fix: avoid httpx2 verify=<str> deprecation in the client auth patches (#952)

* fix: avoid httpx2 verify=<str> deprecation in client patches

httpx2 deprecated passing verify as a path string. The client credential
flow converts verify to a CA-bundle path when ca_path is configured and
passed it straight to httpx2.get/post, triggering a DeprecationWarning in
normal usage.

Add a prepare_verify helper in diracx.core.utils that builds an
ssl.SSLContext from a CA file/directory path (booleans pass through) and
use it at the httpx2 call sites in the sync and async client patches.

* refactor: drop unused DiracClientMixin from client patches

DiracClientMixin (and its DiracTokenCredential /
DiracBearerTokenCredentialPolicy helpers) in patches/utils.py were never
imported; the live clients are SyncDiracClient/AsyncDiracClient, which use
the per-mode mixins in patches/client/{sync,aio}.py. Remove the dead
classes and the imports that only they used.

* refactor: consolidate client auth patches into one module

patches/utils.py duplicated the token helpers already present in
patches/client/common.py; the async client used one copy and the sync
client the other. Merge them into patches/client/common.py (imported by
both sync.py and aio.py) and delete patches/utils.py.

With a single home for the helpers, flip their verify parameter to the
native httpx2 type (bool | ssl.SSLContext) and convert the CA path once in
each client __init__, keeping the bool/str form only for azure-core's
connection_verify.

---------

Co-authored-by: chaen <christophe.haen@cern.ch>

Author: chrisburr

diracx-client/src/diracx/client/patches/client/aio.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import ssl
 from importlib.metadata import PackageNotFoundError, distribution
 from pathlib import Path
 from types import TracebackType
@@ -12,8 +13,9 @@
 from azure.core.pipeline import PipelineRequest
 from azure.core.pipeline.policies import AsyncBearerTokenCredentialPolicy
 from diracx.core.preferences import get_diracx_preferences, DiracxPreferences
+from diracx.core.utils import prepare_verify
 
-from ..utils import get_openid_configuration, get_token
+from .common import get_openid_configuration, get_token
 from ..._generated.aio._client import Dirac as _Dirac
 
 __all__ = [
@@ -30,7 +32,7 @@ def __init__(
         token_endpoint: str,
         client_id: str,
         *,
-        verify: bool | str = True,
+        verify: bool | ssl.SSLContext = True,
     ) -> None:
         self.location = location
         self.verify = verify
@@ -122,11 +124,16 @@ def __init__(
         if verify is True and diracx_preferences.ca_path:
             verify = str(diracx_preferences.ca_path)
         kwargs["connection_verify"] = verify
+        # azure-core wants a bool/path for connection_verify, but httpx2 wants
+        # an SSLContext, so convert the CA path once here for the httpx2 calls.
+        ssl_verify = prepare_verify(verify)
         self._endpoint = str(endpoint or diracx_preferences.url)
         self._client_id = client_id or "myDIRACClientID"
 
         # Get .well-known configuration
-        openid_configuration = get_openid_configuration(self._endpoint, verify=verify)
+        openid_configuration = get_openid_configuration(
+            self._endpoint, verify=ssl_verify
+        )
 
         try:
             self.client_version = distribution("diracx").version
@@ -149,7 +156,7 @@ def __init__(
                     location=diracx_preferences.credentials_path,
                     token_endpoint=openid_configuration["token_endpoint"],
                     client_id=self._client_id,
-                    verify=verify,
+                    verify=ssl_verify,
                 ),
             ),
             **kwargs,

diracx-client/src/diracx/client/patches/client/common.py

@@ -3,12 +3,15 @@
 from __future__ import annotations
 
 __all__ = [
-    "DiracAuthMixin",
+    "get_openid_configuration",
+    "get_token",
+    "refresh_token",
 ]
 
 import fcntl
 import json
 import os
+import ssl
 from datetime import datetime, timedelta, timezone
 from dataclasses import dataclass
 from enum import Enum
@@ -19,7 +22,10 @@
 import httpx2
 import jwt
 from azure.core.credentials import AccessToken
-from diracx.core.utils import EXPIRES_GRACE_SECONDS, serialize_credentials
+from diracx.core.utils import (
+    EXPIRES_GRACE_SECONDS,
+    serialize_credentials,
+)
 from diracx.core.models import TokenResponse
 
 
@@ -37,7 +43,7 @@ class TokenResult:
 
 
 def get_openid_configuration(
-    endpoint: str, *, verify: bool | str = True
+    endpoint: str, *, verify: bool | ssl.SSLContext = True
 ) -> dict[str, str]:
     """Get the openid configuration from the .well-known endpoint"""
     response = httpx2.get(
@@ -54,7 +60,7 @@ def get_token(
     token: AccessToken | None,
     token_endpoint: str,
     client_id: str,
-    verify: bool | str,
+    verify: bool | ssl.SSLContext,
 ) -> AccessToken:
     """Get the access token if available and still valid."""
     # Immediately return the token if it is available and still valid
@@ -117,7 +123,7 @@ def refresh_token(
     client_id: str,
     refresh_token: str,
     *,
-    verify: bool | str = True,
+    verify: bool | ssl.SSLContext = True,
 ) -> TokenResponse:
     """Refresh the access token using the refresh_token flow."""
     response = httpx2.post(

diracx-client/src/diracx/client/patches/client/sync.py

@@ -6,6 +6,7 @@
     "Dirac",
 ]
 
+import ssl
 from importlib.metadata import PackageNotFoundError, distribution
 from pathlib import Path
 from typing import Any, Optional
@@ -14,6 +15,7 @@
 from azure.core.pipeline import PipelineRequest
 from azure.core.pipeline.policies import BearerTokenCredentialPolicy
 from diracx.core.preferences import DiracxPreferences, get_diracx_preferences
+from diracx.core.utils import prepare_verify
 
 from .common import get_openid_configuration, get_token
 from ..._generated._client import Dirac as _Dirac
@@ -28,7 +30,7 @@ def __init__(
         token_endpoint: str,
         client_id: str,
         *,
-        verify: bool | str = True,
+        verify: bool | ssl.SSLContext = True,
     ) -> None:
         self.location = location
         self.verify = verify
@@ -104,10 +106,15 @@ def __init__(
         if verify is True and diracx_preferences.ca_path:
             verify = str(diracx_preferences.ca_path)
         kwargs["connection_verify"] = verify
+        # azure-core wants a bool/path for connection_verify, but httpx2 wants
+        # an SSLContext, so convert the CA path once here for the httpx2 calls.
+        ssl_verify = prepare_verify(verify)
         self._client_id = client_id or "myDIRACClientID"
 
         # Get .well-known configuration
-        openid_configuration = get_openid_configuration(self._endpoint, verify=verify)
+        openid_configuration = get_openid_configuration(
+            self._endpoint, verify=ssl_verify
+        )
 
         try:
             self.client_version = distribution("diracx").version
@@ -130,7 +137,7 @@ def __init__(
                     location=diracx_preferences.credentials_path,
                     token_endpoint=openid_configuration["token_endpoint"],
                     client_id=self._client_id,
-                    verify=verify,
+                    verify=ssl_verify,
                 ),
             ),
             **kwargs,