certapi 1.1.5__tar.gz → 1.1.7__tar.gz

{certapi-1.1.5/src/certapi.egg-info → certapi-1.1.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: certapi
-Version: 1.1.5
+Version: 1.1.7
 Summary: Python Package for managing keys, request SSL certificates from ACME.
 Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai
@@ -10,7 +10,7 @@ Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: OS Independent
 Requires-Python: >=3.6
 Description-Content-Type: text/markdown
-Requires-Dist: cryptography
+Requires-Dist: cryptography>=39.0.0
 Requires-Dist: requests
 Dynamic: author
 Dynamic: author-email

{certapi-1.1.5 → certapi-1.1.7}/setup.py

@@ -2,11 +2,11 @@ from setuptools import setup, find_packages
 
 setup(
     name="certapi",
-    version="1.1.5",
+    version="1.1.7",
     packages=find_packages(where="src"),
     package_dir={"": "src"},
     install_requires=[
-        "cryptography",
+        "cryptography>=39.0.0",
         "requests",
     ],
     include_package_data=True,

{certapi-1.1.5 → certapi-1.1.7}/src/certapi/client/renewal_manager.py

@@ -18,9 +18,13 @@ class RenewalManager:
     callers publish the complete desired domain set through
     :meth:`update_watch_domains`. Publishing a domain set is synchronous: the call
     returns after certapi has processed the set and attempted any due
-    obtain/renew work. Each renewal pass first calls the optional
-    ``sync_watch_domains`` callback so integrations can republish the latest
-    domain list before certapi decides what to obtain or renew.
+    obtain/renew work.
+
+    The integration owns domain discovery. Certapi's background renewal cycle
+    only invokes ``renewal_callback`` when it is time to refresh external state;
+    that callback is responsible for calling :meth:`update_watch_domains` with
+    the current complete domain set. ``update_watch_domains`` is the only method
+    that mutates watched domains and performs due renewal work.
 
     Algorithm:
     - Maintain a watched domain set and cache each domain's certificate expiry.
@@ -48,7 +52,7 @@ class RenewalManager:
     def __init__(
         self,
         cert_manager_client,
-        sync_watch_domains: Optional[Callable[[], None]] = None,
+        renewal_callback: Optional[Callable[[], None]] = None,
         renew_threshold_days: Optional[int] = None,
         min_renew_threshold_days: int = 10,
         sleep_slack_seconds: int = 300,
@@ -75,11 +79,10 @@ class RenewalManager:
             cert_manager_client: Backend object with an ``obtain(domains,
                 **kwargs)`` method. Local managers and ``CertManagerClient`` are
                 both supported.
-            sync_watch_domains: Optional callback invoked at the start of each
-                renewal pass. The callback should call :meth:`update_watch_domains`
-                with the latest desired domain list. Calls made from this
-                callback only update the in-progress cycle and do not start a
-                nested renewal pass.
+            renewal_callback: Optional callback invoked by background or forced
+                renewal cycles. Integrations should use this to recompute their
+                domain list and call :meth:`update_watch_domains`. The callback
+                itself should not perform certificate issuance directly.
             renew_threshold_days: Renew certificates when they expire within
                 this many days. Defaults to ``CERT_RENEW_THRESHOLD_DAYS`` or the
                 certapi default.
@@ -113,7 +116,7 @@ class RenewalManager:
                 certs.
         """
         self.cert_manager_client = cert_manager_client
-        self.sync_watch_domains = sync_watch_domains
+        self.renewal_callback = renewal_callback
         self.key_type = key_type
         self.expiry_days = expiry_days
         self.batch_domains = batch_domains
@@ -154,6 +157,10 @@ class RenewalManager:
         self._cycle_running = False
         self._cycle_thread_id: Optional[int] = None
         self._cycle_generation = 0
+        self._renewal_running = False
+        self._renewal_requested = False
+        self._renewal_thread_id: Optional[int] = None
+        self._renewal_generation = 0
         self._blacklist: Dict[str, datetime] = {}
         self._last_error_message: Optional[str] = None
         self._last_error_timestamp: Optional[datetime] = None
@@ -166,30 +173,20 @@ class RenewalManager:
         Empty values are ignored. Cache and blacklist entries for domains no
         longer being watched are dropped.
 
-        When called outside an active renewal cycle, this method immediately
-        runs or wakes a renewal pass and blocks until certapi has attempted any
-        due obtain/renew work for the published set. When called from
-        ``sync_watch_domains`` during a renewal cycle, it only updates the set
-        being processed and returns immediately to avoid recursive cycles.
+        This method immediately runs or queues a renewal pass and blocks until
+        certapi has attempted any due obtain/renew work for the latest published
+        set. Concurrent calls are serialized inside the manager; if a renewal
+        pass is already running, the current pass is allowed to finish and a
+        follow-up pass processes the newest watch set before callers return.
         """
         new_watch_set = {x for x in domains if x}
         with self._lock:
             self._watch_domains = new_watch_set
             self._cache = {d: expiry for d, expiry in self._cache.items() if d in self._watch_domains}
             self._blacklist = {d: exp for d, exp in self._blacklist.items() if d in self._watch_domains}
-            if self._cycle_thread_id == threading.get_ident():
-                self._lock.notify_all()
-                return
-            if self._running:
-                target_generation = self._cycle_generation + (2 if self._cycle_running else 1)
-                self._cycle_requested = True
-                self._lock.notify_all()
-                while self._running and self._cycle_generation < target_generation:
-                    self._lock.wait()
-                return
             self._lock.notify_all()
 
-        self._run_cycle(force=False)
+        self._run_renewal_pass(force=False)
 
     def start(self):
         """
@@ -227,15 +224,13 @@ class RenewalManager:
 
     def trigger_now(self):
         """
-        Run a renewal pass immediately.
+        Run the renewal trigger immediately.
 
-        When the background worker is not running, this method performs the
-        renewal pass in the caller's thread and returns after it completes. When
-        the worker is running, this method wakes it and blocks until the
-        requested renewal pass has completed.
-
-        Most integrations should call :meth:`update_watch_domains` instead. This
-        method is for forcing a pass without changing the watched domain set.
+        When a renewal callback is configured, this method invokes that callback
+        and waits for it to return. The callback should call
+        :meth:`update_watch_domains`, which performs due renewal work. Without a
+        callback, this method performs a direct forced renewal pass over the
+        existing watch set.
 
         If called from inside the renewal cycle itself, the method only requests
         a follow-up pass and returns immediately to avoid deadlock.
@@ -321,14 +316,6 @@ class RenewalManager:
         # Testing hook: allows deterministic no-op sleep behavior.
         self.sleep_fn(wait_seconds)
 
-    def _sync_watch_domains(self):
-        if self.sync_watch_domains is None:
-            return
-        try:
-            self.sync_watch_domains()
-        except Exception as e:
-            self._set_error(e)
-
     def _due_window_secs(self) -> float:
         return max(self.update_threshold_secs, self.cert_min_renew_threshold_secs)
 
@@ -366,7 +353,49 @@ class RenewalManager:
                 self._lock.notify_all()
 
     def _run_cycle_body(self, force: bool = False) -> int:
-        self._sync_watch_domains()
+        if self.renewal_callback is None:
+            return self._run_renewal_pass(force=force)
+
+        try:
+            self.renewal_callback()
+        except Exception as e:
+            self._set_error(e)
+        return 0
+
+    def _run_renewal_pass(self, force: bool = False) -> int:
+        count = 0
+        current_thread_id = threading.get_ident()
+        with self._lock:
+            if self._renewal_thread_id == current_thread_id:
+                return 0
+            if self._renewal_running:
+                target_generation = self._renewal_generation + 2
+                self._renewal_requested = True
+                self._lock.notify_all()
+                while self._renewal_generation < target_generation:
+                    self._lock.wait()
+                return 0
+
+            self._renewal_running = True
+            self._renewal_thread_id = current_thread_id
+
+        try:
+            while True:
+                count += self._run_renewal_pass_body(force=force)
+                with self._lock:
+                    self._renewal_generation += 1
+                    if not self._renewal_requested:
+                        return count
+                    self._renewal_requested = False
+                    force = False
+                    self._lock.notify_all()
+        finally:
+            with self._lock:
+                self._renewal_running = False
+                self._renewal_thread_id = None
+                self._lock.notify_all()
+
+    def _run_renewal_pass_body(self, force: bool = False) -> int:
         self._seed_cache_from_local_keystore()
         now = self.clock_fn()
         self._clean_blacklist(now)
@@ -390,8 +419,8 @@ class RenewalManager:
             if (expiry - now).total_seconds() < due_window:
                 due_domains.append(domain)
 
-        for domain in due_domains:
-            self._renew_domain(domain, now)
+        if due_domains:
+            self._renew_domains(due_domains, now)
 
         return len(due_domains)
 
@@ -434,10 +463,12 @@ class RenewalManager:
                     self._cache[domain] = expiry
             self._lock.notify_all()
 
-    def _renew_domain(self, domain: str, now: datetime):
-        domain_had_cached_entry = False
+    def _renew_domains(self, domains: List[str], now: datetime):
+        domains_with_cached_entries = []
         with self._lock:
-            domain_had_cached_entry = domain in self._cache
+            for domain in domains:
+                if domain in self._cache:
+                    domains_with_cached_entries.append(domain)
 
         try:
             renew_threshold_days = self.cert_min_renew_threshold_secs // (24 * 3600)
@@ -446,7 +477,7 @@ class RenewalManager:
                 "expiry_days": self.expiry_days,
                 "renew_threshold_days": renew_threshold_days,
                 "skip_failing": False,
-                "batch_domains": self.batch_domains,
+                "batch_domains": True,
                 "self_verify": self.self_verify,
                 "country": self.country,
                 "state": self.state,
@@ -456,7 +487,7 @@ class RenewalManager:
             }
             res = self._call_certificate_backend(
                 self.cert_manager_client.obtain,
-                [domain],
+                domains,
                 obtain_options,
             )
             if res is None:
@@ -464,11 +495,12 @@ class RenewalManager:
             self._update_expiry_cache(res.issued + res.existing)
         except Exception as e:
             self._set_error(e)
-            self._add_to_blacklist(domain, now)
-            if domain_had_cached_entry or self._has_local_certificate(domain):
-                self._schedule_existing_certificate_retry(domain, now)
-            else:
-                self._register_self_signed(domain)
+            for domain in domains:
+                self._add_to_blacklist(domain, now)
+                if domain in domains_with_cached_entries or self._has_local_certificate(domain):
+                    self._schedule_existing_certificate_retry(domain, now)
+                else:
+                    self._register_self_signed(domain)
 
     def _schedule_existing_certificate_retry(self, domain: str, now: datetime):
         retry_interval_seconds = min(self.renew_retry_interval_seconds, 24 * 3600)

{certapi-1.1.5 → certapi-1.1.7}/src/certapi/issuers/AcmeCertIssuer.py

@@ -95,7 +95,7 @@ class AcmeCertIssuer(CertIssuer):
                     return order.get_certificate()
                 return None
             elif order.status == "processing":
-                return obtain_cert()
+                return obtain_cert(count - 1)
             return None  # TODO: error throwing here
 
         return obtain_cert()

{certapi-1.1.5 → certapi-1.1.7/src/certapi.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: certapi
-Version: 1.1.5
+Version: 1.1.7
 Summary: Python Package for managing keys, request SSL certificates from ACME.
 Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai
@@ -10,7 +10,7 @@ Classifier: License :: OSI Approved :: MIT License
 Classifier: Operating System :: OS Independent
 Requires-Python: >=3.6
 Description-Content-Type: text/markdown
-Requires-Dist: cryptography
+Requires-Dist: cryptography>=39.0.0
 Requires-Dist: requests
 Dynamic: author
 Dynamic: author-email

certapi-1.1.7/src/certapi.egg-info/requires.txt

@@ -0,0 +1,2 @@
+cryptography>=39.0.0
+requests

{certapi-1.1.5 → certapi-1.1.7}/tests/test_renewal_manager.py

@@ -25,7 +25,7 @@ class DummyClient:
 
     def obtain(self, hosts, **kwargs):
         host = hosts[0] if isinstance(hosts, list) else hosts
-        self.calls.append({"host": host, "kwargs": kwargs})
+        self.calls.append({"host": host, "hosts": hosts, "kwargs": kwargs})
         handler = self._handlers.get(host)
         if handler is None:
             return CertificateResponse()
@@ -47,12 +47,12 @@ class DummyClientWithObtain(DummyClient):
 
     def obtain(self, hosts, **kwargs):
         host = hosts[0] if isinstance(hosts, list) else hosts
-        self.obtain_calls.append({"host": host, "kwargs": kwargs})
+        self.obtain_calls.append({"host": host, "hosts": hosts, "kwargs": kwargs})
         return super().obtain(hosts, **kwargs)
 
     def issue_certificate(self, hosts, **kwargs):
         host = hosts[0] if isinstance(hosts, list) else hosts
-        self.issue_calls.append({"host": host, "kwargs": kwargs})
+        self.issue_calls.append({"host": host, "hosts": hosts, "kwargs": kwargs})
         return super().obtain(hosts, **kwargs)
 
 
@@ -325,7 +325,7 @@ def test_retry_deferral_suppresses_immediate_retry_and_force_when_blacklisted():
     assert len(client.calls) == 1
 
 
-def test_watch_domain_replacement_drops_unwatched_cache_and_sync_callback_replaces():
+def test_watch_domain_replacement_drops_unwatched_cache_and_external_update_processes_new_set():
     now = datetime(2026, 1, 1, tzinfo=UTC)
     client = DummyClient()
     cert_c = _make_cert_pem("c.example.com", now, valid_for_days=60)
@@ -334,12 +334,7 @@ def test_watch_domain_replacement_drops_unwatched_cache_and_sync_callback_replac
         CertificateResponse(issued=[IssuedCert(cert=cert_c, domains=["c.example.com"])], existing=[]),
     )
 
-    mgr = None
-
-    def sync_watch_domains():
-        mgr.update_watch_domains(["c.example.com"])
-
-    mgr = RenewalManager(client, sync_watch_domains=sync_watch_domains, clock_fn=lambda: now)
+    mgr = RenewalManager(client, clock_fn=lambda: now)
     mgr.update_watch_domains(["a.example.com", "b.example.com"])
     with mgr._lock:
         mgr._cache["a.example.com"] = now + timedelta(days=20)
@@ -349,8 +344,9 @@ def test_watch_domain_replacement_drops_unwatched_cache_and_sync_callback_replac
     with mgr._lock:
         assert "b.example.com" not in mgr._cache
 
-    # callback replaces watch set with c.example.com before renewal pass.
-    mgr.trigger_now()
+    # Integrations can publish new domain state directly, outside the timed
+    # renewal callback path.
+    mgr.update_watch_domains(["c.example.com"])
     state = mgr.get_state()
     assert state["watched_domains"] == ["c.example.com"]
     with mgr._lock:
@@ -527,21 +523,6 @@ def test_new_domain_failure_selfsigns_and_blacklists():
     assert len(client.calls) == 2
 
 
-def test_sync_callback_exception_sets_state_error():
-    now = datetime(2026, 1, 1, tzinfo=UTC)
-    mgr = RenewalManager(
-        DummyClient(),
-        sync_watch_domains=lambda: (_ for _ in ()).throw(RuntimeError("sync failed")),
-        clock_fn=lambda: now,
-    )
-
-    mgr.trigger_now()
-
-    state = mgr.get_state()
-    assert state["last_error_message"] == "sync failed"
-    assert state["last_error_timestamp"] == now.isoformat()
-
-
 def test_update_watch_domains_blocks_until_running_worker_processes_domains():
     now = datetime(2026, 1, 1, tzinfo=UTC)
     started = threading.Event()
@@ -572,7 +553,7 @@ def test_update_watch_domains_blocks_until_running_worker_processes_domains():
     assert client.calls[0]["host"] == "requested.example.com"
 
 
-def test_update_watch_domains_from_cycle_thread_does_not_request_extra_cycle():
+def test_renewal_cycle_invokes_callback_and_callback_updates_domains():
     now = datetime(2026, 1, 1, tzinfo=UTC)
     client = DummyClient()
     cert = _make_cert_pem("from-callback.example.com", now, valid_for_days=60)
@@ -582,26 +563,22 @@ def test_update_watch_domains_from_cycle_thread_does_not_request_extra_cycle():
     )
     mgr = None
 
-    def sync_watch_domains():
+    def renewal_callback():
         mgr.update_watch_domains(["from-callback.example.com"])
 
-    mgr = RenewalManager(client, sync_watch_domains=sync_watch_domains, clock_fn=lambda: now)
-    with mgr._lock:
-        mgr._running = True
-
-    mgr._run_cycle(force=False)
+    mgr = RenewalManager(client, renewal_callback=renewal_callback, clock_fn=lambda: now)
+    mgr.trigger_now()
 
     with mgr._lock:
+        assert mgr._watch_domains == {"from-callback.example.com"}
+        assert "from-callback.example.com" in mgr._cache
         assert mgr._force_trigger is False
         assert mgr._cycle_requested is False
     assert len(client.calls) == 1
 
 
-def test_running_trigger_now_blocks_until_synced_cycle_finishes():
+def test_running_trigger_now_blocks_until_callback_update_finishes():
     now = datetime(2026, 1, 1, tzinfo=UTC)
-    sync_count = 0
-    sync_ready = threading.Event()
-    sync_enabled = threading.Event()
     obtain_started = threading.Event()
     release_obtain = threading.Event()
     client = DummyClient()
@@ -613,20 +590,13 @@ def test_running_trigger_now_blocks_until_synced_cycle_finishes():
         release_obtain.wait(timeout=2)
         return CertificateResponse(issued=[IssuedCert(cert=cert, domains=[host])], existing=[])
 
-    def sync_watch_domains():
-        nonlocal sync_count
-        sync_count += 1
-        sync_ready.set()
-        if sync_enabled.is_set():
-            mgr.update_watch_domains(["blocking.example.com"])
+    def renewal_callback():
+        mgr.update_watch_domains(["blocking.example.com"])
 
     client.set_handler("blocking.example.com", slow_handler)
-    mgr = RenewalManager(client, sync_watch_domains=sync_watch_domains, clock_fn=lambda: now)
+    mgr = RenewalManager(client, renewal_callback=renewal_callback, clock_fn=lambda: now)
 
     mgr.start()
-    assert sync_ready.wait(timeout=2)
-
-    sync_enabled.set()
     trigger_thread = threading.Thread(target=mgr.trigger_now)
     trigger_thread.start()
 
@@ -637,7 +607,6 @@ def test_running_trigger_now_blocks_until_synced_cycle_finishes():
 
     mgr.stop()
     assert not trigger_thread.is_alive()
-    assert sync_count >= 2
     assert len(client.calls) == 1
     assert client.calls[0]["host"] == "blocking.example.com"
 
@@ -733,3 +702,16 @@ def test_stop_does_not_wait_for_hung_remote_request_thread():
 
     assert not mgr._thread.is_alive()
     release.set()
+
+
+def test_renewal_manager_batches_due_domains():
+    now = datetime(2026, 1, 1, tzinfo=UTC)
+    client = DummyClientWithObtain()
+    client.set_handler("domain1.com", CertificateResponse())
+
+    mgr = RenewalManager(client, renew_threshold_days=30, clock_fn=lambda: now, batch_domains=True)
+    mgr.update_watch_domains(["domain1.com", "domain2.com"])
+
+    assert len(client.obtain_calls) == 1
+    assert "domain1.com" in client.obtain_calls[0]["hosts"]
+    assert "domain2.com" in client.obtain_calls[0]["hosts"]

certapi-1.1.5/src/certapi.egg-info/requires.txt

@@ -1,2 +0,0 @@
-cryptography
-requests