Implement token caching with automatic renewal#289
Conversation
Replace the current AuthenticationInterceptor with a wrapped HttpHandler that fetches tokens on-demand during requests.
Invalidate token on credentials change
Add ClearCredentials method to client.
There was a problem hiding this comment.
Pull request overview
This PR reworks how EtcdClient applies authentication by moving from a gRPC Interceptor that reads a cached token to an HttpMessageHandler that fetches and caches tokens on-demand, enabling automatic renewal during reconnects (notably for watch streams).
Changes:
- Replace
AuthenticationInterceptortoken injection with a newAuthenticationHttpHandlerthat fetches/caches tokens and bypasses the Authenticate RPC to avoid recursion. - Update
EtcdClientauthentication APIs to support token cache duration configuration and credential clearing/invalidation. - Replace unit tests for the removed interceptor with new unit tests for the handler; adjust integration tests and update auth docs.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 8 comments.
Show a summary per file
| File | Description |
|---|---|
| dotnet-etcd/etcdClient.cs | Installs AuthenticationHttpHandler, adds credential/token-cache configuration and lazy token acquisition via RequestTokenAsync. |
| dotnet-etcd/AuthenticationInterceptor.cs | Removes the old interceptor-based auth approach. |
| dotnet-etcd/AuthenticationHttpHandler.cs | Introduces a delegating handler to attach, cache, and refresh auth tokens on outgoing requests. |
| dotnet-etcd.Tests/Unit/AuthenticationInterceptorTests.cs | Removes tests for the deleted interceptor. |
| dotnet-etcd.Tests/Unit/AuthenticationHttpHandlerTests.cs | Adds unit coverage for header injection, caching, invalidation, and concurrency behavior in the new handler. |
| dotnet-etcd.Tests/Integration/AuthClientIntegrationTests.cs | Minor updates and ensures credentials can be cleared during auth setup/teardown flows. |
| docs/authentication/api-reference.md | Documents the new token cache duration parameter and updated credential behavior. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Store credentials in record instead of struct to prevent torn read / write race condition.
Store cached token with expiration in record to prevent race condition during read / write.
Overwrite existing authorization header.
|
@shubhamranjan The failing integration test seems to be unrelated to my change and was fixed in PR-293. I just merged the fix into this branch. |
|
cool, thank you. I will test this branch myself locally to see if all is fine. |
Replace the current AuthenticationInterceptor with a wrapped HttpHandler that fetches tokens on-demand during requests.
This also fixes Issue 283 where the watch can no longer re-establish once the cached token has expired.
Please ensure your pull request adheres to the following guidelines:
* [owner/repo](link)Thanks for contributing!