Consolidate agent API auth onto Configuration token machinery

AgentApiClient now stores minted tokens via Configuration.update_token() and
reuses them until auth_token_ttl_msec elapses — the same rule and the same
cache as every generated client built from that Configuration. This replaces
the private JWT-exp mint cache (and its opaque-token re-mint-per-request
special case: with fixed-TTL renewal a stale token can never be served
indefinitely, so the caching test now pins the TTL behavior instead).
conductor.ai.agents._internal.token_utils is untouched — the framework
adapters' event-push paths still use it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Kowser

src/conductor/client/ai/agent_api_client.py

@@ -23,7 +23,6 @@
 
 from __future__ import annotations
 
-import base64
 import json
 import logging
 import time
@@ -42,23 +41,6 @@
 _SSE_NO_EVENT_TIMEOUT = 15  # seconds to wait for first real event before fallback
 
 
-def _decode_jwt_exp(token: str) -> float:
-    """Best-effort decode of a JWT's ``exp`` claim (unix seconds).
-
-    Returns 0.0 for opaque tokens, malformed JWTs, or tokens without ``exp`` —
-    callers treat 0 as "expiry unknown, re-mint rather than cache".
-    """
-    try:
-        parts = token.split(".")
-        if len(parts) < 2:
-            return 0.0
-        seg = parts[1] + "=" * (-len(parts[1]) % 4)
-        payload = json.loads(base64.urlsafe_b64decode(seg))
-        return float(payload.get("exp", 0) or 0)
-    except Exception:
-        return 0.0
-
-
 class SSEUnavailableError(Exception):
     """Raised when the server doesn't support SSE streaming."""
 
@@ -71,7 +53,9 @@ class AgentApiClient:
     1. an explicit ``token`` passed to the constructor — sent as-is;
     2. otherwise a JWT minted via ``POST {host}/token`` from the
        ``Configuration``'s ``authentication_settings`` (requires both key id
-       and secret), cached until ~expiry;
+       and secret), stored via ``Configuration.update_token()`` and reused
+       until the configuration's token TTL elapses — the same cache every
+       generated client built from that ``Configuration`` shares;
     3. no credentials → no header (anonymous / security-disabled servers).
     """
 
@@ -84,8 +68,6 @@ def __init__(
         self._server_url = (configuration.host or "").rstrip("/")
         self._token_static = token or ""
         self._client: Optional[httpx.AsyncClient] = None
-        self._token: str = ""
-        self._token_exp: float = 0.0
 
     def _mint_credentials(self) -> Optional[tuple]:
         """(key_id, key_secret) when the configuration can mint, else None."""
@@ -95,12 +77,16 @@ def _mint_credentials(self) -> Optional[tuple]:
         return settings.key_id, settings.key_secret
 
     def _cached_token_header(self) -> Optional[Dict[str, str]]:
-        # Reuse the cached token only if it has a decodable expiry and isn't near
-        # it. A token with no decodable exp (_token_exp == 0.0) is NOT cached —
-        # re-mint it (matches the C# SDK; avoids serving a stale token forever).
-        if self._token and self._token_exp != 0.0 and time.time() < self._token_exp - 30:
-            return {"X-Authorization": self._token}
-        return None
+        # Same TTL rule as the generated ApiClient's auth headers: a token
+        # stored on the Configuration is reused until auth_token_ttl_msec
+        # elapses, then re-minted.
+        token = self._configuration.AUTH_TOKEN
+        if not token:
+            return None
+        now = round(time.time() * 1000)
+        if now - self._configuration.token_update_time > self._configuration.auth_token_ttl_msec:
+            return None
+        return {"X-Authorization": token}
 
     async def _auth_headers(self) -> Dict[str, str]:
         """``X-Authorization`` header for secured hosts (orkes); {} when anonymous."""
@@ -126,8 +112,7 @@ async def _auth_headers(self) -> Dict[str, str]:
             return {}
         if not token:
             return {}
-        self._token = token
-        self._token_exp = _decode_jwt_exp(token)
+        self._configuration.update_token(token)
         return {"X-Authorization": token}
 
     def _sync_headers(self) -> Dict[str, str]:
@@ -156,8 +141,7 @@ def _sync_headers(self) -> Dict[str, str]:
             return {}
         if not token:
             return {}
-        self._token = token
-        self._token_exp = _decode_jwt_exp(token)
+        self._configuration.update_token(token)
         return {"X-Authorization": token}
 
     async def _get_client(self) -> httpx.AsyncClient:

tests/unit/ai/test_http_client.py

@@ -210,8 +210,8 @@ def b64url(d: dict) -> str:
 
 @pytest.mark.asyncio
 async def test_auth_key_mints_token_and_caches_it():
-    """A minted token WITH a decodable (future) exp is cached across requests —
-    minted exactly once."""
+    """A minted token is stored on the Configuration and reused across
+    requests until its TTL elapses — minted exactly once."""
     token_calls = {"count": 0}
     jwt = _jwt_with_exp(4102444800)  # ~2100 → far future
 
@@ -232,9 +232,11 @@ async def handler(request: httpx.Request) -> httpx.Response:
 
 
 @pytest.mark.asyncio
-async def test_auth_key_opaque_token_is_reminted_not_cached_forever():
-    """A token with no decodable exp must NOT be cached indefinitely — it is
-    re-minted on each request (matches the C# SDK; avoids serving a stale token)."""
+async def test_opaque_token_cached_for_configuration_ttl():
+    """An opaque (non-JWT) token is cached like any other: stored on the
+    Configuration and reused until auth_token_ttl_min elapses — the same
+    fixed-TTL renewal rule every generated client uses, so a stale token can
+    never be served indefinitely."""
     token_calls = {"count": 0}
 
     async def handler(request: httpx.Request) -> httpx.Response:
@@ -246,7 +248,12 @@ async def handler(request: httpx.Request) -> httpx.Response:
     client = _make_client(handler, auth_key="key1", auth_secret="secret1")
     await client.start_agent({"prompt": "one"})
     await client.start_agent({"prompt": "two"})
-    assert token_calls["count"] == 2  # no exp → not cached → minted each call
+    assert token_calls["count"] == 1  # cached on the Configuration for its TTL
+
+    # Force the TTL to lapse → the next request re-mints.
+    client._api._configuration.token_update_time = 0
+    await client.start_agent({"prompt": "three"})
+    assert token_calls["count"] == 2
     await client.close()