refactor(client): drop private httpx imports for proxy discovery

connect/client/fluent.py imported `Proxy` from httpx._config and
`get_environment_proxies` from httpx._utils. Both are private httpx APIs
that can change or vanish on any minor release, and the import happens at
module load, so a break would take down the whole client, not just proxy
support.

Reimplement the environment proxy discovery locally as
_get_environment_proxies() on top of stdlib urllib.request.getproxies()
and ipaddress, faithfully porting httpx 0.28's algorithm: http/https/all
schemes (normalizing bare host:port to a http:// URL) and NO_PROXY
handling for domains, IPv4, IPv6, localhost, explicit-scheme hosts, and
the NO_PROXY=* global bypass. Use the public httpx.Proxy instead of the
private one.

Add tests for this previously untested logic (scheme normalization, each
NO_PROXY host form, and the wildcard bypass). All 407 tests pass.

Author: pcaro

connect/client/fluent.py

@@ -4,15 +4,15 @@
 # Copyright (c) 2025 CloudBlue. All Rights Reserved.
 #
 import contextvars
+import ipaddress
 import threading
 from functools import cache
 from json.decoder import JSONDecodeError
 from typing import Union
+from urllib.request import getproxies
 
 import httpx
 import requests
-from httpx._config import Proxy
-from httpx._utils import get_environment_proxies
 from requests.adapters import HTTPAdapter
 
 from connect.client.constants import CONNECT_ENDPOINT_URL, CONNECT_SPECS_URL
@@ -240,6 +240,59 @@ def _get_namespace_class(self):
 _SSL_CONTEXT = httpx.create_ssl_context()
 
 
+def _is_ipv4_hostname(hostname):
+    try:
+        ipaddress.IPv4Address(hostname.split('/')[0])
+    except ValueError:
+        return False
+    return True
+
+
+def _is_ipv6_hostname(hostname):
+    try:
+        ipaddress.IPv6Address(hostname.split('/')[0])
+    except ValueError:
+        return False
+    return True
+
+
+def _get_environment_proxies():
+    """
+    Build httpx mount patterns from the standard proxy environment variables
+    (HTTP_PROXY / HTTPS_PROXY / ALL_PROXY / NO_PROXY and lowercase variants).
+
+    Ported from httpx's internal ``get_environment_proxies`` so we don't depend
+    on the private ``httpx._utils`` module.
+    """
+    proxy_info = getproxies()
+    mounts = {}
+
+    for scheme in ('http', 'https', 'all'):
+        if proxy_info.get(scheme):
+            hostname = proxy_info[scheme]
+            mounts[f'{scheme}://'] = hostname if '://' in hostname else f'http://{hostname}'
+
+    no_proxy_hosts = [host.strip() for host in proxy_info.get('no', '').split(',')]
+    for hostname in no_proxy_hosts:
+        # NO_PROXY=* bypasses every proxy, so ignore all proxy configuration.
+        if hostname == '*':
+            return {}
+        if not hostname:
+            continue
+        if '://' in hostname:
+            mounts[hostname] = None
+        elif _is_ipv4_hostname(hostname):
+            mounts[f'all://{hostname}'] = None
+        elif _is_ipv6_hostname(hostname):
+            mounts[f'all://[{hostname}]'] = None
+        elif hostname.lower() == 'localhost':
+            mounts[f'all://{hostname}'] = None
+        else:
+            mounts[f'all://*{hostname}'] = None
+
+    return mounts
+
+
 @cache
 def _get_async_mounts():
     """
@@ -249,8 +302,8 @@ def _get_async_mounts():
     return {
         key: None
         if url is None
-        else httpx.AsyncHTTPTransport(verify=_SSL_CONTEXT, proxy=Proxy(url=url))
-        for key, url in get_environment_proxies().items()
+        else httpx.AsyncHTTPTransport(verify=_SSL_CONTEXT, proxy=httpx.Proxy(url=url))
+        for key, url in _get_environment_proxies().items()
     }
 
 

tests/client/test_fluent.py

@@ -6,7 +6,7 @@
 from requests import RequestException, Timeout
 
 from connect.client.exceptions import ClientError
-from connect.client.fluent import ConnectClient
+from connect.client.fluent import ConnectClient, _get_environment_proxies
 from connect.client.logger import RequestLogger
 from connect.client.models import NS, Collection
 
@@ -605,3 +605,69 @@ def test_getattr():
     assert c.__getattr__('session') == 'mysession'
     assert c.__getattr__('response') == 'myresponse'
     assert isinstance(c.__getattr__('anything'), Collection)
+
+
+def test_get_environment_proxies_schemes(mocker):
+    """
+    Verify proxy env vars are turned into the httpx mount patterns the async
+    client expects, normalizing bare host:port values to a http:// URL.
+
+    Confidence: our stdlib reimplementation of httpx's proxy discovery keeps the
+    same behaviour after dropping the private ``httpx._utils`` import.
+    """
+    mocker.patch(
+        'connect.client.fluent.getproxies',
+        return_value={
+            'http': 'proxy.example.org:8080',
+            'https': 'http://secure.example.org:8080',
+        },
+    )
+
+    mounts = _get_environment_proxies()
+
+    assert mounts['http://'] == 'http://proxy.example.org:8080'
+    assert mounts['https://'] == 'http://secure.example.org:8080'
+
+
+@pytest.mark.parametrize(
+    ('no_proxy_host', 'expected_key'),
+    (
+        ('localhost', 'all://localhost'),
+        ('.internal', 'all://*.internal'),
+        ('example.com', 'all://*example.com'),
+        ('127.0.0.1', 'all://127.0.0.1'),
+        ('::1', 'all://[::1]'),
+        ('http://direct.example.org', 'http://direct.example.org'),
+    ),
+)
+def test_get_environment_proxies_no_proxy(mocker, no_proxy_host, expected_key):
+    """
+    Verify each NO_PROXY host form (domain, IPv4, IPv6, localhost, explicit
+    scheme) maps to the mount pattern that disables proxying for it.
+
+    Confidence: hosts meant to bypass the proxy actually do, matching curl/httpx
+    NO_PROXY semantics.
+    """
+    mocker.patch(
+        'connect.client.fluent.getproxies',
+        return_value={'all': 'http://proxy.example.org:8080', 'no': no_proxy_host},
+    )
+
+    mounts = _get_environment_proxies()
+
+    assert mounts['all://'] == 'http://proxy.example.org:8080'
+    assert mounts[expected_key] is None
+
+
+def test_get_environment_proxies_wildcard_disables_all(mocker):
+    """
+    Verify NO_PROXY=* discards every configured proxy.
+
+    Confidence: the global bypass wins over any HTTP_PROXY/ALL_PROXY setting.
+    """
+    mocker.patch(
+        'connect.client.fluent.getproxies',
+        return_value={'all': 'http://proxy.example.org:8080', 'no': '*'},
+    )
+
+    assert _get_environment_proxies() == {}