fix(gax): map REST fallback transport errors to gRPC status codes

[MarkDuckworth]

Summary

This PR fixes a bug where errors from the fallback (REST) transport carry an HTTP status number or a Node system error string on err.code, instead of a numeric gRPC status code.

Existing retry logic in normalCalls/retries.ts expects gRPC status codes — it matches err.code against the numeric retryCodes built from each method's service config:

if (retry.retryCodes.indexOf(err!.code!) < 0) {
  // "...not classified as transient"

So for example, Firestore's Commit is configured with "retry_codes_name": "resource_exhausted_unavailable", which resolves to RESOURCE_EXHAUSTED and UNAVAILABLE — [8, 14]. When the connection drops mid-call, the fallback transport reports err.code === 'ECONNRESET'; when the backend returns 503, it reports err.code === 503. Neither is in [8, 14], so both are classified as permanent and retried zero times — a single socket hang up fails the call. Client libraries branching on err.code see the same divergence.

Root cause

Two defects, both introduced when the transport moved to auth.fetch() in e7c686a (googleapis/gax-nodejs#1766):

1. HTTP errors never reach the decoder. gaxios resolves only when a response passes validateStatus — which defaults to 2xx-only and throws otherwise — and gax never sets it. So the .then() handler only ever runs for 2xx responses, which makes the response.ok it forwards to the decoder always true. That leaves decodeResponse's if (!ok) branch — the code that builds a GoogleError via parseHttpError() — unreachable. Every HTTP error takes the .catch below instead.
2. Connection errors are never classified. The terminal .catch forwards the raw GaxiosError straight to the gRPC-style callback.

That PR's scope was fixing silently-failing tests ("minimal change to gax/src/") and it shipped as a plain fix: with no discussion of error codes; deliberate changes in this area (googleapis/gax-nodejs#1736, googleapis/gax-nodejs#1633) were marked fix!.

Why CI stayed green: setMockFallbackResponse() in test/unit/utils.ts mocks AuthClient#request to resolve with a failed Response; real gaxios throws. The suite asserts code === 3 for a 400 and code === 7 for a 403 and passes, while production returns 400 and 403.

The fix

• Pass validateStatus: status => status !== 401 && status !== 403 to auth.fetch(), so HTTP errors resolve and flow through the existing decodeResponse → parseHttpError path. 401/403 keep rejecting so google-auth-library can refresh credentials and retry — oauth2client branches on a thrown 401/403.

• Add _toGoogleError() for errors that still reject, preserving the original on cause:

  Source	→
  carries an HTTP status	rpcCodeFromHttpStatusCode(status)
  name AbortError	CANCELLED
  name TimeoutError	DEADLINE_EXCEEDED
  any other failure before a response	UNAVAILABLE

  The last row follows @grpc/grpc-js rather than a hand-written errno list. grpc-js defaults transport failures to UNAVAILABLE — write and stream errors in subchannel-call.ts, 'No connection established' in picker.ts, resolution failures in resolver-dns.ts — and inspects errno only to refine an HTTP/2 INTERNAL_ERROR, where it treats both ECONNRESET and ETIMEDOUT as UNAVAILABLE. Enumerating errnos here would classify anything left off the list as non-retryable, and such a list can only ever be incomplete. Note this means ETIMEDOUT is UNAVAILABLE, not DEADLINE_EXCEEDED; the latter is for an elapsed call deadline.

  Aborts and timeouts are matched on err.name, not err.code: AbortSignal.abort() and AbortSignal.timeout() raise a DOMException whose code is the numeric legacy value (20 and 23). This matches the existing err.name !== 'AbortError' checks in the same file. A string code is accepted too, since gaxios normalizes a DOMException's name onto code.

  An existing GoogleError, or a non-Error, passes through untouched. Applies to unary and server-streaming. Errors raised while decoding a response are handled nearer the decoder and do not reach this path.

No gaxios-level retryConfig is added, so retries stay governed by the per-method retry codes in each service config.

Behaviour change

err.code from the fallback transport becomes a numeric gRPC status where it was an HTTP number or system string. This restores the documented contract — GoogleError.code is typed as the gRPC Status enum, and the Java and Python REST transports normalize the same way — but it is observable for anyone who adapted to the current behaviour.

[gemini-code-assist]

Code Review

This pull request introduces transport error translation for the fallback service stub, mapping underlying fetch and connection errors to numeric gRPC status codes. It also adds comprehensive unit tests to verify transport parity and error mapping. Feedback on the changes highlights a critical issue where checking fetchError.code === 'AbortError' will fail to match aborted requests in production due to differences in how various fetch implementations represent abort errors, and suggests checking err.name or gaxios-abort instead.