Summary

Authentication._get_error_code extracts the error code from a Synology API response by chaining .get() calls:

if response.get("success"):
    code = CODE_SUCCESS
else:
    code = response.get("error").get("code")
return code

If the server returns {"success": false} without an error field — or with error set to None, a non-dict value, or a dict missing code — the second .get() raises AttributeError.

Because this method is called on every API response, a malformed reply turns a recoverable error into an exception with no useful context.

Reproduction

Authentication._get_error_code({"success": False})
# AttributeError: 'NoneType' object has no attribute 'get'

Authentication._get_error_code({"success": False, "error": None})
# AttributeError: 'NoneType' object has no attribute 'get'

Authentication._get_error_code({"success": False, "error": {}})
# returns None instead of an int

The last case is also incorrect because the docstring says the method returns an int.

Fix

Validate the response structure before dereferencing it, and fall back to the existing CODE_UNKNOWN value when the response does not match the documented schema.

CODE_UNKNOWN is already mapped to "Unknown Error" in error_codes.

if response.get("success"):
    return CODE_SUCCESS

error = response.get("error")
if isinstance(error, dict) and isinstance(error.get("code"), int):
    return error["code"]

return CODE_UNKNOWN

Behavior

Callers using if not error_code continue to take the error path. _get_error_message(9999, ...) already returns "Error 9999 - Unknown Error".

Tests

Adds tests/test_auth.py with 11 cases covering:

• successful responses;
• normal error responses;
• missing error;
• error set to None;
• error set to {};
• error set to a non-dict value;
• error.code set to a non-int value;
• empty response objects.

All malformed-response cases now return CODE_UNKNOWN instead of raising an exception or returning a non-int value.