fixup! feat(platform): support external token providers and simplify caching

Author: akunft

src/aignostics/platform/_client.py

@@ -67,6 +67,7 @@ class Client:
 
     - Provides access to platform resources like applications, versions, and runs.
     - Handles authentication and API client configuration.
+    - Supports external token providers for machine-to-machine or custom auth flows.
     - Retries on network and server errors for specific operations.
     - Caches operation results for specific operations.
     """
@@ -88,8 +89,9 @@ def __init__(self, cache_token: bool = True, token_provider: Callable[[], str] |
                 Ignored when ``token_provider`` is supplied.
             token_provider: Optional external token provider callable. When provided,
                 bypasses internal OAuth authentication entirely. The callable must
-                return a valid bearer token string. When set, ``cache_token`` has no
-                effect because the external provider manages its own token lifecycle.
+                return a raw access token string (without the ``Bearer `` prefix).
+                When set, ``cache_token`` has no effect because the external provider
+                manages its own token lifecycle.
 
         Sets up resource accessors for applications, versions, and runs.
         """
@@ -292,7 +294,10 @@ def get_api_client(cache_token: bool = True, token_provider: Callable[[], str] |
         client.user_agent = user_agent()
         api_client = _AuthenticatedApi(client, effective_provider)
 
-        # Store in the appropriate singleton cache
+        # Store in the appropriate singleton cache.
+        # For external providers we use a simple bounded dict rather than LRU:
+        # switching providers is rare in practice, and a full clear is simpler
+        # than tracking access order while still bounding memory.
         if token_provider is not None:
             if len(Client._api_client_external) >= _MAX_EXTERNAL_CLIENTS:
                 logger.warning(

src/aignostics/platform/_operation_cache.py

@@ -13,6 +13,7 @@
 
 from __future__ import annotations
 
+import functools
 import hashlib
 import time
 import typing as t
@@ -121,6 +122,7 @@ def cached_operation(
     """
 
     def decorator(func: Callable[P, T]) -> Callable[P, T]:
+        @functools.wraps(func)
         def wrapper(*args: P.args, **kwargs: P.kwargs) -> T:
             # Check if nocache is requested and remove it from kwargs before passing to func
             nocache = kwargs.pop("nocache", False)

src/aignostics/platform/resources/runs.py

@@ -112,7 +112,7 @@ class Run(_AuthenticatedResource):
     """
 
     def __init__(self, api: _AuthenticatedApi, run_id: str) -> None:
-        """Initializes an Run instance.
+        """Initializes a Run instance.
 
         Args:
             api (_AuthenticatedApi): The configured API client.

tests/aignostics/platform/client_token_provider_test.py

@@ -228,3 +228,37 @@ def test_external_provider_cache_bounded() -> None:
         mock_logger.warning.assert_called()
         warning_msg = mock_logger.warning.call_args[0][0]
         assert "resource leak" in warning_msg
+
+
+# --- Integration tests ---
+
+
+@pytest.mark.integration
+def test_external_provider_wires_through_to_resources() -> None:
+    """Integration: Client(token_provider=...) wires through real constructors.
+
+    Verifies that an external token provider flows through Client → _AuthenticatedApi →
+    resource classes (Applications, Runs) without any AttributeError.  Only the
+    ApiClient constructor is mocked to avoid real HTTP calls.
+    """
+    my_provider = _make_provider("integration-test-token")
+
+    with patch("aignostics.platform._client.ApiClient") as mock_api_client_cls:
+        # Create client with external provider — real _AuthenticatedApi and
+        # resource constructors (_AuthenticatedResource.__init__) run.
+        client = Client(token_provider=my_provider)
+
+        # Verify the provider is wired through the real _AuthenticatedApi
+        assert isinstance(client._api, _AuthenticatedApi)
+        assert client._api.token_provider is my_provider
+
+        # Verify resources received the same _AuthenticatedApi instance
+        assert client.applications._api is client._api
+        assert client.runs._api is client._api
+        assert client.versions._api is client._api
+
+        # Verify the Configuration passed to ApiClient produces the correct auth header
+        config = mock_api_client_cls.call_args[0][0]
+        assert isinstance(config, _OAuth2TokenProviderConfiguration)
+        auth = config.auth_settings()
+        assert auth["OAuth2AuthorizationCodeBearer"]["value"] == "Bearer integration-test-token"