fix: address some more concerns

Author: SoulPancake

src/main/java/dev/openfga/sdk/api/BaseStreamingApi.java

@@ -177,6 +177,8 @@ protected HttpRequest buildHttpRequest(String method, String path, Object body,
             }
 
             return requestBuilder.build();
+        } catch (FgaInvalidParameterException e) {
+            throw e;
         } catch (Exception e) {
             throw new ApiException(e);
         }

src/main/java/dev/openfga/sdk/api/auth/OAuth2Client.java

@@ -76,11 +76,13 @@ public CompletableFuture<String> getAccessToken() throws FgaInvalidParameterExce
                     // after inFlight becomes null immediately sees a valid token.
                     snapshot.set(new TokenSnapshot(token, Instant.now().plusSeconds(response.getExpiresInSeconds())));
 
-                    telemetry.metrics().credentialsRequest(1L, new HashMap<>());
-
                     // Clear before completing
                     inFlight.set(null);
                     promise.complete(token);
+
+                    // Telemetry fires after the gate is cleared and waiters are unblocked,
+                    // so a slow or throwing metrics call cannot stall the in-flight promise.
+                    telemetry.metrics().credentialsRequest(1L, new HashMap<>());
                 }
             });
         } catch (Exception e) {

src/main/java/dev/openfga/sdk/api/client/ApiClient.java

@@ -53,6 +53,10 @@ public class ApiClient {
     private Consumer<HttpRequest.Builder> interceptor;
     private Consumer<HttpResponse<InputStream>> responseInterceptor;
     private Consumer<HttpResponse<String>> asyncResponseInterceptor;
+    // NOTE: unbounded — one entry per unique set of client credentials for the lifetime of this ApiClient.
+    // This is intentional for multi-tenant use cases, but stale entries accumulate if credentials rotate
+    // frequently (e.g. per-request dynamic credentials). In those cases, callers should reuse the same
+    // ClientCredentials object or manage ApiClient lifecycle to bound memory growth.
     private final ConcurrentMap<CredentialsCacheKey, OAuth2Client> oAuth2Clients = new ConcurrentHashMap<>();
 
     /**

…penfga/sdk/api/auth/AccessTokenTest.java …nfga/sdk/api/auth/TokenSnapshotTest.javasrc/test/java/dev/openfga/sdk/api/auth/AccessTokenTest.java renamed to src/test/java/dev/openfga/sdk/api/auth/TokenSnapshotTest.java src/test/java/dev/openfga/sdk/api/auth/AccessTokenTest.java renamed to src/test/java/dev/openfga/sdk/api/auth/TokenSnapshotTest.java

@@ -9,7 +9,7 @@
 import org.junit.jupiter.params.provider.Arguments;
 import org.junit.jupiter.params.provider.MethodSource;
 
-class AccessTokenTest {
+class TokenSnapshotTest {
 
     private static Stream<Arguments> expTimeAndResults() {
         return Stream.of(

src/test/java/dev/openfga/sdk/api/client/StreamingApiExecutorTest.java

@@ -362,16 +362,20 @@ public void stream_appliesApiTokenAuthHeader() throws Exception {
         // Regression guard for openfga/java-sdk#330: the streaming path must attach
         // Authorization: Bearer <token> when the configuration uses API_TOKEN credentials.
         String apiToken = "stream-api-token";
+
+        // Use a real ApiClient backed by the same mockHttpClient so applyAuthHeader runs for real.
+        var authBuilder = mock(HttpClient.Builder.class);
+        when(authBuilder.executor(any())).thenReturn(authBuilder);
+        when(authBuilder.build()).thenReturn(mockHttpClient);
+        ApiClient realApiClient = new ApiClient(authBuilder, new ObjectMapper());
+
         ClientConfiguration authConfig = new ClientConfiguration()
                 .storeId(DEFAULT_STORE_ID)
                 .authorizationModelId(DEFAULT_AUTH_MODEL_ID)
                 .apiUrl(FgaConstants.TEST_API_URL)
                 .credentials(new Credentials(new ApiToken(apiToken)))
                 .readTimeout(Duration.ofMillis(250));
-        doCallRealMethod()
-                .when(mockApiClient)
-                .applyAuthHeader(any(HttpRequest.Builder.class), any(Configuration.class));
-        OpenFgaClient authFga = new OpenFgaClient(authConfig, mockApiClient);
+        OpenFgaClient authFga = new OpenFgaClient(authConfig, realApiClient);
 
         Stream<String> lines = Stream.of("{\"result\":{\"object\":\"document:1\"}}");
         HttpResponse<Stream<String>> mockResponse = mockStreamResponse(200, lines);