fix: store cred_mngr on WtSite, improve 403 diagnostics

- WtSite.__init__ now stores _cred_mngr and _iri so the ApiGateway
  transport can re-authenticate on expired sessions
- Log the 403 response body to help diagnose permission issues
  (e.g. missing bot password grants, see
  OpenSemanticLab/mediawiki-extensions-ApiGateway#1)

Author: simontaurus

src/osw/utils/workflow.py

@@ -245,7 +245,14 @@ async def handle_async_request(self, request: httpx.Request) -> httpx.Response:
             rewritten = self._rewrite_request(request)
             response = await httpx.AsyncHTTPTransport().handle_async_request(rewritten)
             if response.status_code == 403 and self._relogin_cb:
-                log.warning("ApiGateway session expired, re-authenticating")
+                try:
+                    body = response.read().decode(errors="replace")
+                except Exception:
+                    body = "<unreadable>"
+                log.warning(
+                    "ApiGateway returned 403, re-authenticating. " "Response: %s",
+                    body,
+                )
                 self._relogin_cb()
                 self._csrf_token = None
                 rewritten = self._rewrite_request(request)

src/osw/wtsite.py

@@ -92,7 +92,11 @@ def __init__(self, config: Union[WtSiteConfig, WtSiteLegacyConfig]):
 
         if isinstance(config, WtSite.WtSiteLegacyConfig):
             self._site: mwclient.Site = config.site
+            self._cred_mngr = None
+            self._iri = None
         else:
+            self._cred_mngr = config.cred_mngr
+            self._iri = config.iri
             cred = config.cred_mngr.get_credential(
                 CredentialManager.CredentialConfig(
                     iri=config.iri, fallback=CredentialManager.CredentialFallback.ask