feat: add asyncio.Lock to prevent concurrent refreshes (#234)

* feat: add asyncio.Lock to prevent concurrent refreshes

* fix: lazy init of lock

* fix: lock at module level to not have different event loops

* chore: remove python 3.9 support

* fix: store refresh lock on instance not on module

* chore: upgrade dev dependencies

* fix: revert anyio to v < 4

---------

Co-authored-by: Jonas Krüger Svensson <jonas@vibber.ai>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: 3 people

.github/workflows/codeql-analysis.yaml

@@ -20,7 +20,7 @@ jobs:
 
       - uses: actions/setup-python@v6
         with:
-          python-version: "3.11"
+          python-version: "3.12"
 
       - name: Install uv
         uses: astral-sh/setup-uv@v6

docs/docs/usage-and-faq/accessing_the_user.mdx

@@ -10,8 +10,6 @@ You can access your user object in two ways, either with `Depends(<schema name>)
 
 ### `Depends(<schema name>)`
 
-<Tabs groupId="python-version">
-<TabItem value="Python 3.9 or above">
 
 ```python title="depends_api_example.py"
 from fastapi import APIRouter, Depends
@@ -33,40 +31,10 @@ async def hello_user(user: User = Depends(azure_scheme)) -> dict[str, bool]:
     """
     return user.dict()
 ```
-</TabItem>
-
-<TabItem value="Python 3.8">
-
-```python title="depends_api_example.py"
-from fastapi import APIRouter, Depends
-from typing import Dict
-
-from demo_project.api.dependencies import azure_scheme
-from fastapi_azure_auth.user import User
-
-router = APIRouter()
-
-
-@router.get(
-    '/hello-user',
-    response_model=User,
-    operation_id='helloWorldApiKey',
-)
-async def hello_user(user: User = Depends(azure_scheme)) -> Dict[str, bool]:
-    """
-    Wonder how this auth is done?
-    """
-    return user.dict()
-```
-</TabItem>
-
-</Tabs>
 
 
 ### `request.state.user`
 
-<Tabs groupId="python-version">
-<TabItem value="Python 3.9 or above">
 
 ```python title="request_state_user_api_example.py"
 from fastapi import APIRouter, Depends, Request
@@ -89,34 +57,3 @@ async def hello_user(request: Request) -> dict[str, bool]:
     """
     return request.state.user.dict()
 ```
-
-</TabItem>
-
-<TabItem value="Python 3.8">
-
-```python title="request_state_user_api_example.py"
-from fastapi import APIRouter, Depends, Request
-from typing import Dict
-
-from demo_project.api.dependencies import azure_scheme
-from fastapi_azure_auth.user import User
-
-router = APIRouter()
-
-
-@router.get(
-    '/hello-user',
-    response_model=User,
-    operation_id='helloWorldApiKey',
-    dependencies=[Depends(azure_scheme)]
-)
-async def hello_user(request: Request) -> Dict[str, bool]:
-    """
-    Wonder how this auth is done?
-    """
-    return request.state.user.dict()
-```
-
-</TabItem>
-
-</Tabs>

fastapi_azure_auth/openid_config.py

@@ -4,6 +4,7 @@
 from typing import TYPE_CHECKING, Any, NotRequired, TypedDict
 
 import jwt
+from anyio import Lock
 from fastapi import HTTPException, status
 from httpx2 import AsyncClient
 
@@ -63,12 +64,24 @@ def __init__(
         self.token_endpoint: str
         self.issuer: str
 
+        self._refresh_lock: Lock = Lock()
+
+    def _config_is_fresh(self) -> bool:
+        refresh_time = datetime.now() - timedelta(hours=24)
+        return bool(self._config_timestamp and self._config_timestamp >= refresh_time)
+
     async def load_config(self) -> None:
         """
         Loads config from the OpenID Connect metadata endpoint if it's over 24 hours old (or don't exist)
         """
-        refresh_time = datetime.now() - timedelta(hours=24)
-        if not self._config_timestamp or self._config_timestamp < refresh_time:
+        # Fast path without the lock: this runs on every authenticated request.
+        if self._config_is_fresh():
+            return
+        async with self._refresh_lock:
+            # Re-check inside the lock: another task may have refreshed while we waited,
+            # so concurrent requests result in a single fetch.
+            if self._config_is_fresh():
+                return
             try:
                 log.debug('Loading Azure Entra ID OpenID configuration.')
                 await self._load_openid_config()

mypy.ini

@@ -1,6 +1,6 @@
 # Global options
 [mypy]
-python_version = 3.11
+python_version = 3.12
 # flake8-mypy expects the two following for sensible formatting
 show_column_numbers = True
 show_error_context = False

pyproject.toml

@@ -43,6 +43,7 @@ classifiers = [
 ]
 dependencies = [
     "fastapi>=0.111.1",
+    "anyio>=4.4.0",
     "cryptography>=48.0.1",
     "httpx2>=2.0.0",
     "pydantic>=2.6.2",

tests/test_provider_config.py

@@ -1,6 +1,8 @@
 import logging
 from datetime import datetime, timedelta
 
+import anyio
+import httpx
 import pytest
 from asgi_lifespan import LifespanManager
 from httpx2 import ASGITransport, AsyncClient
@@ -9,7 +11,7 @@
 from demo_project.main import app
 from fastapi_azure_auth import HttpClientConfig, SingleTenantAzureAuthorizationCodeBearer
 from fastapi_azure_auth.openid_config import OpenIdConfig
-from tests.utils import build_access_token, build_openid_keys, openid_configuration
+from tests.utils import build_access_token, build_openid_keys, keys_url, openid_config_url, openid_configuration
 
 
 @pytest.mark.anyio
@@ -72,6 +74,32 @@ async def test_custom_config_id(httpx2_mock):
     assert len(openid_config.signing_keys) == 2
 
 
+@pytest.mark.anyio
+async def test_concurrent_refresh_requests(httpx2_mock):
+    """Concurrent refreshes of a stale config should result in exactly one fetch."""
+
+    # respx requires classic httpx.Response objects from side_effect callables (lundberg/respx#324)
+    async def slow_config_response(*args, **kwargs):
+        await anyio.sleep(0.2)
+        return httpx.Response(200, json=openid_configuration())
+
+    async def slow_keys_response(*args, **kwargs):
+        await anyio.sleep(0.2)
+        return httpx.Response(200, json=build_openid_keys())
+
+    config_route = httpx2_mock.get(openid_config_url()).mock(side_effect=slow_config_response)
+    keys_route = httpx2_mock.get(keys_url()).mock(side_effect=slow_keys_response)
+
+    openid_config = OpenIdConfig('vibber_tenant_id')
+    async with anyio.create_task_group() as task_group:
+        for _ in range(5):
+            task_group.start_soon(openid_config.load_config)
+
+    assert len(config_route.calls) == 1, 'Config endpoint called multiple times'
+    assert len(keys_route.calls) == 1, 'Keys endpoint called multiple times'
+    assert len(openid_config.signing_keys) == 2
+
+
 def _capture_client_kwargs(mocker):
     """Patch the AsyncClient used for config fetching so the kwargs it receives can be asserted."""
     import fastapi_azure_auth.openid_config as openid_config_module