auth-gate 0.2.0__tar.gz → 0.2.2__tar.gz

{auth_gate-0.2.0/src/auth_gate.egg-info → auth_gate-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: auth-gate
-Version: 0.2.0
+Version: 0.2.2
 Summary: Enterprise-grade authentication for microservices with Kong and Keycloak integration
 Home-page: https://github.com/tradelink-org/auth-gate
 Author: Brian Mburu

{auth_gate-0.2.0 → auth_gate-0.2.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "auth-gate"
-version = "0.2.0"
+version = "0.2.2"
 description = "Enterprise-grade authentication for microservices with Kong and Keycloak integration"
 readme = "README.md"
 requires-python = ">=3.11"

{auth_gate-0.2.0 → auth_gate-0.2.2}/setup.cfg

@@ -1,6 +1,6 @@
 [metadata]
 name = auth-gate
-version = 0.2.0
+version = 0.2.2
 author = Brian Mburu
 author_email = brian.mburu@students.jkuat.ac.ke
 description = Enterprise-grade authentication for microservices with Kong and Keycloak integration

{auth_gate-0.2.0 → auth_gate-0.2.2}/src/auth_gate/__init__.py

@@ -25,10 +25,11 @@ from .fastapi_utils import (
     verify_hmac_signature,
 )
 from .middleware import AuthMiddleware
+from .s2s_auth import CircuitBreaker, CircuitBreakerOpenError, ServiceAuthClient
 from .schemas import ServiceContext, UserContext
 from .user_auth import UserValidator
 
-__version__ = "0.2.0"
+__version__ = "0.2.2"
 
 __all__ = [
     # Configuration
@@ -39,6 +40,10 @@ __all__ = [
     "ServiceContext",
     # User Authentication
     "UserValidator",
+    # Service-to-Service
+    "ServiceAuthClient",
+    "CircuitBreaker",
+    "CircuitBreakerOpenError",
     # Middleware
     "AuthMiddleware",
     # FastAPI Dependencies

auth_gate-0.2.2/src/auth_gate/s2s_auth.py

@@ -0,0 +1,352 @@
+"""
+Service-to-service authentication with resilience patterns
+"""
+
+import asyncio
+import logging
+from dataclasses import dataclass
+from datetime import datetime, timedelta, timezone
+from enum import Enum
+from typing import Optional, Tuple, Type, Union
+
+import httpx
+from fastapi import HTTPException, status
+
+from .config import get_settings
+
+logger = logging.getLogger(__name__)
+
+
+class CircuitState(Enum):
+    """Circuit breaker states"""
+
+    CLOSED = "closed"  # Normal operation
+    OPEN = "open"  # Failing, reject calls
+    HALF_OPEN = "half_open"  # Testing recovery
+
+
+class CircuitBreakerOpenError(Exception):
+    """Exception raised when circuit breaker is open"""
+
+    pass
+
+
+class CircuitBreaker:
+    """
+    Circuit breaker implementation for fault tolerance.
+
+    States:
+    - CLOSED: Normal operation, calls pass through
+    - OPEN: Service is failing, calls are rejected
+    - HALF_OPEN: Testing if service recovered
+    """
+
+    def __init__(
+        self,
+        failure_threshold: int = 5,
+        recovery_timeout: int = 60,
+        expected_exception: Union[Type[Exception], Tuple[Type[Exception], ...]] = Exception,
+        name: Optional[str] = None,
+    ):
+        """
+        Initialize circuit breaker.
+
+        Args:
+            failure_threshold: Number of failures before opening circuit
+            recovery_timeout: Seconds to wait before attempting recovery
+            expected_exception: Exception type to catch
+            name: Circuit breaker name for logging
+        """
+        self.failure_threshold = failure_threshold
+        self.recovery_timeout = recovery_timeout
+        self.expected_exception = expected_exception
+        self.name = name or "CircuitBreaker"
+
+        self._state = CircuitState.CLOSED
+        self._failure_count = 0
+        self._last_failure_time: Optional[datetime] = None
+        self._lock = asyncio.Lock()
+
+    @property
+    def state(self) -> CircuitState:
+        """Get current circuit state"""
+        return self._state
+
+    @property
+    def is_open(self) -> bool:
+        """Check if circuit is open"""
+        return self._state == CircuitState.OPEN
+
+    @property
+    def is_closed(self) -> bool:
+        """Check if circuit is closed"""
+        return self._state == CircuitState.CLOSED
+
+    async def __aenter__(self):
+        """Context manager entry"""
+        await self._before_call()
+        return self
+
+    async def __aexit__(self, exc_type, exc_val, exc_tb):
+        """Context manager exit"""
+        if exc_type is None:
+            await self._on_success()
+        elif issubclass(exc_type, self.expected_exception):
+            await self._on_failure()
+        # Don't suppress the exception
+        return False
+
+    async def _before_call(self):
+        """Check circuit state before allowing call"""
+        async with self._lock:
+            if self._state == CircuitState.OPEN:
+                # Check if recovery timeout has passed
+                if self._last_failure_time and datetime.now(
+                    timezone.utc
+                ) - self._last_failure_time > timedelta(seconds=self.recovery_timeout):
+                    logger.info(f"{self.name}: Attempting recovery (HALF_OPEN)")
+                    self._state = CircuitState.HALF_OPEN
+                else:
+                    raise CircuitBreakerOpenError(f"{self.name}: Circuit is OPEN, rejecting call")
+
+    async def _on_success(self):
+        """Handle successful call"""
+        async with self._lock:
+            if self._state == CircuitState.HALF_OPEN:
+                logger.info(f"{self.name}: Recovery successful, closing circuit")
+                self._state = CircuitState.CLOSED
+                self._failure_count = 0
+                self._last_failure_time = None
+            elif self._state == CircuitState.CLOSED:
+                # Reset failure count on success
+                self._failure_count = 0
+
+    async def _on_failure(self):
+        """Handle failed call"""
+        async with self._lock:
+            self._failure_count += 1
+            self._last_failure_time = datetime.now(timezone.utc)
+
+            if self._state == CircuitState.HALF_OPEN:
+                logger.warning(f"{self.name}: Recovery failed, reopening circuit")
+                self._state = CircuitState.OPEN
+            elif self._state == CircuitState.CLOSED:
+                if self._failure_count >= self.failure_threshold:
+                    logger.error(
+                        f"{self.name}: Failure threshold reached ({self._failure_count}), "
+                        f"opening circuit"
+                    )
+                    self._state = CircuitState.OPEN
+                else:
+                    logger.warning(
+                        f"{self.name}: Failure {self._failure_count}/{self.failure_threshold}"
+                    )
+
+    def reset(self):
+        """Manually reset circuit breaker"""
+        self._state = CircuitState.CLOSED
+        self._failure_count = 0
+        self._last_failure_time = None
+        logger.info(f"{self.name}: Circuit manually reset")
+
+    async def call(self, func, *args, **kwargs):
+        """
+        Execute a function with circuit breaker protection.
+
+        Args:
+            func: Async function to execute
+            *args: Positional arguments for func
+            **kwargs: Keyword arguments for func
+
+        Returns:
+            Result of func
+
+        Raises:
+            CircuitBreakerOpenError: If circuit is open
+            Exception: Any exception raised by func
+        """
+        async with self:
+            return await func(*args, **kwargs)
+
+
+@dataclass
+class ServiceToken:
+    """Service account token"""
+
+    access_token: str
+    token_type: str
+    expires_in: int
+    created_at: datetime = datetime.now(timezone.utc)  # Default to current time
+
+    @property
+    def is_expired(self) -> bool:
+        """Check if token is expired (with buffer)"""
+        settings = get_settings()
+        expiry_time = self.created_at + timedelta(
+            seconds=self.expires_in - settings.TOKEN_REFRESH_BUFFER
+        )
+        return datetime.now(timezone.utc) > expiry_time
+
+    @property
+    def authorization_header(self) -> str:
+        """Get authorization header value"""
+        return f"{self.token_type} {self.access_token}"
+
+
+class ServiceAuthClient:
+    """
+    Client for obtaining and managing service account tokens from Keycloak.
+    Includes circuit breaker for resilience against Keycloak failures.
+    """
+
+    def __init__(self):
+        """Initialize service auth client with circuit breaker"""
+        settings = get_settings()
+        self.token_url = f"{settings.KEYCLOAK_REALM_URL}/protocol/openid-connect/token"
+        self.client_id = settings.SERVICE_CLIENT_ID
+        self.client_secret = settings.SERVICE_CLIENT_SECRET
+        self._token: Optional[ServiceToken] = None
+        self._lock = asyncio.Lock()
+        self._http_client: Optional[httpx.AsyncClient] = None
+
+        # Initialize circuit breaker
+        self._circuit_breaker: CircuitBreaker = CircuitBreaker(
+            failure_threshold=settings.CIRCUIT_BREAKER_FAILURE_THRESHOLD,
+            recovery_timeout=settings.CIRCUIT_BREAKER_RECOVERY_TIMEOUT,
+            expected_exception=(httpx.RequestError, HTTPException),
+            name="ServiceAuthCircuit",
+        )
+
+    @property
+    async def http_client(self) -> httpx.AsyncClient:
+        """Get or create HTTP client"""
+        if self._http_client is None:
+            settings = get_settings()
+            self._http_client = httpx.AsyncClient(
+                timeout=httpx.Timeout(settings.HTTP_TIMEOUT),
+                limits=httpx.Limits(max_keepalive_connections=5),
+            )
+        return self._http_client
+
+    async def _fetch_token(self) -> ServiceToken:
+        """
+        Internal method to fetch token from Keycloak.
+
+        Returns:
+            ServiceToken
+
+        Raises:
+            HTTPException: If token fetch fails
+        """
+        client = await self.http_client
+        response = await client.post(
+            self.token_url,
+            data={
+                "grant_type": "client_credentials",
+                "client_id": self.client_id,
+                "client_secret": self.client_secret,
+                "scope": "openid profile",
+            },
+            headers={"Content-Type": "application/x-www-form-urlencoded"},
+        )
+
+        if response.status_code != 200:
+            logger.error(f"Failed to get service token: {response.status_code} - {response.text}")
+            raise HTTPException(
+                status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+                detail="Unable to authenticate service",
+            )
+
+        token_data = response.json()
+        return ServiceToken(
+            access_token=token_data["access_token"],
+            token_type=token_data.get("token_type", "Bearer"),
+            expires_in=token_data.get("expires_in", 300),
+        )
+
+    async def get_service_token(self) -> str:
+        """
+        Get service account token for service-to-service calls.
+        Uses circuit breaker for resilience against Keycloak failures.
+
+        Returns:
+            Authorization header value (e.g., "Bearer token")
+
+        Raises:
+            CircuitBreakerOpenError: If circuit is open due to repeated failures
+            HTTPException: If token fetch fails
+        """
+        async with self._lock:
+            # Return cached token if still valid
+            if self._token and not self._token.is_expired:
+                return self._token.authorization_header
+
+            # Get new token with circuit breaker protection
+            try:
+                self._token = await self._circuit_breaker.call(self._fetch_token)
+                if self._token is not None:
+                    logger.info(
+                        f"Obtained new service token for {self.client_id}, "
+                        f"expires in {self._token.expires_in} seconds"
+                    )
+                    return self._token.authorization_header
+                else:
+                    logger.error("Failed to obtain service token: token is None")
+                    raise HTTPException(
+                        status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                        detail="Failed to authenticate service",
+                    )
+
+            except CircuitBreakerOpenError:
+                logger.error("Circuit breaker is open - Keycloak is unavailable")
+                raise HTTPException(
+                    status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+                    detail="Authentication service temporarily unavailable",
+                )
+            except httpx.RequestError as e:
+                logger.error(f"Failed to connect to Keycloak: {e}")
+                raise HTTPException(
+                    status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+                    detail="Authentication service unavailable",
+                )
+            except Exception as e:
+                logger.error(f"Unexpected error getting service token: {e}")
+                raise HTTPException(
+                    status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+                    detail="Failed to authenticate service",
+                )
+
+    @property
+    def circuit_state(self) -> CircuitState:
+        """Get current circuit breaker state"""
+        return self._circuit_breaker.state
+
+    def reset_circuit(self):
+        """Manually reset circuit breaker"""
+        self._circuit_breaker.reset()
+
+    async def close(self):
+        """Close HTTP client and clean up resources"""
+        if self._http_client:
+            await self._http_client.aclose()
+            self._http_client = None
+
+
+# Global instance management
+_service_auth_client: Optional[ServiceAuthClient] = None
+
+
+def get_service_auth_client() -> ServiceAuthClient:
+    """Get or create service auth client"""
+    global _service_auth_client
+    if _service_auth_client is None:
+        _service_auth_client = ServiceAuthClient()
+    return _service_auth_client
+
+
+async def cleanup_service_auth():
+    """Cleanup service auth resources"""
+    global _service_auth_client
+    if _service_auth_client:
+        await _service_auth_client.close()
+        _service_auth_client = None

{auth_gate-0.2.0 → auth_gate-0.2.2/src/auth_gate.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: auth-gate
-Version: 0.2.0
+Version: 0.2.2
 Summary: Enterprise-grade authentication for microservices with Kong and Keycloak integration
 Home-page: https://github.com/tradelink-org/auth-gate
 Author: Brian Mburu

{auth_gate-0.2.0 → auth_gate-0.2.2}/src/auth_gate.egg-info/SOURCES.txt

@@ -6,6 +6,7 @@ src/auth_gate/__init__.py
 src/auth_gate/config.py
 src/auth_gate/fastapi_utils.py
 src/auth_gate/middleware.py
+src/auth_gate/s2s_auth.py
 src/auth_gate/schemas.py
 src/auth_gate/user_auth.py
 src/auth_gate.egg-info/PKG-INFO
@@ -19,5 +20,6 @@ src/tests/test_config.py
 src/tests/test_fastapi_utils.py
 src/tests/test_intergration.py
 src/tests/test_middleware.py
+src/tests/test_s2s_auth.py
 src/tests/test_schema.py
 src/tests/test_user_auth.py

{auth_gate-0.2.0 → auth_gate-0.2.2}/src/tests/conftest.py

@@ -12,6 +12,7 @@ from httpx import AsyncClient
 
 from auth_gate import AuthSettings, ServiceContext, UserContext
 from auth_gate.config import AuthMode, reset_settings
+from auth_gate.s2s_auth import ServiceAuthClient
 from auth_gate.user_auth import UserValidator, cleanup_user_validator
 
 
@@ -60,9 +61,10 @@ def mock_settings():
     )
     with patch("auth_gate.config.get_settings", return_value=settings):
         with patch("auth_gate.user_auth.get_settings", return_value=settings):
-            with patch("auth_gate.middleware.get_settings", return_value=settings):
-                with patch("auth_gate.fastapi_utils.get_settings", return_value=settings):
-                    yield settings
+            with patch("auth_gate.s2s_auth.get_settings", return_value=settings):
+                with patch("auth_gate.middleware.get_settings", return_value=settings):
+                    with patch("auth_gate.fastapi_utils.get_settings", return_value=settings):
+                        yield settings
 
 
 @pytest_asyncio.fixture(autouse=True)
@@ -231,3 +233,17 @@ async def bypass_validator():
 
     # Clean up after each test
     await validator.close()
+
+
+@pytest_asyncio.fixture
+async def service_auth_client():
+    """Fixture to create and clean up UserValidator instance"""
+    # Reset settings to ensure clean state
+    reset_settings()
+
+    # Create validator with DIRECT_KEYCLOAK mode
+    auth_client = ServiceAuthClient()
+    yield auth_client
+
+    # Clean up after each test
+    await auth_client.close()

auth_gate-0.2.2/src/tests/test_s2s_auth.py

@@ -0,0 +1,295 @@
+"""
+Tests for service-to-service authentication
+"""
+
+import asyncio
+from datetime import datetime, timedelta, timezone
+from unittest.mock import AsyncMock, patch
+
+import httpx
+import pytest
+from fastapi import HTTPException
+
+from auth_gate.s2s_auth import (
+    CircuitBreaker,
+    CircuitBreakerOpenError,
+    CircuitState,
+    ServiceToken,
+)
+
+
+class TestCircuitBreaker:
+    """Test CircuitBreaker implementation"""
+
+    @pytest.mark.asyncio
+    async def test_circuit_breaker_closed_state(self):
+        """Test circuit breaker in closed state allows calls"""
+        breaker = CircuitBreaker(failure_threshold=3)
+
+        assert breaker.state == CircuitState.CLOSED
+        assert breaker.is_closed is True
+
+        # Successful calls should pass through
+        async with breaker:
+            pass  # Successful operation
+
+        assert breaker.state == CircuitState.CLOSED
+
+    @pytest.mark.asyncio
+    async def test_circuit_breaker_opens_after_threshold(self):
+        """Test circuit breaker opens after failure threshold"""
+        breaker = CircuitBreaker(failure_threshold=3)
+
+        # Simulate failures
+        for i in range(3):
+            try:
+                async with breaker:
+                    raise ValueError("Test failure")
+            except ValueError:
+                pass
+
+        assert breaker.state == CircuitState.OPEN
+        assert breaker.is_open is True
+
+    @pytest.mark.asyncio
+    async def test_circuit_breaker_rejects_calls_when_open(self):
+        """Test circuit breaker rejects calls when open"""
+        breaker = CircuitBreaker(failure_threshold=2)
+
+        # Open the circuit
+        for i in range(2):
+            try:
+                async with breaker:
+                    raise ValueError("Test failure")
+            except ValueError:
+                pass
+
+        # Should reject calls when open
+        with pytest.raises(CircuitBreakerOpenError):
+            async with breaker:
+                pass
+
+    @pytest.mark.asyncio
+    async def test_circuit_breaker_half_open_recovery(self):
+        """Test circuit breaker recovery through half-open state"""
+        breaker = CircuitBreaker(failure_threshold=2, recovery_timeout=0)  # Instant recovery
+
+        # Open the circuit
+        for i in range(2):
+            try:
+                async with breaker:
+                    raise ValueError("Test failure")
+            except ValueError:
+                pass
+
+        assert breaker.state == CircuitState.OPEN
+
+        # Wait a tiny bit for recovery timeout
+        await asyncio.sleep(0.01)
+
+        # Should transition to half-open and allow one call
+        async with breaker:
+            pass  # Successful call
+
+        assert breaker.state == CircuitState.CLOSED
+
+    @pytest.mark.asyncio
+    async def test_circuit_breaker_half_open_failure(self):
+        """Test circuit breaker reopens on half-open failure"""
+        breaker = CircuitBreaker(failure_threshold=2, recovery_timeout=0)
+
+        # Open the circuit
+        for i in range(2):
+            try:
+                async with breaker:
+                    raise ValueError("Test failure")
+            except ValueError:
+                pass
+
+        # Wait for recovery
+        await asyncio.sleep(0.01)
+
+        # Fail during half-open
+        try:
+            async with breaker:
+                raise ValueError("Recovery failure")
+        except ValueError:
+            pass
+
+        assert breaker.state == CircuitState.OPEN
+
+    @pytest.mark.asyncio
+    async def test_circuit_breaker_call_wrapper(self):
+        """Test circuit breaker call wrapper method"""
+        breaker = CircuitBreaker(failure_threshold=3)
+
+        async def successful_func(x, y):
+            return x + y
+
+        result = await breaker.call(successful_func, 2, 3)
+        assert result == 5
+
+        async def failing_func():
+            raise ValueError("Test error")
+
+        with pytest.raises(ValueError):
+            await breaker.call(failing_func)
+
+    def test_circuit_breaker_reset(self):
+        """Test manual circuit breaker reset"""
+        breaker = CircuitBreaker(failure_threshold=1)
+
+        # Open the circuit by causing a failure
+        with pytest.raises(ValueError):
+            asyncio.run(breaker.call(lambda: (_ for _ in ()).throw(ValueError("Test error"))))
+
+        # At this point, the circuit should be open
+        assert breaker.state == CircuitState.OPEN
+
+        # Reset manually
+        breaker.reset()
+
+        assert breaker.state == CircuitState.CLOSED
+        assert breaker._failure_count == 0
+        assert breaker._last_failure_time is None
+
+
+class TestServiceToken:
+    """Test ServiceToken model"""
+
+    def test_service_token_not_expired(self):
+        """Test service token expiration check"""
+        token = ServiceToken(
+            access_token="test-token",
+            token_type="Bearer",
+            expires_in=300,
+            created_at=datetime.now(timezone.utc),
+        )
+
+        assert token.is_expired is False
+        assert token.authorization_header == "Bearer test-token"
+
+    def test_service_token_expired(self):
+        """Test expired service token"""
+        token = ServiceToken(
+            access_token="test-token",
+            token_type="Bearer",
+            expires_in=300,
+            created_at=datetime.now(timezone.utc) - timedelta(seconds=400),
+        )
+
+        assert token.is_expired is True
+
+
+class TestServiceAuthClient:
+    """Test ServiceAuthClient"""
+
+    @pytest.mark.asyncio
+    async def test_get_service_token_success(
+        self, mock_settings, service_auth_client, service_token_response
+    ):
+        """Test successful service token acquisition"""
+        with patch.object(httpx.AsyncClient, "post", new=AsyncMock()) as mock_post:
+            mock_post.return_value = httpx.Response(status_code=200, json=service_token_response)
+            token = await service_auth_client.get_service_token()
+
+            assert token == "Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.test"
+            assert service_auth_client._token is not None
+            mock_post.assert_called_once()
+
+    @pytest.mark.asyncio
+    async def test_get_service_token_cached(
+        self, mock_settings, service_auth_client, service_token_response
+    ):
+        """Test service token caching"""
+        with patch.object(httpx.AsyncClient, "post", new=AsyncMock()) as mock_post:
+            mock_post.return_value = httpx.Response(status_code=200, json=service_token_response)
+            # First call
+            token1 = await service_auth_client.get_service_token()
+
+            # Second call should use cache
+            token2 = await service_auth_client.get_service_token()
+
+            assert token1 == token2
+            # HTTP client should only be called once
+            mock_post.assert_called_once()
+
+    @pytest.mark.asyncio
+    async def test_get_service_token_refresh_on_expiry(
+        self, mock_settings, service_auth_client, service_token_response
+    ):
+        """Test service token refresh on expiry"""
+        # Set an already expired token
+        service_auth_client._token = ServiceToken(
+            access_token="old-token",
+            token_type="Bearer",
+            expires_in=300,
+            created_at=datetime.now(timezone.utc) - timedelta(seconds=400),
+        )
+
+        with patch.object(httpx.AsyncClient, "post", new=AsyncMock()) as mock_post:
+            mock_post.return_value = httpx.Response(status_code=200, json=service_token_response)
+
+            token = await service_auth_client.get_service_token()
+
+            assert token == "Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.test"
+            mock_post.assert_called_once()
+
+    @pytest.mark.asyncio
+    async def test_get_service_token_circuit_breaker_open(self, mock_settings, service_auth_client):
+        """Test service token with open circuit breaker"""
+        # Manually open the circuit breaker
+        service_auth_client._circuit_breaker._state = CircuitState.OPEN
+        service_auth_client._circuit_breaker._last_failure_time = datetime.now(timezone.utc)
+
+        with pytest.raises(HTTPException) as exc_info:
+            await service_auth_client.get_service_token()
+
+        assert exc_info.value.status_code == 503
+        assert "temporarily unavailable" in exc_info.value.detail
+
+    @pytest.mark.asyncio
+    async def test_get_service_token_connection_error(self, mock_settings, service_auth_client):
+        """Test service token with connection error"""
+        with patch.object(httpx.AsyncClient, "post", new=AsyncMock()) as mock_post:
+            mock_post.side_effect = httpx.RequestError("Connection failed")
+
+            with pytest.raises(HTTPException) as exc_info:
+                await service_auth_client.get_service_token()
+
+            assert exc_info.value.status_code == 503
+
+    @pytest.mark.asyncio
+    async def test_get_service_token_circuit_breaker_integration(
+        self, mock_settings, service_auth_client
+    ):
+        """Test circuit breaker integration with service token"""
+        # Simulate multiple failures to open circuit
+        with patch.object(httpx.AsyncClient, "post", new=AsyncMock()) as mock_post:
+            mock_post.side_effect = httpx.RequestError("Connection failed")
+
+            # First few failures should be allowed
+            for i in range(mock_settings.CIRCUIT_BREAKER_FAILURE_THRESHOLD):
+                with pytest.raises(HTTPException):
+                    await service_auth_client.get_service_token()
+
+            # Circuit should now be open
+            assert service_auth_client.circuit_state == CircuitState.OPEN
+
+            # Next call should be rejected immediately
+            with pytest.raises(HTTPException) as exc_info:
+                await service_auth_client.get_service_token()
+
+            assert "temporarily unavailable" in exc_info.value.detail
+
+    def test_circuit_state_property(self, service_auth_client):
+        """Test circuit state property"""
+        assert service_auth_client.circuit_state == CircuitState.CLOSED
+
+    def test_reset_circuit(self, service_auth_client):
+        """Test manual circuit reset"""
+        service_auth_client._circuit_breaker._state = CircuitState.OPEN
+
+        service_auth_client.reset_circuit()
+
+        assert service_auth_client.circuit_state == CircuitState.CLOSED