AWS SDK

tmp-codegen-diff/aws-sdk/sdk/aws-runtime/src/static_stability.rs

@@ -21,21 +80,83 @@

 use aws_credential_types::StaticStabilityEligible;
 use aws_smithy_async::future::timeout::Timeout;
 use aws_smithy_async::rt::sleep::AsyncSleep;
 use aws_smithy_runtime_api::box_error::BoxError;
 use aws_smithy_runtime_api::client::identity::{
     Identity, IdentityCachePartition, IdentityFuture, ResolveCachedIdentity, ResolveIdentity,
     SharedIdentityCache, SharedIdentityResolver,
 };
 use aws_smithy_runtime_api::client::runtime_components::{
     RuntimeComponents, RuntimeComponentsBuilder,
 };
 use aws_smithy_runtime_api::shared::IntoShared;
 use aws_smithy_types::config_bag::ConfigBag;
 use aws_smithy_types::retry::RetryConfig;
 use aws_smithy_types::timeout::TimeoutConfig;
 use std::collections::HashMap;
 use std::error::Error;
 use std::fmt;
 use std::sync::{Arc, Mutex, RwLock};
 use std::time::{Duration, SystemTime};

 use tracing::Instrument;
-42
 // Blocking refresh point before expiration
 const DEFAULT_MANDATORY_WINDOW: Duration = Duration::from_secs(60);
 // Refresh point before expiry for caching-only (ineligible) identities
 const CACHING_ONLY_BUFFER_TIME: Duration = Duration::from_secs(10);
 // Uniform backoff floor after a failed refresh.
 const BACKOFF_MIN_SECS: u64 = 300;
 // Uniform backoff jitter span (300..=600s total).
 const BACKOFF_JITTER_SECS: u64 = 300;
 // Non-recoverable error cache floor + jitter span (1..=5s total).
 const ERROR_CACHE_MIN_SECS: u64 = 1;
 const ERROR_CACHE_JITTER_SECS: u64 = 4;
-54
 const DEFAULT_CONNECT_TIMEOUT: Duration = Duration::from_millis(3100);
-56
 // NOTE: `pessimistic_load_timeout` below is deliberately duplicated from
 // `aws_smithy_runtime::client::identity::cache::lazy::pessimistic_load_timeout` rather than
 // imported, to avoid the one-way `pub` API exposure.
 //
 // Derive a pessimistic load timeout from the configured retry/timeout so the source's own retries
 // can finish before the cache kills the future.
 fn pessimistic_load_timeout(config_bag: &ConfigBag) -> Duration {

↧ Expand context

     let retry_config = config_bag
         .load::<RetryConfig>()
         .cloned()
         .unwrap_or_else(RetryConfig::standard);
     let timeout_config = config_bag
         .load::<TimeoutConfig>()
         .cloned()
         .unwrap_or_else(TimeoutConfig::disabled);
-72
     let attempts = retry_config.max_attempts();
     let initial_backoff = retry_config.initial_backoff().as_secs_f64();
     let max_backoff = retry_config.max_backoff().as_secs_f64();
-76
     // Worst-case total backoff: sum of min(initial * 2^i, max_backoff) for each retry.
     let total_backoff: f64 = (0..attempts.saturating_sub(1))
         .map(|i| (initial_backoff * 2.0_f64.powi(i as i32)).min(max_backoff))
         .sum();
-81
     // Per-attempt ceiling: connect_timeout (floored at the default, doubled to approximate a full
     // attempt) or operation_attempt_timeout when larger.

@@ -154,157 +213,228 @@

↥ Expand context

     // Read-mostly: the hit path takes only a shared read lock.
     fn partition(&self, key: IdentityCachePartition) -> Arc<Partition> {
         if let Some(p) = self.partitions.read().unwrap().get(&key).cloned() {
             return p;
-161
+        }
         // Unbounded: a client-level cache sees only its configured resolvers (a small, static set),
         // and per-operation `config_override` uses its own cache — so partitions don't grow with
         // request volume. `entry` also collapses the check-then-insert race with another writer.
         self.partitions
             .write()
             .unwrap()
             .entry(key)
             .or_insert_with(|| Arc::new(Partition::default()))
             .clone()
-171
+    }
-172
     fn snapshot_partitions(&self) -> Vec<Arc<Partition>> {
         self.partitions.read().unwrap().values().cloned().collect()
-175
+    }
-176

     // Refresh a partition from the source, then commit (success) or serve-cached/back-off/raise
     // (failure). The source `.await` is held under the async `refresh_gate` only (acquired by the
     // caller); the sync `state` lock is taken only for the brief snapshot/commit sections.
     async fn refresh(
         &self,
         part: &Partition,
         resolver: &SharedIdentityResolver,
         runtime_components: &RuntimeComponents,
         config_bag: &ConfigBag,
     ) -> Result<Identity, BoxError> {
         // Non-recoverable error cache: if a terminal failure is still cached, re-raise it without
         // contacting the source, so a caller looping on the error cannot hammer the source. Checked
         // here — the caller already holds the refresh gate — before any source call.
-+
+        {
             let st = part.state.lock().unwrap();
             if let (Some(err), Some(expires_at)) = (&st.cached_error, st.cached_error_expires_at) {
                 if runtime_components.time_source().expect("validated").now() < expires_at {
                     return Err(err.clone().into());
-+
+                }
-+
+            }
-+
+        }
-+
         let prev = part.state.lock().unwrap().cached.clone();
-200
         let sleep_impl = runtime_components.sleep_impl().expect("validated");
         let load_timeout = self
             .load_timeout
             .unwrap_or_else(|| pessimistic_load_timeout(config_bag));
         let timeout_future = sleep_impl.sleep(load_timeout);
         let resolved: Result<Identity, BoxError> = async move {
             match Timeout::new(
                 resolver.resolve_identity(runtime_components, config_bag),

↧ Expand context

                 timeout_future,
-210
+            )
             .await
-212
+            {
                 Ok(result) => result,
                 // Timeout: converts a *hung* source into a serve-cached decision (recoverable).
                 Err(_elapsed) => {
                     Err(format!("credential resolution timed out after {:?}", load_timeout).into())
-217
+                }
-218
+            }
-219
+        }
         .instrument(tracing::debug_span!("load_identity"))
         .await;
-222
         // The source call may have taken a while (up to the load timeout), so read `now` fresh from
         // the (validated) runtime time source rather than a pre-await value.
         let now = runtime_components.time_source().expect("validated").now();
-226
         // An `Ok` response already expired by `now` is treated as a failed refresh (retain + back
         // off), not cached as fresh.

@@ -223,238 +289,314 @@

↥ Expand context

             Ok(id) => {
                 let mut st = part.state.lock().unwrap();
                 st.cached = Some(id.clone());
                 match id.expiration() {
                     Some(expiry) => {
                         st.expiration = Some(expiry);
                         if eligible(&id) {
                             // Static-stability overlay: advisory + mandatory windows.
                             let advisory_window = self
                                 .advisory_window_override
                                 .unwrap_or_else(|| advisory_window_for(lifetime(expiry, now)));
                             st.advisory_at = Some(sub(expiry, advisory_window));
                             st.mandatory_at = Some(sub(expiry, DEFAULT_MANDATORY_WINDOW));
                         } else {
                             // Ineligible (custom/process): a single caching-only window at expiry.
                             let at = sub(expiry, CACHING_ONLY_BUFFER_TIME);
                             st.advisory_at = Some(at);
                             st.mandatory_at = Some(at);
-256
+                        }
-257
+                    }

                     // Non-expiring identity: no expiration-based refresh. Served indefinitely
                     // (classify returns Valid when `expiration` is None); only invalidation, which
                     // sets `expiration = now`, forces a refresh.
                     None => {
                         st.expiration = None;
                         st.advisory_at = None;
                         st.mandatory_at = None;
-265
+                    }
-266
+                }
                 st.next_refresh_allowed_at = None; // clear backoff
                 st.cached_error = None; // a success clears any cached terminal error
                 st.cached_error_expires_at = None;
                 Ok(id)
-271
+            }
             Err(err) => {
                 // A non-recoverable error raises immediately — before backoff and
                 // before serve-cached. The cache holds only a predicate, naming no error types.
                 // A non-recoverable error raises immediately — before backoff and before
                 // serve-cached. The cache holds only a predicate, naming no error types.
                 if self.non_recoverable.as_ref().is_some_and(|p| p(&err)) {
                     return Err(err);
                     // Cache the terminal error for a short, jittered window so repeat callers are
                     // served it without another source call; still raise it to this caller now.
                     let cached = CachedNonRecoverableError(Arc::from(err));
-+
+                    {
                         let mut st = part.state.lock().unwrap();
                         st.cached_error = Some(cached.clone());
                         st.cached_error_expires_at = Some(now + jittered_error_cache());
-+
+                    }
                     return Err(cached.into());
-285
+                }
                 let mut st = part.state.lock().unwrap();
                 // Backoff AND serve-stale are BOTH static stability — gated on eligibility.
                 match prev {
                     Some(c) if eligible(&c) => {
                         st.next_refresh_allowed_at =
                             Some(now + self.backoff_override.unwrap_or_else(jittered_backoff));
                         tracing::warn!(
                             error = ?err,
                             "credential refresh failed; serving cached credentials (static stability)"

↧ Expand context

                         );
                         Ok(c)
-297
+                    }
                     // Ineligible: serve only if still valid, else raise.
                     Some(c) if !expired(st.expiration, now) => Ok(c),
                     _ => Err(err),
-301
+                }
-302
+            }
-303
+        }
-304
+    }
-305
+}
-306
 impl ResolveCachedIdentity for StaticStabilityCache {
     fn validate_base_client_config(
         &self,
         runtime_components: &RuntimeComponentsBuilder,
         _cfg: &ConfigBag,
     ) -> Result<(), BoxError> {
         validate(
             runtime_components.time_source().is_some(),

@@ -362,387 +421,449 @@

↥ Expand context

 #[derive(Debug, Default)]
 struct Partition {
     // Guards the synchronous snapshot/commit sections. NEVER held across `.await`.
     state: Mutex<CachedState>,
     // Async single-flight gate for the source call. Held across `.await`.
     refresh_gate: tokio::sync::Mutex<()>,
-393
+}
-394
 impl Partition {
     // Re-classify after acquiring the gate: another task may have refreshed while we waited.
     fn recheck(&self, now: SystemTime) -> Option<Identity> {
         let st = self.state.lock().unwrap();
         match classify(&st, now) {
             Decision::Valid(id) | Decision::RateLimited(id) => Some(id),
             _ => None,
-402
+        }
-403
+    }
-404
+}
-405
 #[derive(Debug, Default)]

 struct CachedState {
     // Retain-always; only ever *replaced* on success, never cleared.
     cached: Option<Identity>,
     expiration: Option<SystemTime>,
     // Non-blocking refresh point.
     advisory_at: Option<SystemTime>,
     // Blocking refresh point (<= expiration).
     mandatory_at: Option<SystemTime>,
     // Backoff gate after a failed refresh.
     next_refresh_allowed_at: Option<SystemTime>,
     // Short-lived, jittered cache of a non-recoverable error, re-raised to repeat callers.
     cached_error: Option<CachedNonRecoverableError>,
     cached_error_expires_at: Option<SystemTime>,
-420
+}
-421
 enum Decision {
     Valid(Identity),
     RateLimited(Identity),
     Advisory(Identity),
     Mandatory,
     Initial,
-428
+}
-429

↧ Expand context

 fn classify(st: &CachedState, now: SystemTime) -> Decision {
     let Some(id) = st.cached.clone() else {
         return Decision::Initial;
     };
     // Non-expiring identity (source reported no expiration): serve indefinitely. Only invalidation
     // (which sets `expiration = now`) forces a refresh.
     if st.expiration.is_none() {
         return Decision::Valid(id);
-438
+    }
     if matches!(st.advisory_at, Some(a) if now < a) {
         return Decision::Valid(id);
-441
+    }
     // Backoff gate sits AFTER Valid, BEFORE the advisory/mandatory split so an
     // expired-but-backed-off credential is served without contacting the source.
     if matches!(st.next_refresh_allowed_at, Some(t) if now < t) {
         return Decision::RateLimited(id);
-446
+    }
     match st.mandatory_at {
         Some(m) if now < m => Decision::Advisory(id),
         _ => Decision::Mandatory, // at/after mandatory_at, includes past-expiry

@@ -427,455 +486,536 @@

↥ Expand context

-455
+}
-456
 fn expired(expiration: Option<SystemTime>, now: SystemTime) -> bool {
     matches!(expiration, Some(exp) if exp <= now)
-459
+}
-460
 fn sub(t: SystemTime, d: Duration) -> SystemTime {
     t.checked_sub(d).unwrap_or(t)
-463
+}
-464
 fn lifetime(expiry: SystemTime, now: SystemTime) -> Duration {
     expiry.duration_since(now).unwrap_or_default()
-467
+}
-468
 // Advisory window tiers, selected by remaining credential lifetime:
 // `<= 20min -> 5min`, `> 20min && < 90min -> 15min`, `>= 90min -> 60min`.
 fn advisory_window_for(lifetime: Duration) -> Duration {
     if lifetime <= Duration::from_secs(20 * 60) {
         Duration::from_secs(5 * 60)
     } else if lifetime < Duration::from_secs(90 * 60) {

         Duration::from_secs(15 * 60)
     } else {
         Duration::from_secs(60 * 60)
-478
+    }
-479
+}
-480
 fn jittered_backoff() -> Duration {
     Duration::from_secs(BACKOFF_MIN_SECS + fastrand::u64(0..=BACKOFF_JITTER_SECS))
-483
+}
-484
 fn jittered_error_cache() -> Duration {
     Duration::from_secs(ERROR_CACHE_MIN_SECS + fastrand::u64(0..=ERROR_CACHE_JITTER_SECS))
-+
+}
-+
 // A `Clone` wrapper so a cached non-recoverable error can be re-raised to multiple callers
 // (`BoxError` is not `Clone`). The underlying error is exposed through `source`, matching how
 // `Arc`-wrapped errors elsewhere in the runtime surface their cause.
 #[derive(Clone, Debug)]
 struct CachedNonRecoverableError(Arc<dyn Error + Send + Sync>);
-+
 impl fmt::Display for CachedNonRecoverableError {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         fmt::Display::fmt(&self.0, f)
-+
+    }
-+
+}
-+
 impl Error for CachedNonRecoverableError {
     fn source(&self) -> Option<&(dyn Error + 'static)> {
         Some(self.0.as_ref())
-+
+    }
-+
+}
-+
 // Default non-recoverable predicate injected into the cache by the AWS layer: a terminal
 // `CredentialsError::Unrecoverable` anywhere in the source chain bypasses backoff and static
 // stability. Providers such as `ChainProvider` wrap the base-provider error, so walk the chain
 // rather than inspecting only the outermost error.
 fn aws_non_recoverable(err: &BoxError) -> bool {
     let mut source: Option<&(dyn Error + 'static)> = Some(&**err);
     while let Some(e) = source {
         if e.downcast_ref::<CredentialsError>()
             .is_some_and(CredentialsError::is_unrecoverable)
-516
+        {

↧ Expand context

             return true;
-518
+        }
         source = e.source();
-520
+    }
     false
-522
+}
-523
 fn validate(has_time_source: bool, has_sleep_impl: bool) -> Result<(), BoxError> {
     if !has_time_source {
         return Err("StaticStabilityCache requires a time source to be configured".into());
-527
+    }
     if !has_sleep_impl {
         return Err(
             "StaticStabilityCache requires an async sleep implementation to be configured".into(),
         );
-532
+    }
     Ok(())
-534
+}
-535
 /// Builder for [`StaticStabilityCache`].

@@ -690,740 +773,821 @@

↥ Expand context

                     if s.given.access_key_id.as_deref() == Some(rejected_access_key_id.as_str()) {
                         cache.invalidate(served.as_ref().expect("a served identity"));
                     } else {
                         cache.invalidate(&identity(999, SEED_LIFE, true));
-744
+                    }
-745
+                }
                 Step::GetCredentials { expected, .. } => {
                     let (r, contacted) =
                         source_get(&cache, &resolver, &components, &cfg, &contacts).await;
                     assert_eq!(
                         contacted, expected.source_contacted,
                         "{doc}: sourceContacted"
                     );
                     match expected.result.as_str() {
                         "cachedCredentials" => {
                             let got = r.expect("cachedCredentials");
                             assert_eq!(id_of(&got), cached_id, "{doc}: cached id");
                             served = Some(got);
-758
+                        }
                         "newCredentials" => {

                             let got = r.expect("newCredentials");
                             cached_id = fresh_ids.pop_front().expect("a queued fresh id");
                             assert_eq!(id_of(&got), cached_id, "{doc}: new id");
                             served = Some(got);
-764
+                        }
                         "noCredentialsError" => assert!(r.is_err(), "{doc}: noCredentialsError"),
                         "nonRecoverableError" => {
                             let Err(e) = r else {
                                 panic!("{doc}: expected nonRecoverableError");
                             };
                             assert!(
                                 e.downcast_ref::<CredentialsError>()
                                     .is_some_and(CredentialsError::is_unrecoverable),
                                 "{doc}: nonRecoverableError"
                             );
                             // The error may be the cache's `CachedNonRecoverableError` wrapper, so
                             // check the source chain (the same detection the cache uses).
                             assert!(aws_non_recoverable(&e), "{doc}: nonRecoverableError");
-773
+                        }
                         other => panic!("{doc}: unknown result {other:?}"),
-775
+                    }
                     if let Some(w) = expected.advisory_window_seconds {
                         assert_eq!(
                             cache.advisory_window(),
                             Some(Duration::from_secs(w)),
                             "{doc}: advisoryWindowSeconds"
                         );
-782
+                    }
-783
+                }
-784
+            }
-785
+        }
-786
+    }
-787
     #[tokio::test]
     async fn test_suite() {
         let scenarios: Vec<Scenario> = serde_json::from_str(SUITE).expect("valid suite json");
         assert_eq!(scenarios.len(), 23, "expected the full modeled suite");
         assert_eq!(scenarios.len(), 24, "expected the full modeled suite");
         for s in &scenarios {
             run_scenario(s).await;
-794
+        }
-795
+    }
-796
     #[derive(Debug, Clone, PartialEq)]
     struct TestCreds {
         id: u32,
-800
+    }
-801

↧ Expand context

     fn epoch(secs: u64) -> SystemTime {
         SystemTime::UNIX_EPOCH + Duration::from_secs(secs)
-804
+    }
-805
     // Build an identity with a distinguishing id, an absolute expiration, and (optionally) the
     // static-stability eligibility marker.
     fn identity(id: u32, expiry_secs: u64, eligible: bool) -> Identity {
         let mut b = Identity::builder()
             .data(TestCreds { id })
             .expiration(epoch(expiry_secs));
         if eligible {
             b = b.property(StaticStabilityEligible);
-814
+        }
         b.build().unwrap()
-816
+    }
-817
     fn id_of(identity: &Identity) -> u32 {
         identity.data::<TestCreds>().unwrap().id
-820
+    }
-821

@@ -834,882 +893,954 @@

↥ Expand context

         // One `getCredentials` step: returns the result and whether the source was contacted.
         async fn get(&self) -> (Result<Identity, BoxError>, bool) {
             let before = self.contacts.load(Ordering::SeqCst);
             let result = self
                 .cache
                 .resolve_cached_identity(self.resolver.clone(), &self.components, &self.config_bag)
                 .await;
             let contacted = self.contacts.load(Ordering::SeqCst) > before;
             (result, contacted)
-891
+        }
-892
         fn advance_to(&self, secs: u64) {
             self.time.set_time(epoch(secs));
-895
+        }
-896
+    }
-897
     // Window selection (advisoryWindowSeconds) by remaining lifetime:
     // <=20min -> 5min, >20 && <90 -> 15min, >=90 -> 60min.
     #[test]
     fn advisory_window_selection() {

         let m = |mins: u64| Duration::from_secs(mins * 60);
         assert_eq!(advisory_window_for(m(10)), m(5));
         assert_eq!(advisory_window_for(m(20)), m(5)); // boundary, inclusive
         assert_eq!(advisory_window_for(m(21)), m(15));
         assert_eq!(advisory_window_for(m(60)), m(15));
         assert_eq!(advisory_window_for(m(89)), m(15));
         assert_eq!(advisory_window_for(m(90)), m(60)); // boundary
         assert_eq!(advisory_window_for(m(6 * 60)), m(60));
-910
+    }
-911
     // The JSON suite's determinism relies on this window staying strictly within (0s, 6s): an
     // immediate retry (0s elapsed) must still be cached, and a 6s advance must always clear it.
     #[test]
     fn jittered_error_cache_bounds() {
         for _ in 0..1000 {
             let d = jittered_error_cache();
             assert!(
                 (Duration::from_secs(1)..=Duration::from_secs(5)).contains(&d),
                 "error-cache window {d:?} out of 1..=5s"
             );
-+
+        }
-+
+    }
-+
     // A non-recoverable error wrapped by an outer provider error (as `ChainProvider` produces) is
     // still detected by walking the source chain, not just the outermost error.
     #[test]
     fn non_recoverable_walks_source_chain() {
         let wrapped: BoxError =
             CredentialsError::provider_error(CredentialsError::unrecoverable("expired SSO token"))
                 .into();
         assert!(
             aws_non_recoverable(&wrapped),
             "a nested Unrecoverable must be detected"

↧ Expand context

         );
-936
         let recoverable: BoxError = CredentialsError::provider_error("STS 503").into();
         assert!(
             !aws_non_recoverable(&recoverable),
             "no Unrecoverable anywhere in the chain"
         );
-942
+    }
-943
     // Ineligible (custom/process) identity: no serve-stale.
     // expected: a failed refresh after expiry raises rather than serving stale.
     #[tokio::test]
     async fn ineligible_error_after_expiry_is_raised() {
         let h = Harness::new(vec![Ok(identity(1, 3600, false)), Err("transient".into())]);
         assert_eq!(id_of(&h.get().await.0.unwrap()), 1);
-950
         h.advance_to(3700); // expired
         let (r, _contacted) = h.get().await;
         assert!(
             r.is_err(),

@@ -1151,1212 +1181,1304 @@

↥ Expand context

         gate.notify_one();
         let seed = cache
             .resolve_cached_identity(resolver.clone(), &components, &cfg)
             .await
             .unwrap();
         assert_eq!(id_of(&seed), 1);
         assert_eq!(contacts.load(Ordering::SeqCst), 1);
-1219
         time.set_time(epoch(3700)); // expired -> mandatory path (blocking lock + recheck)
-1221
         // Three concurrent callers + a driver that releases the single in-flight refresh.
         let get1 = cache.resolve_cached_identity(resolver.clone(), &components, &cfg);
         let get2 = cache.resolve_cached_identity(resolver.clone(), &components, &cfg);
         let get3 = cache.resolve_cached_identity(resolver.clone(), &components, &cfg);
         let driver = async {
             tokio::task::yield_now().await;
             gate.notify_one();
         };
         let (r1, r2, r3, ()) = tokio::join!(get1, get2, get3, driver);
-1231

         // Every caller receives the one refreshed identity; only one refresh contacted the source.
         assert_eq!(id_of(&r1.unwrap()), 2);
         assert_eq!(id_of(&r2.unwrap()), 2);
         assert_eq!(id_of(&r3.unwrap()), 2);
         assert_eq!(
             contacts.load(Ordering::SeqCst),
 ,
             "one refresh shared by all waiters"
         );
-1241
+    }
-+
     // Concurrency + non-recoverable: the one caller that refreshes fails non-recoverably and
     // caches the error; the waiters reuse the cached error instead of each re-contacting the
     // source.
     #[tokio::test]
     async fn mandatory_concurrent_non_recoverable_reuses_cached_error() {
         let time = ManualTimeSource::new(epoch(0));
         let (_tick, sleep) = tick_advance_time_and_sleep();
         let components = RuntimeComponentsBuilder::for_tests()
             .with_time_source(Some(time.clone()))
             .with_sleep_impl(Some(sleep))
             .build()
             .unwrap();
         let cfg = ConfigBag::base();
         let gate = Arc::new(tokio::sync::Notify::new());
         let contacts = Arc::new(AtomicUsize::new(0));
         let resolver = SharedIdentityResolver::new(GatedSource {
             gate: gate.clone(),
             contacts: contacts.clone(),
             results: Mutex::new(vec![
                 Ok(identity(1, 3600, true)),
                 Err(CredentialsError::unrecoverable("terminal").into()),
             ]),
         });
         let cache = StaticStabilityCache::builder().build();
-+
         gate.notify_one();
         let seed = cache
             .resolve_cached_identity(resolver.clone(), &components, &cfg)
             .await
             .unwrap();
         assert_eq!(id_of(&seed), 1);
         assert_eq!(contacts.load(Ordering::SeqCst), 1);
-+
         time.set_time(epoch(3700)); // expired -> mandatory path
-+
         // Three concurrent callers + a driver that releases the single in-flight refresh.
         let get1 = cache.resolve_cached_identity(resolver.clone(), &components, &cfg);
         let get2 = cache.resolve_cached_identity(resolver.clone(), &components, &cfg);
         let get3 = cache.resolve_cached_identity(resolver.clone(), &components, &cfg);
         let driver = async {
             tokio::task::yield_now().await;
             gate.notify_one();
         };
         let (r1, r2, r3, ()) = tokio::join!(get1, get2, get3, driver);
-+
         // Every caller receives the non-recoverable error; only one contacted the source.
         for r in [r1, r2, r3] {
             let Err(e) = r else {
                 panic!("expected a non-recoverable error");
             };
             assert!(
                 aws_non_recoverable(&e),
                 "each waiter gets the non-recoverable error"
             );
-+
+        }
         assert_eq!(
             contacts.load(Ordering::SeqCst),
 ,
             "one refresh failed for all callers; the cache suppressed re-contacts"
         );
-+
+    }
-1304
+}

tmp-codegen-diff/aws-sdk/sdk/aws-runtime/test-data/credential-refresh-tests.json

@@ -161,161 +255,280 @@

↥ Expand context

         "documentation": "Initial fetch returns 6-hour credentials, selecting the 60-minute advisory window.",
         "expected": { "result": "newCredentials", "sourceContacted": true, "rateLimited": false, "advisoryWindowSeconds": 3600 }
       },
-164
+      {
         "type": "advanceTime",
         "seconds": 18060
       },
-168
+      {
         "type": "getCredentials",
         "response": "freshCredentials",
         "lifetimeSeconds": 600,
         "documentation": "59 minutes remain until expiration, inside the 60-minute advisory window, so the SDK refreshes. The new 10-minute credentials select the 5-minute advisory window.",
         "expected": { "result": "newCredentials", "sourceContacted": true, "rateLimited": false, "advisoryWindowSeconds": 300 }
-174
+      }
-175
+    ]
   },
-177
+  {
     "documentation": "A customer-configured advisory window overrides the table. Credentials with a 6-hour lifetime would map to 60 minutes, but the configured 30-minute window is used instead.",
     "given": { "cachedCredentials": "none", "configuredAdvisoryWindowSeconds": 1800 },
     "steps": [

-181
+      {
         "type": "getCredentials",
         "response": "freshCredentials",
         "lifetimeSeconds": 21600,
         "expected": { "result": "newCredentials", "sourceContacted": true, "rateLimited": false, "advisoryWindowSeconds": 1800 }
-186
+      }
-187
+    ]
   },
-189
-190
+  {
     "documentation": "Advisory window, non-recoverable failure: the SDK raises immediately. Because no refresh backoff is applied, the next call contacts the source again rather than being rate limited.",
     "documentation": "Advisory window, non-recoverable failure: the SDK raises immediately. No refresh backoff is applied, but the error is cached for up to 5 seconds, so a recovering call succeeds once that cache expires.",
     "given": { "cachedCredentials": "advisory" },
     "steps": [
-194
+      {
         "type": "getCredentials",
         "response": "nonRecoverableError",
         "documentation": "Non-recoverable failure: the SDK raises and does not apply the refresh backoff.",
         "expected": { "result": "nonRecoverableError", "sourceContacted": true, "rateLimited": false }
       },
-+
+      {
         "type": "advanceTime",
         "seconds": 6
       },
-204
+      {
         "type": "getCredentials",
         "response": "freshCredentials",
         "documentation": "No refresh backoff was applied, so this call contacts the source again and succeeds.",
         "documentation": "The non-recoverable error cache (max 5 seconds) has expired, so this call contacts the source again and succeeds.",
         "expected": { "result": "newCredentials", "sourceContacted": true, "rateLimited": false }
-209
+      }
-210
+    ]
   },
-212
+  {
     "documentation": "Mandatory window, non-recoverable failure: the SDK raises immediately. Because no refresh backoff is applied, the next call contacts the source again rather than being rate limited.",
     "documentation": "Mandatory window, non-recoverable failure: the SDK raises immediately. No refresh backoff is applied, but the error is cached for up to 5 seconds, so a recovering call succeeds once that cache expires.",
     "given": { "cachedCredentials": "mandatory" },
     "steps": [
-216
+      {
         "type": "getCredentials",
         "response": "nonRecoverableError",
         "documentation": "Non-recoverable failure: the SDK raises and does not apply the refresh backoff.",
         "expected": { "result": "nonRecoverableError", "sourceContacted": true, "rateLimited": false }
       },
-+
+      {
         "type": "advanceTime",
         "seconds": 6
       },
-226
+      {
         "type": "getCredentials",
         "response": "freshCredentials",
         "documentation": "No refresh backoff was applied, so this call contacts the source again and succeeds.",
         "documentation": "The non-recoverable error cache (max 5 seconds) has expired, so this call contacts the source again and succeeds.",
         "expected": { "result": "newCredentials", "sourceContacted": true, "rateLimited": false }
-231
+      }
-232
+    ]
   },
-+
+  {
     "documentation": "Non-recoverable error, then an immediate retry with no clock advance: the error is still cached, so the SDK re-raises it without contacting the source. This protects the credential source from an application that swallows the error and retries in a loop.",
     "given": { "cachedCredentials": "advisory" },
     "steps": [
-+
+      {
         "type": "getCredentials",
         "response": "nonRecoverableError",
         "documentation": "Non-recoverable failure: the SDK raises and caches the error for up to 5 seconds.",
         "expected": { "result": "nonRecoverableError", "sourceContacted": true, "rateLimited": false }
       },
-+
+      {
         "type": "getCredentials",
         "documentation": "Immediate retry with no clock advance. The cached error is still active, so the SDK re-raises it without contacting the source.",
         "expected": { "result": "nonRecoverableError", "sourceContacted": false, "rateLimited": false }
-+
+      }
-+
+    ]
   },
-251
-252
+  {
     "documentation": "Invalidate with an access key ID matching the cached credentials routes the next getCredentials through the mandatory refresh path, and the refresh succeeds.",
     "given": { "cachedCredentials": "valid", "accessKeyId": "AKID-1" },
     "steps": [
       { "type": "invalidate", "rejectedAccessKeyId": "AKID-1" },
-257
+      {
         "type": "getCredentials",
         "response": "freshCredentials",
         "expected": { "result": "newCredentials", "sourceContacted": true, "rateLimited": false }

↧ Expand context

-261
+      }
-262
+    ]
   },
-264
+  {
     "documentation": "Invalidate with a matching access key ID routes the next getCredentials through the mandatory refresh path; the refresh fails and the SDK continues using the cached credentials.",
     "given": { "cachedCredentials": "valid", "accessKeyId": "AKID-1" },
     "steps": [
       { "type": "invalidate", "rejectedAccessKeyId": "AKID-1" },
-269
+      {
         "type": "getCredentials",
         "response": "error",
         "expected": { "result": "cachedCredentials", "sourceContacted": true, "rateLimited": false }
-273
+      }
-274
+    ]
   },
-276
+  {
     "documentation": "Invalidate during an active backoff: the SDK does not contact the credential source. Once the refresh backoff has elapsed, the next getCredentials attempts a refresh.",
     "given": { "cachedCredentials": "expired", "accessKeyId": "AKID-1", "refreshBackoffSeconds": 420 },
     "steps": [
-280
+      {

@@ -297,322 +344,373 @@

↥ Expand context

     "given": { "cachedCredentials": "expired", "refreshBackoffSeconds": 420 },
     "steps": [
-324
+      {
         "type": "getCredentials",
         "response": "error",
         "documentation": "Refresh fails, so the SDK applies the refresh backoff.",
         "expected": { "result": "cachedCredentials", "sourceContacted": true, "rateLimited": false }
       },
-330
+      {
         "type": "advanceTime",
         "seconds": 300
       },
-334
+      {
         "type": "getCredentials",
         "documentation": "300s elapsed and the refresh backoff has not yet elapsed, so the SDK does not contact the credential source.",
         "expected": { "result": "cachedCredentials", "sourceContacted": false, "rateLimited": true }
       },
-339
+      {
         "type": "advanceTime",
         "seconds": 425

       },
-343
+      {
         "type": "getCredentials",
         "response": "freshCredentials",
         "documentation": "725s elapsed total and the refresh backoff has elapsed, so the SDK contacts the credential source and the refresh succeeds.",
         "expected": { "result": "newCredentials", "sourceContacted": true, "rateLimited": false }
-348
+      }
-349
+    ]
   },
-351
+  {
     "documentation": "No cached credentials and the initial fetch fails with a non-recoverable error: the SDK raises the error directly rather than a generic NoCredentialsError. Because no refresh backoff is applied, the next call contacts the source again.",
     "documentation": "No cached credentials and the initial fetch fails with a non-recoverable error: the SDK raises the error directly rather than a generic NoCredentialsError. No refresh backoff is applied, but the error is cached for up to 5 seconds, so a recovering call succeeds once that cache expires.",
     "given": { "cachedCredentials": "none" },
     "steps": [
-355
+      {
         "type": "getCredentials",
         "response": "nonRecoverableError",
         "documentation": "Non-recoverable failure: the SDK raises and does not apply the refresh backoff.",
         "expected": { "result": "nonRecoverableError", "sourceContacted": true, "rateLimited": false }
       },
-+
+      {
         "type": "advanceTime",
         "seconds": 6
       },
-365
+      {
         "type": "getCredentials",
         "response": "freshCredentials",
         "documentation": "No refresh backoff was applied, so this call contacts the source again and succeeds.",
         "documentation": "The non-recoverable error cache (max 5 seconds) has expired, so this call contacts the source again and succeeds.",
         "expected": { "result": "newCredentials", "sourceContacted": true, "rateLimited": false }
-370
+      }
-371
+    ]
-372
+  }
-373
+]

AWS SDK

Files changed:

tmp-codegen-diff/aws-sdk/sdk/aws-runtime/src/static_stability.rs

tmp-codegen-diff/aws-sdk/sdk/aws-runtime/test-data/credential-refresh-tests.json