25
• open PRs feat: add health and readiness checks #20, feat: add refresh options for on-demand dataset refresh #21 and feat: add SearchAsync for vector, keyword, and hybrid search #22 all fail identically — 33 failures each, every one of them this message

Anyone looking at CI right now sees a .NET internal error about trailers and has no way to tell that the cause is a credential. That's what this changes.

Verification

Reproduced against a TLS endpoint that isn't a Flight service, which produces the same handshake-failure shape as CI:

	message
before	InvalidOperationException: Can't get the call trailers because the call has not completed successfully.
after	SpiceException: Failed to authenticate: the runtime returned no authorization token. Check that the API key is valid for this endpoint.

Also checked the healthy-server-but-no-token path (valid endpoint, bad key) still fails gracefully with the same clear message rather than regressing.

• dotnet build -c Release — all four targets including netstandard2.0
• dotnet test — 115 passed, 0 failed on net8.0 / net9.0 / net10.0 (33 skipped: the cloud integration tests, which need the API key)
• The cloud integration tests now pass in CI — 0 failures across net8.0 / net9.0 / net10.0

Follow-on effect

Merging this unblocks #22, whose 11 failing checks are all this same bug.

[Copilot]

Pull request overview

Fixes gRPC Flight authentication failures by avoiding an eager trailers read during handshake, so authentication can succeed when the token is already present in response headers and failures surface a meaningful SpiceException (with the underlying RpcException preserved).

Changes:

• Reads the auth token from handshake response headers first; only consults trailers as a fallback and suppresses trailer-read exceptions.
• Improves authentication failure diagnostics by formatting gRPC failures into actionable messages.
• Adds an internal SpiceException constructor that accepts an innerException.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
Spice/src/Flight/SpiceFlightClient.cs	Reworks AuthenticateAsync to avoid eager trailer reads; adds helper methods for trailer token retrieval and RPC failure description.
Spice/src/Errors/SpiceException.cs	Adds an internal constructor overload to preserve inner exceptions for better error reporting.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.