ctrader-api-client 0.7.2__tar.gz → 0.7.3__tar.gz

{ctrader_api_client-0.7.2 → ctrader_api_client-0.7.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ctrader-api-client
-Version: 0.7.2
+Version: 0.7.3
 Summary: API Client to interact with the cTrader Open API spec
 Author-email: Elio <elioachukri@pm.me>
 License-File: LICENSE

{ctrader_api_client-0.7.2 → ctrader_api_client-0.7.3}/docs/api/events.md

@@ -146,6 +146,14 @@ async def on_reconnected(event: ReconnectedEvent):
         print(f"Failed accounts: {event.failed_accounts}")
 ```
 
+An `app_auth_restored=False` is not the end of the story. The server can refuse
+application authentication for transient reasons of its own, so the client keeps
+retrying with backoff and announces each account it restores afterwards with a
+`ReadyEvent`. Treat this event as a signal that the link is back but degraded —
+stop acting on the session until the accounts are announced ready — rather than
+as a permanent failure. Check the current state with
+`client.auth.is_app_authenticated`.
+
 ::: ctrader_api_client.events.ClientDisconnectEvent
     options:
       show_source: false

{ctrader_api_client-0.7.2 → ctrader_api_client-0.7.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "ctrader-api-client"
-version = "0.7.2"
+version = "0.7.3"
 description = "API Client to interact with the cTrader Open API spec"
 readme = "README.md"
 authors = [
@@ -79,6 +79,7 @@ select = [
     "RUF022", # Unsorted __all__ blocks
     "FURB157",  # Check unnecessary casts in Decimal constructors
     "RUF032",  # Check for Decimal calls passing a float literal
+    "G004",  # Check for all f strings in logging calls
 ]
 
 [tool.ruff.lint.per-file-ignores]

{ctrader_api_client-0.7.2 → ctrader_api_client-0.7.3}/src/ctrader_api_client/auth/_recovery.py

@@ -60,6 +60,14 @@ class SessionRecovery:
         # repeated report does not start a second check against the server.
         self._verifying: set[int] = set()
 
+        # A reconnect whose application re-authentication failed, left for the
+        # recovery loop to keep retrying. Nothing can be authorized on a link
+        # the application itself is not authenticated on, so this is settled
+        # before any account is attempted.
+        self._app_auth_pending = False
+        self._app_auth_attempts = 0
+        self._app_auth_next_at = 0.0
+
         self._task_scope: anyio.CancelScope | None = None
         self._running = False
 
@@ -85,6 +93,7 @@ class SessionRecovery:
         finally:
             self._running = False
             self._task_scope = None
+            self._app_auth_pending = False
             self._store.invalidate_all()
             logger.debug("Session recovery monitor stopped")
 
@@ -181,6 +190,11 @@ class SessionRecovery:
         credentials are kept, so the sessions can be re-established once the
         link is back.
         """
+        # Any application re-authentication still being retried belonged to the
+        # link that just died. The reconnection attempts it again from scratch
+        # and re-arms this if it has to, so carrying the old state forward would
+        # only make the next backoff start deeper than it should.
+        self._app_auth_pending = False
         self._store.invalidate_all()
 
     async def on_connection_restored(self) -> None:
@@ -190,6 +204,11 @@ class SessionRecovery:
         link is already back, and a caller can only act on a failure it is told
         about. Without application authentication nothing else can be
         attempted, so that failure is reported on its own.
+
+        Only the first attempt is made here. This runs inside the protocol's
+        reconnection task, which cannot detect a further drop while it is
+        blocked, so a failure is handed to the recovery loop to keep retrying in
+        the background rather than waited out inline.
         """
         logger.debug("Connection restored, re-authenticating...")
 
@@ -197,7 +216,8 @@ class SessionRecovery:
             await self._authenticator.authenticate_app()
             logger.debug("App re-authenticated successfully")
         except Exception as e:
-            logger.error("Failed to re-authenticate app after reconnect: %s", e)
+            logger.error("Failed to re-authenticate app after reconnect, will retry: %s", e)
+            self._arm_app_auth_recovery()
             await self._publisher.emit(
                 ReconnectedEvent(
                     app_auth_restored=False,
@@ -228,15 +248,66 @@ class SessionRecovery:
             )
         )
 
+    def _backoff_delay(self, attempts: int) -> float:
+        """How long to wait before attempt number `attempts`, per the policy."""
+        return min(self._policy.min_wait * 2 ** (attempts - 1), self._policy.max_wait)
+
     def _defer_recovery(self, account_id: int, state: AwaitingRecovery) -> None:
         """Back off before the next recovery attempt for a single account."""
         attempts = state.attempts + 1
-        delay = min(self._policy.min_wait * 2 ** (attempts - 1), self._policy.max_wait)
         self._store.reschedule_recovery(
             account_id,
-            AwaitingRecovery(attempts=attempts, next_attempt_at=self._clock.now() + delay),
+            AwaitingRecovery(
+                attempts=attempts,
+                next_attempt_at=self._clock.now() + self._backoff_delay(attempts),
+            ),
         )
 
+    def _arm_app_auth_recovery(self) -> None:
+        """Hand a failed application re-authentication to the recovery loop.
+
+        Every account is flagged alongside it: their sessions died with the
+        link, and the re-authentication that would have restored them is the
+        very thing that failed, so they are recovered by the same loop once the
+        application is authenticated again.
+        """
+        self._app_auth_pending = True
+        self._app_auth_attempts = 0
+        self._defer_app_auth()
+
+        for credentials in self._store.all_credentials():
+            self._store.flag_for_recovery(credentials.account_id)
+
+        self._reauth_signal.set()
+
+    def _defer_app_auth(self) -> None:
+        """Back off before the next application re-authentication attempt."""
+        self._app_auth_attempts += 1
+        self._app_auth_next_at = self._clock.now() + self._backoff_delay(self._app_auth_attempts)
+
+    async def _retry_app_auth(self) -> bool:
+        """Attempt the deferred application re-authentication once.
+
+        Returns:
+            True if the application is authenticated again, False if the
+            attempt failed and has been deferred for another try.
+        """
+        try:
+            await self._authenticator.authenticate_app()
+        except Exception as e:
+            self._defer_app_auth()
+            logger.warning(
+                "Re-authenticating the application failed (attempt %d), will retry: %s",
+                self._app_auth_attempts,
+                e,
+            )
+            return False
+
+        self._app_auth_pending = False
+        self._app_auth_attempts = 0
+        logger.info("Application re-authenticated; restoring accounts")
+        return True
+
     async def _wait_for_retry(self, delay: float, flagged: anyio.Event) -> None:
         """Wait out a backoff, returning early if another account needs recovery.
 
@@ -266,6 +337,11 @@ class SessionRecovery:
         and retries continue until every account succeeds, is removed, or the
         monitor stops. A successful re-auth restores authorized state and emits
         a ReadyEvent so subscriptions can be restored.
+
+        Also carries the application re-authentication a reconnect could not
+        complete. That one is not per-account and blocks every account behind
+        it, so it is settled first and the accounts are left flagged until it
+        succeeds.
         """
         while self._running:
             # Consume any pending notification before reading the queue, so a
@@ -274,6 +350,16 @@ class SessionRecovery:
                 self._reauth_signal = anyio.Event()
             flagged = self._reauth_signal
 
+            if self._app_auth_pending:
+                waiting = self._app_auth_next_at - self._clock.now()
+                if waiting > 0:
+                    await self._wait_for_retry(waiting, flagged)
+                    continue
+                if not await self._retry_app_auth():
+                    continue
+                # Authenticating the application is exactly what the flagged
+                # accounts were held up by, so go straight on to them.
+
             queue = self._store.awaiting_recovery()
             if not queue:
                 await flagged.wait()

{ctrader_api_client-0.7.2 → ctrader_api_client-0.7.3}/src/ctrader_api_client/connection/protocol.py

@@ -109,6 +109,11 @@ class Protocol:
         # reader loop and the heartbeat loop both detecting the same drop).
         self._reconnecting = False
 
+        # Set when the link drops again while a reconnection is already in
+        # flight. The detector that saw it cannot start its own reconnection,
+        # so the one already running goes round again on its behalf.
+        self._redo_requested = False
+
         # Told about link transitions; set by whoever owns this protocol.
         self._listener: ConnectionListener | None = None
 
@@ -444,11 +449,17 @@ class Protocol:
         standalone task decouples the reconnection from the cancel scope of
         whichever loop detected the drop.
 
-        Idempotent: calls made while a reconnection is already in flight are
-        ignored, so the reader and heartbeat loops racing to report the same
-        drop only produce a single reconnection.
+        Idempotent: calls made while a reconnection is already in flight do not
+        start a second one, so the reader and heartbeat loops racing to report
+        the same drop only produce a single reconnection. Such a call is still
+        recorded, because it may be reporting a *fresh* drop of the link the
+        running reconnection just restored — and the caller cannot retry for
+        itself, since the reader loop exits as soon as it has reported.
         """
-        if not self._running or self._reconnecting:
+        if not self._running:
+            return
+        if self._reconnecting:
+            self._redo_requested = True
             return
         if self._task_group is None:
             return
@@ -457,16 +468,25 @@ class Protocol:
         logger.warning("Connection lost, attempting to reconnect...")
 
         # State tied to the dead link is invalid from this moment on. Report it
-        # before reconnecting so nothing observes a session that no longer
-        # exists, and never let a failing listener block the reconnection.
-        if self._listener is not None:
-            try:
-                await self._listener.on_connection_lost()
-            except Exception:
-                logger.exception("Connection listener failed on disconnect")
+        # before reconnecting so nothing observes a session that no longer exists.
+        await self._notify_connection_lost()
 
         self._task_group.start_soon(self._reconnect_task)
 
+    async def _notify_connection_lost(self) -> None:
+        """Tell the listener the link is gone.
+
+        Never lets a failing listener block the reconnection: whatever
+        bookkeeping it does matters less than getting the link back.
+        """
+        if self._listener is None:
+            return
+
+        try:
+            await self._listener.on_connection_lost()
+        except Exception:
+            logger.exception("Connection listener failed on disconnect")
+
     async def _reconnect_task(self) -> None:
         """Own the full reconnection lifecycle from a standalone task.
 
@@ -475,20 +495,44 @@ class Protocol:
         escape: an unhandled error here would propagate into the protocol task
         group and tear down every other task. A terminal reconnection failure is
         instead recorded by stopping the protocol and waking pending requests.
+
+        Loops rather than running once, so a link that drops again while this is
+        working — reported through `handle_disconnect` as `_redo_requested`, the
+        only route left once the reader has exited — is reconnected too instead
+        of being stranded.
         """
         try:
-            # The reader loop is reading a dead stream; cancel it before we
-            # reconnect so a stale reader can't race the fresh one we restart.
-            if self._reader_scope is not None:
-                self._reader_scope.cancel()
-                self._reader_scope = None
-
-            # Close the old transport (idempotent — the task that detected the
-            # drop may have already raced us to it).
-            await self._transport.close()
-
-            await self._reconnect()
-            logger.info("Reconnection successful")
+            while True:
+                self._redo_requested = False
+
+                # The reader loop is reading a dead stream; cancel it before we
+                # reconnect so a stale reader can't race the fresh one we restart.
+                if self._reader_scope is not None:
+                    self._reader_scope.cancel()
+                    self._reader_scope = None
+
+                # Close the old transport (idempotent — the task that detected
+                # the drop may have already raced us to it). Tearing down a dead
+                # socket can fail on its own, which says nothing about whether
+                # reconnecting will work: swallow it here so it can never be
+                # mistaken below for an exhausted reconnection.
+                try:
+                    await self._transport.close()
+                except Exception:
+                    logger.debug("Ignoring error while closing dead transport", exc_info=True)
+
+                await self._reconnect()
+                logger.info("Reconnection successful")
+
+                if not self._redo_requested:
+                    break
+
+                logger.warning("Connection lost again while reconnecting, retrying...")
+                # The sessions this pass just restored died with the link that
+                # dropped underneath it, so report that loss before going round
+                # again — nothing else will, since `handle_disconnect` only
+                # recorded the drop rather than handling it.
+                await self._notify_connection_lost()
         except (CTraderConnectionFailedError, CTraderConnectionClosedError) as e:
             logger.error("Reconnection failed, giving up: %s", e)
             self._running = False
@@ -501,6 +545,7 @@ class Protocol:
             self._fail_pending("Reconnection error")
         finally:
             self._reconnecting = False
+            self._redo_requested = False
 
     def _fail_pending(self, reason: str) -> None:
         """Resolve every in-flight request with a connection error."""

{ctrader_api_client-0.7.2 → ctrader_api_client-0.7.3}/src/ctrader_api_client/connection/transport.py

@@ -104,7 +104,7 @@ class Transport:
                     await stream.aclose()
                 if close_scope.cancelled_caught:
                     logger.debug("Graceful TLS shutdown timed out, forcing close")
-            except (OSError, anyio.ClosedResourceError):
+            except (OSError, anyio.ClosedResourceError, anyio.BrokenResourceError):
                 pass
 
     async def send(self, data: bytes) -> None:

{ctrader_api_client-0.7.2 → ctrader_api_client-0.7.3}/src/ctrader_api_client/events/types.py

@@ -324,8 +324,14 @@ class ReconnectedEvent:
     Use this event for any custom logic that depends on reconnection, such as logging or alerting.
 
     Attributes:
-        app_auth_restored: Whether app authentication succeeded.
+        app_auth_restored: Whether app authentication succeeded on the attempt
+            this event reports. False is not final: the client keeps retrying
+            with backoff, and announces each account it restores afterwards with
+            a ReadyEvent. Check `client.auth.is_app_authenticated` for the
+            state now.
         restored_accounts: Account IDs that were successfully re-authenticated.
+            Empty when app authentication failed, since nothing can be
+            authorized before it succeeds — not a report that they were lost.
         failed_accounts: Accounts that failed, as (account_id, error_message) tuples.
     """
 

{ctrader_api_client-0.7.2 → ctrader_api_client-0.7.3}/tests/behavior/connection/test_reconnection.py

@@ -15,6 +15,7 @@ from ctrader_api_client._internal.proto import (
     ProtoOATraderRes,
 )
 from ctrader_api_client.composition import ClientGraph
+from ctrader_api_client.connection import Transport
 from ctrader_api_client.exceptions import CTraderConnectionClosedError
 
 from ...harness import FakeServer, Recorder, factories
@@ -109,6 +110,102 @@ async def test_reconnection_restores_event_delivery(
     assert spots.only.bid == 111_111
 
 
+async def test_closing_a_transport_whose_socket_is_broken_does_not_raise() -> None:
+    """A socket that refuses a graceful shutdown is still going away.
+
+    A broken TLS session raises `BrokenResourceError` out of `aclose()`, because
+    the close-notify it tries to write cannot be sent. That is the expected
+    ending for a link that is already dead, not a failure to report.
+    """
+    transport = Transport(host="stub.invalid", port=0, use_ssl=False)
+
+    class BrokenStream:
+        async def aclose(self) -> None:
+            raise anyio.BrokenResourceError
+
+    transport._stream = BrokenStream()  # type: ignore[assignment]  # noqa: SLF001 - no public seam for a broken stream
+
+    await transport.close()
+
+    assert transport.is_connected is False
+
+
+@pytest.mark.usefixtures("echoing_trader")
+async def test_reconnection_survives_a_transport_that_cannot_be_closed(
+    make_graph: Callable[..., ClientGraph],
+    connected: Callable[[CTraderClient], Awaitable[CTraderClient]],
+    server: FakeServer,
+) -> None:
+    """Failing to tear down the dead link must not abandon the reconnection.
+
+    Regression guard: closing the old transport is the first thing a
+    reconnection does, and on an already-broken socket that close can raise.
+    The exception used to be indistinguishable from an exhausted retry loop, so
+    the client stopped reconnecting permanently — while never having attempted
+    a single reconnection on that cycle.
+    """
+    graph = make_graph()
+    close_cleanly = graph.transport.close
+    refusals = [anyio.BrokenResourceError()]
+
+    async def close_raising_once() -> None:
+        # Raise *after* the real teardown, the way the broken socket did: the
+        # stream is released first, and only the graceful TLS shutdown fails.
+        await close_cleanly()
+        if refusals:
+            raise refusals.pop()
+
+    graph.transport.close = close_raising_once  # type: ignore[method-assign]
+    client = await connected(CTraderClient.from_graph(graph))
+
+    await server.drop_connection()
+    await server.wait_for_connections(2)
+
+    response = await client.protocol.request(ProtoOATraderReq(ctid_trader_account_id=10), ProtoOATraderRes)
+
+    assert response.ctid_trader_account_id == 10
+
+
+@pytest.mark.usefixtures("echoing_trader")
+async def test_a_drop_reported_while_reconnecting_is_not_lost(
+    make_graph: Callable[..., ClientGraph],
+    connected: Callable[[CTraderClient], Awaitable[CTraderClient]],
+    server: FakeServer,
+) -> None:
+    """A drop reported mid-reconnection is acted on, not silently swallowed.
+
+    This is the only window in which nothing else can pick the report up: a
+    detector is refused while a reconnection is in flight, and the reader loop
+    exits as soon as it has reported, so the reconnection already running has to
+    go round again on its behalf. The report is made from a listener, which runs
+    inside that window by construction, and the link is left healthy so that no
+    *other* detector can mask the loss by noticing independently.
+    """
+    graph = make_graph()
+
+    class ReportsADropWhileTheReconnectionIsInFlight:
+        def __init__(self) -> None:
+            self.reported = False
+
+        async def on_connection_lost(self) -> None: ...
+
+        async def on_connection_restored(self) -> None:
+            if self.reported:
+                return
+            self.reported = True
+            await graph.protocol.handle_disconnect()
+
+    graph.supervisor.add_listener(ReportsADropWhileTheReconnectionIsInFlight())
+    client = await connected(CTraderClient.from_graph(graph))
+
+    await server.drop_connection()
+    await server.wait_for_connections(3)
+
+    response = await client.protocol.request(ProtoOATraderReq(ctid_trader_account_id=12), ProtoOATraderRes)
+
+    assert response.ctid_trader_account_id == 12
+
+
 @pytest.mark.usefixtures("echoing_trader")
 async def test_a_failing_listener_does_not_block_reconnection(
     make_graph: Callable[..., ClientGraph],

{ctrader_api_client-0.7.2 → ctrader_api_client-0.7.3}/tests/behavior/test_client.py

@@ -16,7 +16,7 @@ from ctrader_api_client._internal.proto import (
     ProtoOARefreshTokenReq,
     ProtoOATraderReq,
 )
-from ctrader_api_client.auth import AccountCredentials
+from ctrader_api_client.auth import AccountCredentials, ReauthPolicy
 from ctrader_api_client.events import (
     AccountDisconnectEvent,
     ReadyEvent,
@@ -35,6 +35,12 @@ from ..harness import FakeServer, ManualClock, Recorder, factories
 
 ALMOST_EXPIRED = 10.0
 CHECK_INTERVAL = 60.0
+RETRY_WAIT = 1.0
+
+# The heartbeat loop and the token-refresh loop, both parked on the clock once a
+# client is up. Captured rather than assumed where a test needs to tell a new
+# sleeper apart from these.
+SLEEPERS_WHEN_CONNECTED = 2
 
 
 async def authenticate(client: CTraderClient, server: FakeServer) -> AccountCredentials:
@@ -51,6 +57,20 @@ def rejecting(_request: betterproto.Message) -> betterproto.Message:
     return factories.error_res(error_code="ACCOUNT_NOT_AUTHORIZED")
 
 
+def cannot_route_once() -> Callable[[betterproto.Message], betterproto.Message]:
+    """Refuse the first request the way a gateway refuses to route one, then relent.
+
+    `CANT_ROUTE_REQUEST` is transient and server-side: the same request a moment
+    later is routed normally.
+    """
+    refusals = [factories.error_res(error_code="CANT_ROUTE_REQUEST", description="Cannot route request")]
+
+    def respond(_request: betterproto.Message) -> betterproto.Message:
+        return refusals.pop() if refusals else factories.app_auth_res()
+
+    return respond
+
+
 def already_logged_in(_request: betterproto.Message) -> betterproto.Message:
     """Refuse the way the server refuses an account whose session is still live."""
     return factories.error_res(
@@ -352,6 +372,63 @@ async def test_a_reconnect_that_cannot_re_authenticate_the_app_says_so(
     assert reconnects.only.failed_accounts == ()
 
 
+async def test_a_reconnect_keeps_retrying_application_authentication(
+    make_client: Callable[..., CTraderClient],
+    connected: Callable[[CTraderClient], Awaitable[CTraderClient]],
+    server: FakeServer,
+) -> None:
+    """A transient refusal must not cost the client the rest of its session.
+
+    Regression guard: application re-authentication used to be attempted exactly
+    once per reconnect. A single transient refusal left the link up but
+    unauthenticated, with no path back — every later request timed out, and
+    because the link itself was healthy nothing ever reconnected again.
+    """
+    client = await connected(make_client(reauth_policy=ReauthPolicy(min_wait=0.0, max_wait=0.0)))
+    await authenticate(client, server)
+    ready: Recorder[ReadyEvent] = Recorder()
+    client.register_handler(ReadyEvent, ready)
+    server.on(ProtoOAApplicationAuthReq, cannot_route_once())
+
+    await server.drop_connection()
+    await ready.wait_for(1)
+
+    assert client.is_account_authorized(factories.ACCOUNT_ID) is True
+    assert ready.only.account_id == factories.ACCOUNT_ID
+    assert ready.only.is_reconnect is True
+
+
+async def test_retrying_application_authentication_waits_out_its_backoff(
+    make_client: Callable[..., CTraderClient],
+    connected: Callable[[CTraderClient], Awaitable[CTraderClient]],
+    server: FakeServer,
+    clock: ManualClock,
+) -> None:
+    """Retrying is paced by the policy, not spun as fast as the server refuses.
+
+    A server that keeps refusing is usually one under strain; hammering it as
+    fast as the loop can go would pin a core and make that worse.
+    """
+    client = await connected(make_client(reauth_policy=ReauthPolicy(min_wait=RETRY_WAIT, max_wait=RETRY_WAIT)))
+    await authenticate(client, server)
+    await clock.wait_for_sleepers(SLEEPERS_WHEN_CONNECTED)
+    parked = clock.sleeper_count
+    server.on(ProtoOAApplicationAuthReq, rejecting)
+
+    await server.drop_connection()
+    # The attempt the reconnection itself makes, which the server refuses.
+    await server.wait_for_request(ProtoOAApplicationAuthReq, 2)
+    # Recovery has taken it over and is parked on the backoff before retrying.
+    await clock.wait_for_sleepers(parked + 1)
+
+    assert len(server.requests_of(ProtoOAApplicationAuthReq)) == 2
+
+    await clock.advance(RETRY_WAIT)
+    await server.wait_for_request(ProtoOAApplicationAuthReq, 3)
+
+    assert len(server.requests_of(ProtoOAApplicationAuthReq)) == 3
+
+
 async def test_an_account_a_reconnect_could_not_restore_is_not_authorized(
     client: CTraderClient,
     server: FakeServer,

{ctrader_api_client-0.7.2 → ctrader_api_client-0.7.3}/uv.lock

@@ -270,7 +270,7 @@ wheels = [
 
 [[package]]
 name = "ctrader-api-client"
-version = "0.7.2"
+version = "0.7.3"
 source = { editable = "." }
 dependencies = [
     { name = "anyio" },