stackit-core 0.3.0__tar.gz → 0.4.0__tar.gz

{stackit_core-0.3.0 → stackit_core-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: stackit-core
-Version: 0.3.0
+Version: v0.4.0
 Summary: Core functionality for the STACKIT SDK for Python
 Project-URL: Homepage, https://github.com/stackitcloud/stackit-sdk-python
 Project-URL: Issues, https://github.com/stackitcloud/stackit-sdk-python/issues

{stackit_core-0.3.0 → stackit_core-0.4.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "stackit-core"
-version = "v0.3.0"
+version = "v0.4.0"
 description = "Core functionality for the STACKIT SDK for Python"
 authors = [{ name = "STACKIT Developer Tools", email = "developer-tools@stackit.cloud" }]
 requires-python = ">=3.10,<4.0"

{stackit_core-0.3.0 → stackit_core-0.4.0}/src/stackit/core/auth_methods/key_auth.py

@@ -54,6 +54,8 @@ class KeyAuth(AuthBase):
     executor: ThreadPoolExecutor
     refresh_future: Optional[futures.Future]
     service_account_key: ServiceAccountKey
+    _stop: threading.Event
+    _refresh_thread: Optional[threading.Thread]
 
     def __init__(
         self,
@@ -66,6 +68,8 @@ class KeyAuth(AuthBase):
         self.executor = ThreadPoolExecutor(max_workers=1)
         self.access_token = None
         self.refresh_future = None
+        self._stop = threading.Event()
+        self._refresh_thread = None
         self.__create_initial_token()
         self.__fetch_token_from_endpoint()
         self.__start_token_refresh_task()
@@ -79,9 +83,37 @@ class KeyAuth(AuthBase):
             if self.__is_token_expired(self.access_token):
                 if self.refresh_future is None or self.refresh_future.done():
                     self.refresh_future = self.executor.submit(self.__refresh_token)
+                refresh_future = self.refresh_future
+            else:
+                refresh_future = None
+
+        # Do not hold the lock while waiting. The refresh worker acquires it when
+        # updating the access token.
+        if refresh_future is not None:
+            refresh_future.result()
+
+        with self.lock:
             r.headers["Authorization"] = f"Bearer {self.access_token}"
         return r
 
+    def close(self) -> None:
+        """Stop the background token refresh and release its worker.
+
+        Call this when the instance is no longer needed, for example after
+        replacing it during key rotation in a long-running process. Without it
+        the refresh thread keeps running and keeps requesting tokens. When it
+        returns, no refresh is running and none will start. Safe to call more
+        than once.
+        """
+        # Set under the lock so the refresh loop cannot submit after shutdown.
+        with self.lock:
+            self._stop.set()
+        atexit.unregister(self.__shutdown)
+        thread = self._refresh_thread
+        if thread is not None and thread is not threading.current_thread():
+            thread.join()
+        self.executor.shutdown(wait=True, cancel_futures=True)
+
     def __create_initial_token(self) -> None:
         payload = {
             "iss": self.service_account_key.credentials.issuer,
@@ -108,16 +140,18 @@ class KeyAuth(AuthBase):
             response = requests.post(self.token_endpoint, data=body, timeout=self.timeout)
             response.raise_for_status()
             response_json = response.json()
-            self.access_token = response_json["access_token"]
-            self.refresh_token = response_json["refresh_token"]
+            with self.lock:
+                self.access_token = response_json["access_token"]
+                self.refresh_token = response_json["refresh_token"]
         except requests.RequestException as e:
             raise requests.RequestException("Initial token fetch failed") from e
 
     def __start_token_refresh_task(self):
         def token_refresh_task():
-            while True:
-                time.sleep(self.TOKEN_EXPIRY_CHECK_INTERVAL.total_seconds())
+            while not self._stop.wait(self.TOKEN_EXPIRY_CHECK_INTERVAL.total_seconds()):
                 with self.lock:
+                    if self._stop.is_set():
+                        return
                     if self.refresh_future is not None and self.refresh_future.done():
                         self.refresh_future.result()
                     if self.__is_token_expired(self.access_token) and (
@@ -128,43 +162,48 @@ class KeyAuth(AuthBase):
         thread = threading.Thread(target=token_refresh_task)
         thread.daemon = True
         thread.start()
+        self._refresh_thread = thread
 
     def __refresh_token(self):
-        if self.__is_token_expired(self.refresh_token):
+        with self.lock:
+            refresh_token = self.refresh_token
+
+        if self.__is_token_expired(refresh_token):
             self.__create_initial_token()
             self.__fetch_token_from_endpoint()
             return
 
         body = {
             "grant_type": "refresh_token",
-            "refresh_token": self.refresh_token,
+            "refresh_token": refresh_token,
         }
 
         last_exception = None
         for _ in range(self.MAX_REFRESH_RETRIES):
+            if self._stop.is_set():
+                return
             try:
                 response = requests.post(self.token_endpoint, data=body, timeout=self.timeout)
                 response.raise_for_status()
                 response_data = response.json()
                 new_token = response_data.get("access_token")
-                self.access_token = new_token
+                with self.lock:
+                    self.access_token = new_token
                 return
             except requests.RequestException as e:
                 last_exception = e
 
         raise requests.RequestException("Token refresh failed after retries") from last_exception
 
-    def __is_token_expired(self, token: str) -> bool:
+    def __is_token_expired(self, token: Optional[str]) -> bool:
         try:
             decoded_token = jwt.decode(token, options={"verify_signature": False})
             exp = decoded_token.get("exp")
-            if exp:
-                return time.time() > (exp + self.EXPIRATION_LEEWAY.total_seconds())
-        except jwt.ExpiredSignatureError:
-            return True
-        except jwt.DecodeError:
+            if exp is None:
+                return True
+            return time.time() > (float(exp) - self.EXPIRATION_LEEWAY.total_seconds())
+        except (jwt.InvalidTokenError, TypeError, ValueError):
             return True
-        return False
 
     def __shutdown(self):
         self.executor.shutdown(wait=False)