python3-commons 0.22.6__tar.gz → 0.22.7__tar.gz

{python3_commons-0.22.6 → python3_commons-0.22.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python3-commons
-Version: 0.22.6
+Version: 0.22.7
 Summary: Re-usable Python3 code
 Author-email: Oleg Korsak <kamikaze.is.waiting.you@gmail.com>
 License-Expression: GPL-3.0

{python3_commons-0.22.6 → python3_commons-0.22.7}/src/python3_commons/auth.py

@@ -1,6 +1,7 @@
 import logging
 import threading
-from collections.abc import Mapping, Sequence
+from collections.abc import Sequence
+from time import monotonic
 from typing import Any, Self, TypeVar
 
 from pydantic import HttpUrl
@@ -18,9 +19,8 @@ except ImportError as e:
 import msgspec
 
 logger = logging.getLogger(__name__)
-_OIDC_CONFIG_LOCK = threading.Lock()
-_OIDC_JWKS_LOCK = threading.Lock()
-_OIDC_SESSION_LOCK = threading.Lock()
+
+DEFAULT_JWKS_CACHE_TTL = 300.0
 
 
 class TokenData(msgspec.Struct):
@@ -81,6 +81,7 @@ class OIDCClient:
         timeout: float = 10.0,
         verify_cert: bool = True,
         connection_limit: int = 100,
+        jwks_cache_ttl: float = DEFAULT_JWKS_CACHE_TTL,
         authority_internal_host: HttpUrl | None = None,
         audit_name: str | None = None,
     ) -> None:
@@ -97,17 +98,22 @@ class OIDCClient:
         self._timeout = timeout
         self._verify_cert = verify_cert
 
-        self._config: Mapping[str, Any] | None = None
-        self._jwks: Mapping[str, Any] | None = None
+        self._session_lock = threading.Lock()
+        self._config: dict[str, Any] | None = None
+        self._config_lock = threading.Lock()
+        self._jwks: dict[str, Any] | None = None
+        self._jwks_lock = threading.Lock()
+        self._jwks_cache_ttl = jwks_cache_ttl
+        self._jwks_fetched_at: float | None = None
         self._audit_name: str | None = audit_name
 
     def _get_session(self) -> aiohttp.ClientSession:
-        if self._session:
-            return self._session
+        if (session := self._session) and not session.closed:
+            return session
 
-        with _OIDC_SESSION_LOCK:
-            if self._session:
-                return self._session
+        with self._session_lock:
+            if (session := self._session) and not session.closed:
+                return session
 
             connector = aiohttp.TCPConnector(verify_ssl=self._verify_cert, limit=self._connection_limit)
             timeout = aiohttp.ClientTimeout(total=self._timeout)
@@ -137,20 +143,20 @@ class OIDCClient:
         ) as response:
             return await response.json()
 
-    async def get_config(self) -> Mapping[str, Any]:
-        if self._config:
-            return self._config
+    async def get_config(self) -> dict[str, Any]:
+        if config := self._config:
+            return config
 
-        with _OIDC_CONFIG_LOCK:
-            if self._config:
-                return self._config
+        with self._config_lock:
+            if config := self._config:
+                return config
 
             config = await self._fetch_config()
             self._config = config
 
             return config
 
-    async def _fetch_jwks(self, jwks_uri: str) -> dict:
+    async def _fetch_jwks(self, jwks_uri: str) -> dict[str, Any]:
         """
         Fetch the JSON Web Key Set (JWKS) for validating the token's signature.
         """
@@ -163,18 +169,32 @@ class OIDCClient:
         async with api_client.request(self._get_session(), jwks_uri, '', audit_name=self._audit_name) as response:
             return await response.json()
 
-    async def get_jwks(self) -> Mapping[str, Any]:
-        if self._jwks:
-            return self._jwks
+    def _is_fresh_jwks(self) -> bool:
+        fetched_at = self._jwks_fetched_at
+
+        if self._jwks is None or fetched_at is None:
+            return False
+
+        return (monotonic() - fetched_at) < self._jwks_cache_ttl
+
+    async def get_jwks(self, *, force_refresh: bool = False) -> dict[str, Any]:
+        if not force_refresh and (jwks := self._jwks) and self._is_fresh_jwks():
+            return jwks
+
+        fetched_at = self._jwks_fetched_at
+
+        with self._jwks_lock:
+            if (jwks := self._jwks) and self._jwks_fetched_at != fetched_at:
+                return jwks
 
-        with _OIDC_JWKS_LOCK:
-            if self._jwks:
-                return self._jwks
+            if not force_refresh and jwks and self._is_fresh_jwks():
+                return jwks
 
             oidc_config = await self.get_config()
 
             jwks = await self._fetch_jwks(oidc_config['jwks_uri'])
             self._jwks = jwks
+            self._jwks_fetched_at = monotonic()
 
             return jwks
 

{python3_commons-0.22.6 → python3_commons-0.22.7}/src/python3_commons.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python3-commons
-Version: 0.22.6
+Version: 0.22.7
 Summary: Re-usable Python3 code
 Author-email: Oleg Korsak <kamikaze.is.waiting.you@gmail.com>
 License-Expression: GPL-3.0

{python3_commons-0.22.6 → python3_commons-0.22.7}/src/python3_commons.egg-info/SOURCES.txt

@@ -69,6 +69,7 @@ tests/unit/__init__.py
 tests/unit/conftest.py
 tests/unit/test_async_functools.py
 tests/unit/test_audit.py
+tests/unit/test_auth.py
 tests/unit/test_helpers.py
 tests/unit/test_msgpack.py
 tests/unit/test_msgspec.py

{python3_commons-0.22.6 → python3_commons-0.22.7}/src/python3_commons.egg-info/scm_file_list.json

@@ -1,75 +1,76 @@
 {
   "files": [
+    ".gitignore",
+    ".python-version",
+    "README.md",
+    "AUTHORS.rst",
+    "CHANGELOG.rst",
+    "pyproject.toml",
+    ".env_template",
     ".coveragerc",
     ".pre-commit-config.yaml",
-    "README.md",
     "uv.lock",
-    ".python-version",
     "LICENSE",
-    "pyproject.toml",
-    "CHANGELOG.rst",
-    ".env_template",
     "README.rst",
-    ".gitignore",
-    "AUTHORS.rst",
-    ".devcontainer/Dockerfile",
-    ".devcontainer/docker-compose.yml",
-    ".devcontainer/devcontainer.json",
-    "docs/Makefile",
-    "docs/license.rst",
-    "docs/authors.rst",
-    "docs/index.rst",
-    "docs/changelog.rst",
-    "docs/conf.py",
-    "docs/_static/.gitignore",
-    "src/python3_commons/helpers.py",
+    "src/python3_commons/conf.py",
     "src/python3_commons/soap_client.py",
-    "src/python3_commons/api_client.py",
-    "src/python3_commons/__init__.py",
-    "src/python3_commons/exceptions.py",
-    "src/python3_commons/object_storage.py",
+    "src/python3_commons/async_functools.py",
     "src/python3_commons/permissions.py",
-    "src/python3_commons/auth.py",
-    "src/python3_commons/audit.py",
-    "src/python3_commons/cache.py",
     "src/python3_commons/fs.py",
-    "src/python3_commons/conf.py",
-    "src/python3_commons/async_functools.py",
+    "src/python3_commons/api_client.py",
+    "src/python3_commons/audit.py",
+    "src/python3_commons/object_storage.py",
+    "src/python3_commons/exceptions.py",
+    "src/python3_commons/helpers.py",
     "src/python3_commons/generators.py",
+    "src/python3_commons/cache.py",
+    "src/python3_commons/auth.py",
+    "src/python3_commons/__init__.py",
     "src/python3_commons/db/helpers.py",
     "src/python3_commons/db/__init__.py",
+    "src/python3_commons/db/models/common.py",
     "src/python3_commons/db/models/rbac.py",
-    "src/python3_commons/db/models/__init__.py",
-    "src/python3_commons/db/models/users.py",
     "src/python3_commons/db/models/auth.py",
-    "src/python3_commons/db/models/common.py",
-    "src/python3_commons/log/__init__.py",
+    "src/python3_commons/db/models/users.py",
+    "src/python3_commons/db/models/__init__.py",
     "src/python3_commons/log/filters.py",
     "src/python3_commons/log/formatters.py",
-    "src/python3_commons/serializers/__init__.py",
-    "src/python3_commons/serializers/msgpack.py",
-    "src/python3_commons/serializers/json.py",
+    "src/python3_commons/log/__init__.py",
     "src/python3_commons/serializers/msgspec.py",
+    "src/python3_commons/serializers/json.py",
     "src/python3_commons/serializers/common.py",
+    "src/python3_commons/serializers/msgpack.py",
+    "src/python3_commons/serializers/__init__.py",
+    ".devcontainer/docker-compose.yml",
+    ".devcontainer/Dockerfile",
+    ".devcontainer/devcontainer.json",
+    ".github/workflows/checks.yml",
+    ".github/workflows/release-on-tag-push.yml",
+    ".github/workflows/python-publish.yaml",
     "tests/__init__.py",
-    "tests/integration/__init__.py",
-    "tests/integration/test_auth.py",
     "tests/integration/conftest.py",
     "tests/integration/test_osc.py",
     "tests/integration/test_cache.py",
-    "tests/unit/__init__.py",
-    "tests/unit/test_helpers.py",
+    "tests/integration/test_auth.py",
+    "tests/integration/__init__.py",
     "tests/unit/test_async_functools.py",
-    "tests/unit/test_msgspec.py",
     "tests/unit/conftest.py",
+    "tests/unit/test_msgspec.py",
     "tests/unit/test_audit.py",
+    "tests/unit/test_auth.py",
     "tests/unit/test_msgpack.py",
-    "tests/unit/db/__init__.py",
+    "tests/unit/test_helpers.py",
+    "tests/unit/__init__.py",
     "tests/unit/db/test_async_session_manager.py",
-    "tests/unit/log/__init__.py",
+    "tests/unit/db/__init__.py",
     "tests/unit/log/test_formatters.py",
-    ".github/workflows/release-on-tag-push.yml",
-    ".github/workflows/python-publish.yaml",
-    ".github/workflows/checks.yml"
+    "tests/unit/log/__init__.py",
+    "docs/conf.py",
+    "docs/Makefile",
+    "docs/index.rst",
+    "docs/authors.rst",
+    "docs/changelog.rst",
+    "docs/license.rst",
+    "docs/_static/.gitignore"
   ]
 }

python3_commons-0.22.7/src/python3_commons.egg-info/scm_version.json

@@ -0,0 +1,8 @@
+{
+  "tag": "0.22.7",
+  "distance": 0,
+  "node": "g5f178ff649355a3292548e00f3c32fdbfcb16d27",
+  "dirty": false,
+  "branch": "HEAD",
+  "node_date": "2026-07-15"
+}

python3_commons-0.22.7/tests/unit/test_auth.py

@@ -0,0 +1,111 @@
+import asyncio
+from typing import TYPE_CHECKING
+
+import pytest
+from pydantic import HttpUrl
+
+from python3_commons.auth import OIDCClient
+
+if TYPE_CHECKING:
+    from pytest_mock import MockerFixture
+
+_CONFIG = {'jwks_uri': 'https://issuer.example/keys'}
+_JWKS_V1 = {'keys': [{'kid': 'key-1'}]}
+_JWKS_V2 = {'keys': [{'kid': 'key-2'}]}
+
+
+@pytest.fixture
+def client() -> OIDCClient:
+    return OIDCClient(HttpUrl('https://issuer.example'), 'jean', jwks_cache_ttl=100.0)
+
+
+@pytest.mark.asyncio
+async def test_get_jwks_serves_cached_set_within_ttl(client: OIDCClient, mocker: MockerFixture) -> None:
+    mocker.patch.object(client, '_fetch_config', mocker.AsyncMock(return_value=_CONFIG))
+    fetch_jwks = mocker.AsyncMock(return_value=_JWKS_V1)
+    mocker.patch.object(client, '_fetch_jwks', fetch_jwks)
+    mocker.patch('python3_commons.auth.monotonic', return_value=10.0)
+
+    first = await client.get_jwks()
+    second = await client.get_jwks()
+
+    assert first == _JWKS_V1
+    assert second == _JWKS_V1
+    assert fetch_jwks.await_count == 1
+
+
+@pytest.mark.asyncio
+async def test_get_jwks_refetches_after_ttl_expiry(client: OIDCClient, mocker: MockerFixture) -> None:
+    """A rotated signing key is picked up once the cached set goes stale."""
+    mocker.patch.object(client, '_fetch_config', mocker.AsyncMock(return_value=_CONFIG))
+    fetch_jwks = mocker.AsyncMock(side_effect=[_JWKS_V1, _JWKS_V2])
+    mocker.patch.object(client, '_fetch_jwks', fetch_jwks)
+    clock = mocker.patch('python3_commons.auth.monotonic', return_value=0.0)
+
+    first = await client.get_jwks()
+    clock.return_value = 100.0
+    second = await client.get_jwks()
+
+    assert first == _JWKS_V1
+    assert second == _JWKS_V2
+    assert fetch_jwks.await_count == 2
+
+
+@pytest.mark.asyncio
+async def test_get_jwks_force_refresh_bypasses_fresh_cache(client: OIDCClient, mocker: MockerFixture) -> None:
+    mocker.patch.object(client, '_fetch_config', mocker.AsyncMock(return_value=_CONFIG))
+    fetch_jwks = mocker.AsyncMock(side_effect=[_JWKS_V1, _JWKS_V2])
+    mocker.patch.object(client, '_fetch_jwks', fetch_jwks)
+    mocker.patch('python3_commons.auth.monotonic', return_value=0.0)
+
+    first = await client.get_jwks()
+    second = await client.get_jwks(force_refresh=True)
+
+    assert first == _JWKS_V1
+    assert second == _JWKS_V2
+    assert fetch_jwks.await_count == 2
+
+
+@pytest.mark.asyncio
+async def test_get_jwks_coalesces_concurrent_refreshes(client: OIDCClient, mocker: MockerFixture) -> None:
+    """Concurrent first-time callers share a single fetch and never deadlock on the lock."""
+    mocker.patch.object(client, '_fetch_config', mocker.AsyncMock(return_value=_CONFIG))
+    mocker.patch('python3_commons.auth.monotonic', return_value=0.0)
+
+    started = asyncio.Event()
+    release = asyncio.Event()
+
+    async def slow_fetch(_uri: str) -> dict:
+        started.set()
+        await release.wait()
+
+        return _JWKS_V1
+
+    fetch_jwks = mocker.AsyncMock(side_effect=slow_fetch)
+    mocker.patch.object(client, '_fetch_jwks', fetch_jwks)
+
+    first = asyncio.create_task(client.get_jwks())
+    await started.wait()
+    second = asyncio.create_task(client.get_jwks())
+    await asyncio.sleep(0)
+    release.set()
+
+    results = await asyncio.gather(first, second)
+
+    assert results == [_JWKS_V1, _JWKS_V1]
+    assert fetch_jwks.await_count == 1
+
+
+@pytest.mark.asyncio
+async def test_get_session_recreates_a_closed_session(client: OIDCClient) -> None:
+    """A cache refresh after the context manager closed the session must get a live one."""
+    async with client:
+        first = client._get_session()  # noqa: SLF001
+
+    assert first.closed
+
+    async with client:
+        second = client._get_session()  # noqa: SLF001
+
+        assert not second.closed
+        assert second is not first

python3_commons-0.22.6/src/python3_commons.egg-info/scm_version.json

@@ -1,8 +0,0 @@
-{
-  "tag": "0.22.6",
-  "distance": 0,
-  "node": "gd66dd259ee583bc3a586ae4be41f9f159169f450",
-  "dirty": false,
-  "branch": "HEAD",
-  "node_date": "2026-06-26"
-}