feat(auth): [aiohttp] Add mTLS reconfiguration logic when certificate mismatch for existing credentials & Agent Identity workloads

[agrawalradhika-cell]

feat: [aiohttp] Add mTLS reconfiguration logic when certificate mismatch for existing credentials & Agent Identity workloads

Changes included:

• Adds mTLS reconfiguration logic when a certificate mismatch occurs.
• Aligns async session behavior with the synchronous session by triggering a credential refresh and request retry on all 401 Unauthorized responses (not just mTLS).

• Make sure to open an issue as a bug/issue before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea
• Ensure the tests and linter pass
• Code coverage does not decrease (if any source code was changed)
• Appropriate docs were updated (if necessary)

Fixes #18227 #18227 🦕

[gemini-code-assist]

Code Review

This pull request introduces client certificate rotation handling for asynchronous authorized sessions when encountering an unauthorized response under mTLS. The review feedback highlights a violation of the repository style guide regarding exception contract compliance, suggesting that the certificate parameter check should be wrapped in a try-except block to gracefully fall back to the original response rather than crashing. Additionally, the feedback recommends updating the corresponding unit tests to assert this resilient fallback behavior.

[nbayati]

self._mtls_check_counter += 1 is nested inside the else: block at line 461, so it only executes when check_parameters_for_unauthorized_response() completes without raising. When handled exceptions occur (such as ClientCertError, MutualTLSChannelError, or OSError), the except block catches them and skips else:, leaving the counter unchanged. Any coroutines queued on _mtls_rotation_lock will then evaluate the skip guard as false and redundantly repeat the failing certificate check.

Note: moving the increment into a finally: block would advance the counter during asyncio.CancelledError unwinding or channel reconfiguration failures.

Consider placing the counter increment immediately after the try...except...else block.

[agrawalradhika-cell]

Had placed self._mtls_check_counter += 1 is nested inside the else: block because of earlier comment that led to assumption - The counter only increments if the certificate check completely succeeds (and reconfiguration succeeds or wasn't needed). If Task A hits a transient error, the else block is skipped, and the counter stays the same. When Task B wakes up, it correctly re-runs the certificate check. This is much safer, as it forces concurrent tasks to retry the check rather than falsely assuming a failed check was resolved.

Please let me know if you still want me to alter it?

[nbayati]

If _do_configure() encounters an exception or is cancelled, self._mtls_init_task is never reset to None, permanently blocking subsequent retries in configure_mtls_channel(). Additionally, because asyncio.CancelledError inherits from BaseException in Python 3.8+, the except Exception: handler in request() (line 314) fails to catch background task cancellation, causing subsequent calls to session.request() to crash with an unhandled CancelledError.

Note that catching CancelledError with pass in request() would swallow outer cancellation of the calling request; checking not self._mtls_init_task.cancelled() ensures caller cancellation is preserved.

Consider resetting self._mtls_init_task = None on failure in configure_mtls_channel(), and guarding the await in request():

# In configure_mtls_channel():
try:
    return await self._mtls_init_task
except BaseException:
    self._mtls_init_task = None
    raise

# In request() (lines 311-317):
if self._mtls_init_task and not self._mtls_init_task.done():
    try:
        await self._mtls_init_task
    except asyncio.CancelledError:
        if not self._mtls_init_task.cancelled():
            raise
    except Exception:
        pass

[nbayati]

nit: Consider distinguishing between a missing certificate and an unchanged certificate when logging:

[nbayati]

Because session._mtls_init_task is None in these rotation tests, the newly added _mtls_init_task.done() reset branch in sessions.py remains unexercised. The new pre-refresh and pre-retry TimeoutError branches also lack unit tests. Consider adding test cases to cover these paths, such as pre-populating _mtls_init_task with a completed task and simulating elapsed time on 401 retries.