fix(prometheus): a refused token stops the scraping, as Home Assistant bans an address after a few refusals (#6355)

Also names the Home Assistant connection by its address in the audit log and
timeline, where its id showed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/plugins/prometheus/test_mcp_tools.py

@@ -15,7 +15,7 @@ def _target(name, *, enabled=True, scraped=timedelta(seconds=30), error=None,
             url="http://archives:8080/metrics"):
     return NS(id=f"id-{name}", name=name, url=url, token="bearer-s3cret", enabled=enabled,
               interval_seconds=60, last_scraped_at=NOW - scraped if scraped else None,
-              last_ok_at=NOW - timedelta(hours=1), last_error=error, last_kept=120, last_dropped=30,
+              last_ok_at=NOW - timedelta(hours=1), last_error=error, refused=False, last_kept=120, last_dropped=30,
               last_capped=0, series_cap=1000, keep=["archives_*"], drop=[])
 
 

tests/plugins/prometheus/test_service.py

@@ -7,7 +7,7 @@ import pytest
 
 from plugins.prometheus.models import PrometheusTarget
 from plugins.prometheus.scheduler import is_due
-from plugins.prometheus.scraper import ScrapeError, scrape
+from plugins.prometheus.scraper import ScrapeError, TokenRefused, scrape
 from plugins.prometheus.service import (FormError, fold_states, label_pairs, map_families, parse_form,
                                         patterns, rate_name, resource_for, target_state, wanted)
 from steward.core import prometheus
@@ -165,6 +165,16 @@ def test_state_and_due():
     assert target_state(t, now).reach == "paused" and not is_due(t, now)
 
 
+def test_a_refused_token_stops_the_scraping_and_the_page_says_so():
+    now = datetime(2026, 10, 12, 12, 0, tzinfo=timezone.utc)
+    t = PrometheusTarget(name="a", url="http://a", enabled=True, interval_seconds=60, refused=True,
+                         last_error="Answered 401: the token was refused.",
+                         last_scraped_at=now - timedelta(hours=5))
+    state = target_state(t, now)
+    assert state.reach == "down" and "stopped asking" in state.says and "Answered 401" in state.says
+    assert not is_due(t, now)
+
+
 @pytest.mark.asyncio
 async def test_a_scrape_sends_the_token_and_says_why_it_failed():
     seen = {}
@@ -180,7 +190,7 @@ async def test_a_scrape_sends_the_token_and_says_why_it_failed():
     transport = httpx.MockTransport(handler)
     fams = await scrape("http://svc/metrics", "tok", transport=transport)
     assert list(fams) == ["up_thing"] and seen["auth"] == "Bearer tok"
-    with pytest.raises(ScrapeError, match="token was refused"):
+    with pytest.raises(TokenRefused, match="token was refused"):
         await scrape("http://svc/denied", "bad", transport=transport)
     with pytest.raises(ScrapeError, match="no metrics"):
         await scrape("http://svc/html", transport=transport)