fixup! feat(platform): support external token providers and simplify caching

Author: akunft

src/aignostics/platform/_client.py

@@ -29,6 +29,10 @@
 
 from ._settings import settings
 
+# Safety bound for the external token-provider cache.  In normal usage callers
+# reuse a single provider reference, so this limit should never be reached.
+_MAX_EXTERNAL_CLIENTS = 16
+
 RETRYABLE_EXCEPTIONS = (
     ServiceException,
     Urllib3TimeoutError,
@@ -290,6 +294,13 @@ def get_api_client(cache_token: bool = True, token_provider: Callable[[], str] |
 
         # Store in the appropriate singleton cache
         if token_provider is not None:
+            if len(Client._api_client_external) >= _MAX_EXTERNAL_CLIENTS:
+                logger.warning(
+                    "External token provider cache exceeded {} entries; clearing to prevent resource leak. "
+                    "Reuse a stable token_provider reference for optimal connection reuse.",
+                    _MAX_EXTERNAL_CLIENTS,
+                )
+                Client._api_client_external.clear()
             Client._api_client_external[token_provider] = api_client
         elif cache_token:
             Client._api_client_cached = api_client

tests/aignostics/platform/client_token_provider_test.py

@@ -205,3 +205,26 @@ def test_none_token_provider_no_warning() -> None:
 
     assert result == {}
     mock_logger.warning.assert_not_called()
+
+
+@pytest.mark.unit
+def test_external_provider_cache_bounded() -> None:
+    """Test that _api_client_external is bounded to _MAX_EXTERNAL_CLIENTS entries."""
+    from aignostics.platform._client import _MAX_EXTERNAL_CLIENTS
+
+    with (
+        patch("aignostics.platform._client.ApiClient"),
+        patch.object(_AuthenticatedApi, "__init__", lambda self, *a, **kw: None),
+        patch("aignostics.platform._client.logger") as mock_logger,
+    ):
+        # Create more clients than the limit, each with a distinct provider
+        for i in range(_MAX_EXTERNAL_CLIENTS + 5):
+            Client(token_provider=_make_provider(f"token-{i}"))
+
+        # Cache must not exceed the limit (cleared + 1 new entry after overflow)
+        assert len(Client._api_client_external) <= _MAX_EXTERNAL_CLIENTS
+
+        # A warning should have been logged when the cache was cleared
+        mock_logger.warning.assert_called()
+        warning_msg = mock_logger.warning.call_args[0][0]
+        assert "resource leak" in warning_msg